What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Polipos/Trojan problem

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Please help, Our computer has been running very slow. I am unable to open Excel and get the following message: "Excel.exe has encountered a problem and needs to close." I am now also unable to open Word, receiving the following message: "Problem with shortcut. The Windows Installer Service could not be accessed. This can occur if you are running windows in safe mode, or if the windows installer is not correctly installed. Contact your support personnel for assistance."

I installed CureIt and ran it in the regular mode as well as safe mode. It found 7 viruses during the regular mode and none in safe mode. However, I am still unable to get my computer to work properly.

My file is as follows:

Logfile of HijackThis v1.99.1
Scan saved at 2:15:31 PM, on 2/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\1156876735\ee\AOLSoftware.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\rundll32.exe
C:\America Online 9.0\waol.exe
C:\America Online 9.0\shellmon.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1156876735\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1201971963921
O17 - HKLM\System\CCS\Services\Tcpip\..\{D78EC274-DE04-4BD8-BF64-571900AE1895}: NameServer = 205.188.146.145
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\WINDOWS\system32\msiexec.exe (file missing)
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Unknown owner - C:\Program Files\Trend Micro\BM\TMBMSRV.exe" /service (file missing)
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
Post #2
Download and run - ATF Cleaner instructions here.

Click HERE to run Panda's ActiveScan

* You need to use IE to run this scan
* Once you are on the Panda site click the Scan your PC button
* A new window will open…click the Check Now button
* Enter your Country
* Enter your State/Province
* Enter your e-mail address and click send
* Select either Home User or Company
* Click the big Scan Now button
* If it wants to install an ActiveX component allow it
* It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
* When download is complete, click on My Computer to start the scan
* When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
Post #3
I have downloaded ATF Cleaner and tried to run Panda's ActiveScan, but am using dial up and don't think it is capable of installing the ActiveX component. I let it scan for over 2 hours, with no progression in %. Any other help?
Post #5
Hijack This was removed from my computer, and now will not download so it can be used. It says it downloads but when I go to open it I have to choose the program to open it with and none of the programs actually give me the correct prompt to do anything.
Post #6
Then download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
Post #7
Here is the new log: Malwarebytes' Anti-Malware 1.05 Database version: 392 Scan type: Full Scan (A:\|C:\|F:\|) Objects scanned: 105257 Time elapsed: 40 minute(s), 15 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 5 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 2 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{85e06077-c824-43d0-a8dc-5efb17bc348a} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\HID_Layer (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\webHancer (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs (Adware.Webhancer) -> Quarantined and deleted successfully. Files Infected: C:\Program Files\webHancer\Programs\whAgent.ini (Adware.Webhancer) -> Quarantined and deleted successfully.
Post #8
Lets see if you can Run this online scan from ESET

You will need to use Internet explorer for this scan!
  • First, accept the Terms of Use
  • Click: Start
  • When asked, allow the ActiveX control to install
  • Click: Start
  • Make sure the options:
    Remove found threats, and Scan unwanted applications
    are both checked!
  • Click: Scan

When the scan finishes, use Notepad to open the ESET report.
It will be located here C:\Program Files\EsetOnlineScanner\log.txt
Post #9
New log: # version=4 # OnlineScanner.ocx=1.0.0.635 # OnlineScannerDLLA.dll=1, 0, 0, 79 # OnlineScannerDLLW.dll=1, 0, 0, 78 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=2896 (20080222) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.064 (20070717) # EOSSerial=04cd7b2662ddcf488ac3735d19844a77 # end=finished # remove_checked=true # unwanted_checked=true # utc_time=2008-02-22 09:02:44 # local_time=2008-02-22 04:02:44 (-0500, Eastern Standard Time) # country="United States" # osver=5.1.2600 NT Service Pack 2 # scanned=147580 # found=3 # scan_time=2615 C:\AOL Instant Messenger\AIM.exe Win32/Adware.WBug.A application (deleted) 00000000000000000000000000000000 C:\AOL Instant Messenger\AIM.exe »WISE »WxBug.EXE Win32/Adware.WBug.A application (error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000 C:\AOL Instant Messenger\AIM.exe »WISE »WxBug.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
Post #10
Hope this can give me the location of the file.

Click HERE to run Panda's ActiveScan

* You need to use IE to run this scan
* Once you are on the Panda site click the Scan your PC button
* A new window will open…click the Check Now button
* Enter your Country
* Enter your State/Province
* Enter your e-mail address and click send
* Select either Home User or Company
* Click the big Scan Now button
* If it wants to install an ActiveX component allow it
* It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
* When download is complete, click on My Computer to start the scan
* When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
Post #11
Panda's ActiveScan does not seem to be working on my computer. Same as last time I tried it. The download did not complete, I tried again, then restarted my computer and tried again. It gets stuck on the "Please wait a moment while ActiveScan completes the download" screen. This time I left it there for an hour with no activity. The other problem that I am having with my computer (in addition to the virus), I can not locate my Microsoft Windows 2000 CD-ROM, and am unable to use word. Any way around this? I don't know if removing this virus will restore word. Also, when I try to open excel, I receive an error stating that excel.exe had a problem and had to close.
Post #12

I don't know if removing this virus will restore word. Also, when I try to open excel, I receive an error stating that excel.exe had a problem and had to close.

I'm not sure if it will.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
Post #13
SDFix: Version 1.146

Run by [removed] on Sat 02/23/2008 at 07:52 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\SYSTEM32\TASKKILL.EXE - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-23 20:09:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4B606C91-D3A3-A6FF-AE80-672997C38135}]
"oadiakaodogleokimikljnheakafjj"=hex:64,61,64,6b,61,65,6f,61,00,80
"oahhphmdjcnbphfjocebnmandkpjpi"=hex:6a,61,61,6b,68,65,6b,65,6c,65,65,6e,66,6f,6c,61,70,6b,67,6c,00,..
"naninklehnejamgdplehhcmbcbmn"=hex:6a,61,6f,6a,70,70,6a,6e,67,68,64,6e,64,6b,6f,6e,69,6f,66,68,00,..

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"="C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\America Online 9.0\\waol.exe"="C:\\America Online 9.0\\waol.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe:*:Enabled:AOLTsMon"
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe:*:Enabled:AOLTopSpeed"
"C:\\Program Files\\Common Files\\AOL\\1156876735\\EE\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1156876735\\EE\\AOLServiceHost.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"="C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"="C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe:*:Enabled:AOL"
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"="C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe:*:Disabled:Kodak Software Updater"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Application Loader"
"C:\\Program Files\\Kazaa\\kazaa.exe"="C:\\Program Files\\Kazaa\\kazaa.exe:*:Enabled:Kazaa"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\\Documents and Settings\\Main\\My Documents\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Main\\My Documents\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Deluxe 2006\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
"C:\\Program Files\\Common Files\\AOL\\1156876735\\EE\\aolsoftware.exe"="C:\\Program Files\\Common Files\\AOL\\1156876735\\EE\\aolsoftware.exe:*:Enabled:AOL Shared Components"
"C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Enabled:Windows Explorer"
"C:\\Program Files\\TurboTax\\Basic 2007\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Basic 2007\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Basic 2007\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Basic 2007\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Application Loader"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 19 Nov 2004 54,872 A..H. — "C:\America Online 9.0\AOLphx.exe"
Fri 19 Nov 2004 31,832 A..H. — "C:\America Online 9.0\rbm.exe"
Wed 4 Aug 2004 93,184 A.SH. — "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
Tue 29 Jan 2008 1,694,208 A.SH. — "C:\Program Files\Messenger\msmsgs.exe"
Wed 4 Aug 2004 60,416 A.SH. — "C:\Program Files\Outlook Express\msimn.exe"
Wed 4 Aug 2004 20,491 A..H. — "C:\WINDOWS\system32\MFC421.dll"
Mon 13 Nov 2006 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 22 Feb 2008 84 A..H. — "C:\Program Files\ATI Multimedia\RemCtrl\x10prod.sys"
Thu 20 Dec 2007 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv03.tmp"
Fri 22 Feb 2008 121,616 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\0077a7fa5d15590d526d63a5048a5445\BITDA.tmp"
Sat 23 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\0a120212db9f8797932f46def01672fc\BITF1.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\0f8a5d0d09e527fa35dec9e085d4b802\BITDC.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\1230492412c0d92c55a03b0de671f167\BITFB.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\299966e551b4462ae94e39e251e277b6\BITE9.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\37fefde58a963f27982e5f97ce053f7f\BITF2.tmp"
Fri 22 Feb 2008 10,703,680 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\3a4b17774256790710b116f48cad024c\BITD9.tmp"
Sat 2 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\410ff09308a833491dba7686f0aee2eb\BITB5.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\410ff09308a833491dba7686f0aee2eb\BITFA.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\4f686eb18ed8be61735e890e67439840\BITED.tmp"
Tue 18 Dec 2007 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\512e19b377bd5d52a1e190ecbd7a83eb\BIT16.tmp"
Wed 19 Dec 2007 1,266,056 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\582374c56f566bb2a83a59d0c2cd7d87\BIT5D.tmp"
Wed 19 Dec 2007 2,166,832 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\61e8df80e280c83110d78864c8db1a90\BIT3A.tmp"
Sun 16 Dec 2007 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\85d72ebd3332986fe72a8378dc1d1a21\BIT5C.tmp"
Sat 23 Feb 2008 2,562,464 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\ab8d9dffe94dbb83444ff3cfb92fe26c\BITD4.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\adc42e4e6905251cac80b18a8dccd42a\BITE7.tmp"
Sat 23 Feb 2008 491,248 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\aebb83db003f77a45671fd2c1557da38\BITD8.tmp"
Wed 19 Dec 2007 6,934,488 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\b6b8211a5dc0636ae3d15bf626ce10d3\BIT2A.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\b6bef673c2e4e242a39946c4931e8a98\BITF8.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\b857106b57491ac2a650851d43af1c92\BITF7.tmp"
Sat 23 Feb 2008 4,548,840 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\bc7d0f6ab3aa3bf7be4e2f411369f85d\BITEE.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\d037d9bbbbdf880e477c3840b38c3180\BITF6.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\d20fc1765c1d2a8e6c26cf77036ce48f\BITF9.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\ed6cff8bccff865b52b93292e144ada6\BITEC.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\0091ab299e899a5920ad91739ad99c67\download\BITDD.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\021bbe9f2a0e31da1414f03ea6d62389\download\BITEB.tmp"
Sat 23 Feb 2008 408,860 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\0a7407b49e4a15c0b9a45c0426de5360\download\BITD7.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\0c114cf5b19927cfea8b29c83de1ed86\download\BITE1.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\109fef93c24da62cf8f31668d6ba9060\download\BITE4.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\32e99364da67a7850c38a7a4e067a1ed\download\BITDE.tmp"
Sat 2 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\458b0ddf827cd2ca02539e5a3b1a3d3c\download\BITA9.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\4b6ccd5ccf72ffca11e7f7e0165f2082\download\BITEF.tmp"
Fri 22 Feb 2008 262,957 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\4bc27de79804b640a2e67eda87fe6cda\download\BITDB.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\4cc8107fde988bba1481bb736cc96c29\download\BITE3.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\50d0c9ff929a7477233edd0771ffdb01\download\BITF4.tmp"
Sat 23 Feb 2008 193,693 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\526e15b6e1b5300357490c8089b5f84e\download\BITF3.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\55b5c397ff94db07e8c1c336efaf0a7b\download\BITE6.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\962449eaea2a809dd7a3a95c81a023bd\download\BITD2.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\a0d1667f129d439fad31a81898b17830\download\BITE0.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\d378d94379aa314a2f8a03df7faef1bc\download\BITE2.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\da70638ee8e6f6c7eff37e755cd6f449\download\BITF0.tmp"
Sat 23 Feb 2008 158,257 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\e7d26e5776f9930c6ad9dff351940707\download\BITF5.tmp"
Fri 22 Feb 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\ee52836d5c671146809a1dc54498be1f\download\BITE8.tmp"

Finished!

________________________________________________________________________________
_____

Logfile of HijackThis v1.99.1
Scan saved at 8:19:36 PM, on 2/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\AOL\1156876735\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\America Online 9.0\waol.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\America Online 9.0\shellmon.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1156876735\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\America Online 9.0\AOL.EXE" -b
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AOL; Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1201971963921
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D78EC274-DE04-4BD8-BF64-571900AE1895}: NameServer = 205.188.146.145
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Post #14
Close all programs leaving only HijackThis running. Place a check against each of the following,

O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)

Click on Fix Checked when finished and exit HijackThis.

—————————————————

Click HERE to run Panda's ActiveScan

* You need to use IE to run this scan
* Once you are on the Panda site click the Scan your PC button
* A new window will open…click the Check Now button
* Enter your Country
* Enter your State/Province
* Enter your e-mail address and click send
* Select either Home User or Company
* Click the big Scan Now button
* If it wants to install an ActiveX component allow it
* It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
* When download is complete, click on My Computer to start the scan
* When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
Post #15
Incident Status Location Potentially unwanted tool:application/altnet Not disinfected c:\windows\smdat32a.sys Potentially unwanted tool:application/bestoffer Not disinfected c:\windows\smdat32m.sys Adware:adware/instafinder Not disinfected c:\program files\INSTAFINK Potentially unwanted tool:application/need2find Not disinfected c:\program files\Need2Find Adware:adware/rxtoolbar Not disinfected c:\program files\RXToolBar Adware:adware/webhancer Not disinfected Windows Registry Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Main\Cookies\[removed][2].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Main\Cookies\main@adrevolver[2].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Main\Cookies\main@advertising[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Main\Cookies\main@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Main\Cookies\main@atwola[2].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Main\Cookies\main@doubleclick[2].txt Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Main\Cookies\main@fastclick[2].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Main\Cookies\main@mediaplex[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Main\Cookies\main@questionmarket[1].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Main\Cookies\[removed][2].txt Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Main\Cookies\[removed][2].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Main\Cookies\main@tribalfusion[1].txt Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Main\Cookies\main@zedo[2].txt Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Main\Desktop\SDFix.exe[SDFix\apps\Process.exe] Adware:Adware/AdRotator Not disinfected C:\Documents and Settings\Main\Local Settings\Temp\Temporary Directory 1 for excel new.zip\setup.exe[²ÜÇ\bann.exe][¦%%\gzmrt.dll] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Main\Local Settings\Temporary Internet Files\Content.IE5\K9G5UDK9\SDFix[1].exe[SDFix\apps\Process.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\SDFix\apps\Process.exe Spyware:Cookie/RealMedia Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@247realmedia[1].txt Spyware:Cookie/YieldManager Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\[removed][2].txt Spyware:Cookie/Adrevolver Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@adrevolver[1].txt Spyware:Cookie/Adrevolver Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@adrevolver[3].txt Spyware:Cookie/Advertising Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@advertising[1].txt Spyware:Cookie/Atlas DMT Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@atwola[1].txt Spyware:Cookie/CentrPort Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@centrport[1].txt Spyware:Cookie/Mediaplex Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@mediaplex[2].txt Spyware:Cookie/Overture Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@overture[2].txt Spyware:Cookie/Tribalfusion Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@tribalfusion[2].txt Spyware:Cookie/Adserver Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\[removed][1].txt Spyware:Cookie/Zedo Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De3\austin@zedo[2].txt Spyware:Cookie/RealMedia Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@247realmedia[1].txt Spyware:Cookie/Adrevolver Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@adrevolver[1].txt Spyware:Cookie/Adrevolver Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@adrevolver[3].txt Spyware:Cookie/AdDynamix Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\[removed][1].txt Spyware:Cookie/Adtech Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@adtech[2].txt Spyware:Cookie/Advertising Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@advertising[2].txt Spyware:Cookie/Adviva Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@adviva[1].txt Spyware:Cookie/Apmebf Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@apmebf[1].txt Spyware:Cookie/Atlas DMT Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@atdmt[1].txt Spyware:Cookie/Atwola Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@atwola[2].txt Spyware:Cookie/Azjmp Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@azjmp[2].txt Spyware:Cookie/Banner Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@banner[2].txt Spyware:Cookie/Bfast Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@bfast[2].txt Spyware:Cookie/Bluestreak Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@bluestreak[1].txt Spyware:Cookie/bravenetA Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@bravenet[1].txt Spyware:Cookie/BurstNet Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@burstnet[2].txt Spyware:Cookie/Casalemedia Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@casalemedia[1].txt Spyware:Cookie/CentrPort Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@centrport[2].txt Spyware:Cookie/Doubleclick Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@doubleclick[1].txt Spyware:Cookie/FastClick Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@fastclick[2].txt Spyware:Cookie/Go Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@go[1].txt Spyware:Cookie/FastClick Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\[removed][1].txt Spyware:Cookie/Mediaplex Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@mediaplex[2].txt Spyware:Cookie/Overture Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\[removed][1].txt Spyware:Cookie/Qsrch Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@qsrch[2].txt Spyware:Cookie/QuestionMarket Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@questionmarket[1].txt Spyware:Cookie/RealMedia Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@realmedia[2].txt Spyware:Cookie/WUpd Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@revenue[1].txt Spyware:Cookie/Searchportal Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\[removed][1].txt Spyware:Cookie/Advertising Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\[removed][1].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\[removed][2].txt Spyware:Cookie/Serving-sys Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@serving-sys[2].txt Spyware:Cookie/Statcounter Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@statcounter[2].txt Spyware:Cookie/WebtrendsLive Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\[removed][1].txt Spyware:Cookie/Tradedoubler Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@tradedoubler[1].txt Spyware:Cookie/Traffic Marketplace Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@trafficmp[2].txt Spyware:Cookie/Tribalfusion Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@tribalfusion[2].txt Spyware:Cookie/Tucows Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@tucows[1].txt Spyware:Cookie/Valueclick Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@valueclick[2].txt Spyware:Cookie/Adserver Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\[removed][1].txt Spyware:Cookie/Zedo Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De34\neil@zedo[2].txt Spyware:Cookie/Sandboxer Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@0[2].txt Spyware:Cookie/RealMedia Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@247realmedia[1].txt Spyware:Cookie/YieldManager Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/Adrevolver Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@adrevolver[1].txt Spyware:Cookie/Adrevolver Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@adrevolver[4].txt Spyware:Cookie/AdDynamix Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/PointRoll Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/Advertising Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@advertising[2].txt Spyware:Cookie/Apmebf Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@apmebf[2].txt Spyware:Cookie/Falkag Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/Atlas DMT Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@atdmt[1].txt Spyware:Cookie/Atwola Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@atwola[2].txt Spyware:Cookie/Azjmp Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@azjmp[2].txt Spyware:Cookie/Banner Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@banner[1].txt Spyware:Cookie/Belnk Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@belnk[1].txt Spyware:Cookie/Bfast Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@bfast[1].txt Spyware:Cookie/Bluestreak Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@bluestreak[1].txt Spyware:Cookie/bravenetA Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@bravenet[2].txt Spyware:Cookie/Serving-sys Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed]-sys[1].txt Spyware:Cookie/BurstNet Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@burstnet[1].txt Spyware:Cookie/Enhance Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/GoClick Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/Casalemedia Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@casalemedia[1].txt Spyware:Cookie/CentrPort Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@centrport[2].txt Spyware:Cookie/Cgi-bin Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@cgi-bin[6].txt Spyware:Cookie/Bridgetrack Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/Clickbank Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@clickbank[1].txt Spyware:Cookie/Com.com Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@com[2].txt Spyware:Cookie/Hitslink Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/cs.sexcounter Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/Dbbsrv Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@dbbsrv[1].txt Spyware:Cookie/Kazaa Networks Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/did-it Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@did-it[1].txt Spyware:Cookie/Doubleclick Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@doubleclick[1].txt Spyware:Cookie/Hitbox Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/empnads Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@empnads[2].txt Spyware:Cookie/FastClick Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@fastclick[2].txt Spyware:Cookie/Findwhat Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@findwhat[1].txt Spyware:Cookie/FortuneCity Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@fortunecity[2].txt Spyware:Cookie/Go Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@go[1].txt Spyware:Cookie/Screensavers Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/DomainSponsor Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/Netster Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/Linksynergy Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@linksynergy[1].txt Spyware:Cookie/Maxserving Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@maxserving[1].txt Spyware:Cookie/Mediaplex Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@mediaplex[1].txt Spyware:Cookie/OfferOptimizer Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@offeroptimizer[2].txt Spyware:Cookie/Overture Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@overture[1].txt Spyware:Cookie/Overture Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/Hitbox Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/QuestionMarket Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@questionmarket[1].txt Spyware:Cookie/RealMedia Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@realmedia[1].txt Spyware:Cookie/WUpd Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@revenue[2].txt Spyware:Cookie/Rn11 Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@rn11[2].txt Spyware:Cookie/Searchportal Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/Serving-sys Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@serving-sys[2].txt Spyware:Cookie/Statcounter Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@statcounter[2].txt Spyware:Cookie/WebtrendsLive Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][2].txt Spyware:Cookie/Mammamediasolutions Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@targetnet[1].txt Spyware:Cookie/Target Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@target[2].txt Spyware:Cookie/Tradedoubler Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@tradedoubler[1].txt Spyware:Cookie/Traffic Marketplace Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@trafficmp[2].txt Spyware:Cookie/Tribalfusion Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@tribalfusion[2].txt Spyware:Cookie/Tucows Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@tucows[2].txt Spyware:Cookie/Valueclick Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@valueclick[1].txt Spyware:Cookie/BurstBeacon Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/myaffiliateprogram Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/Seeq Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/Adserver Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\[removed][1].txt Spyware:Cookie/Zedo Not disinfected F:\RECYCLER\S-1-5-21-1177238915-73586283-839522115-1006\De4\lolajjn@zedo[1].txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI