Do i have Malware or Spyware

When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.

Do i have Malware or Spyware, please help, i did something stupid!

Options

waterface View Member Profile	Dec 8 2008, 09:24 AM Post #1
Forum Regular Group: Members Posts: 166 Joined: 10-September 07 Member No.: 155,930	Hi A fiew days ago i had an issue logging onto my internet banking! I called the helpline & they reset my password & username. Today i got an email from them telling me exactly what had happened (so i thought it was genuine) & that i needed to click a link to verify or my account would be suspended! Firefox gave me an alert after i clicked the link & a new tab opened & in the address bar an arrow dropped saying that it was a fraudulent website & do i want to get outa here or stay!, i just closed the window & deleted the message but am now anxious that i have spyware!! I ran my Avir Antivir which found nothing but i will paste in the report! I will run Adaware & Spybot now! Can anyone please advise! Many thanks in advance wf Avira AntiVir Personal Report file date: 08 December 2008 14:02 Scanning for 1077146 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: HOME-E9D7CCFC95 Version information: BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00 AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 14:02:24 AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 08:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 13:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 08:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 10:02:28 ANTIVIR1.VDF : 7.1.0.197 1170432 Bytes 07/12/2008 14:38:45 ANTIVIR2.VDF : 7.1.0.198 2048 Bytes 07/12/2008 14:38:47 ANTIVIR3.VDF : 7.1.0.202 10240 Bytes 08/12/2008 14:01:36 Engineversion : 8.2.0.43 AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 23:06:17 AESCRIPT.DLL : 8.1.1.18 336251 Bytes 08/12/2008 14:01:42 AESCN.DLL : 8.1.1.5 123251 Bytes 08/11/2008 15:38:07 AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 14:10:01 AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 15:52:25 AEOFFICE.DLL : 8.1.0.32 196987 Bytes 06/12/2008 14:01:17 AEHEUR.DLL : 8.1.0.74 1519990 Bytes 05/12/2008 14:45:33 AEHELP.DLL : 8.1.2.0 119159 Bytes 18/11/2008 19:21:44 AEGEN.DLL : 8.1.1.6 323955 Bytes 28/11/2008 23:02:45 AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 23:06:12 AECORE.DLL : 8.1.5.2 172405 Bytes 28/11/2008 23:02:37 AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 23:06:10 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 09:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 10:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 15/08/2008 22:43:08 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 12:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 09:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 13:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 18:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 13:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 13:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 14:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 14:34:37 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: 08 December 2008 14:02 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'SpybotSD.exe' - '1' Module(s) have been scanned Scan process 'usnsvc.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'MailWasher.exe' - '1' Module(s) have been scanned Scan process 'wscntfy.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'jqs.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'FireWall.exe' - '1' Module(s) have been scanned Scan process 'hkcmd.exe' - '1' Module(s) have been scanned Scan process 'igfxtray.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'aawservice.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 30 processes with 30 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '51' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! End of the scan: 08 December 2008 14:17 Used time: 14:58 Minute(s) The scan has been done completely. 1432 Scanning directories 92892 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 92891 Files not concerned 578 Archives were scanned 1 Warnings 0 Notes

waterface View Member Profile	Dec 10 2008, 04:43 AM Post #2
Forum Regular Group: Members Posts: 166 Joined: 10-September 07 Member No.: 155,930	Hi I'm not sure whether my post has been overlooked! thanks & sorry if i'm impatient, i get told i am a lot! wf p.s. spybot found nothing but unusually took 4 hours to complete the scan, adaware too just found cookies This post has been edited by waterface: Dec 10 2008, 04:45 AM

waterface View Member Profile	Dec 10 2008, 05:20 AM Post #3
Forum Regular Group: Members Posts: 166 Joined: 10-September 07 Member No.: 155,930	Hi I needed to post again as my Avir Antivir Guard popped up with a warning & the message below that Malware was discovered! I decided to deny access as opposed to quarantine!, i hope this was correct! I ran the scanner & it found nothing, although i am concerned after what happened after the bank issue in post 1. Virus or unwanted program 'HEUR/HTML.Malware [heuristic]' detected in file 'C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\Cache\C0406E3Ed01. Action performed: Deny access thanks

quietman7 View Member Profile	Dec 10 2008, 11:02 AM Post #4
Bleepin' Janitor Group: Global Moderator Posts: 18,040 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	Please download ATF Cleaner by Atribune & save it to your desktop. DO NOT use yet. alternate download link Please download and install SUPERAntiSpyware Free Double-click SUPERAntiSypware.exe and use the default settings for installation. An icon will be created on your desktop. Double-click that icon to launch the program. If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.) In the Main Menu, click the Preferences... button. Click the "*General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked. Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked): Close browsers before scanning.* Scan for tracking cookies. Terminate memory threats before quarantining. Click the "Close" button to leave the control center screen and exit the program. Do not run a scan just yet. Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode". Double-click ATF-Cleaner.exe to run the program. Under Main "*Select Files to Delete" choose: Select All. Click the Empty Selected* button. If you use Firefox browser click Firefox at the top and choose: Select All Click the Empty Selected button. If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser click Opera at the top and choose: Select All Click the Empty Selected button. If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator". Scan with SUPERAntiSpyware as follows: Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer. On the left, make sure you check C:\Fixed Drive. On the right, under "Complete Scan", choose *Perform Complete Scan* and click "Next". After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK". Make sure everything has a checkmark next to it and click "Next". A notification will appear that "*Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu. If asked if you want to reboot, click "Yes" and reboot normally. To retrieve the removal information after reboot, launch SUPERAntispyware again. Click Preferences, then click the Statistics/Logs tab.* Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. If there are several logs, click the current dated log and press View log. A text file will open in your default text editor. Please copy and paste the Scan Log results in your next reply. Click Close to exit the program. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2009 Member of UNITE, Unified Network of Instructors and Trusted Eliminators

waterface View Member Profile	Dec 10 2008, 04:10 PM Post #5
Forum Regular Group: Members Posts: 166 Joined: 10-September 07 Member No.: 155,930	I launched ATF in safe mode, but i forgot to click firefox at the top. After i checked 'select all' & 'empty selected', it wouldn't let me go back as whaen i clicked firefox then, there was no responce! Also, do i run SuperAntiSpyware in safe mode straight after doing the ATF cleaner, as there were no left hands side boxes in safe mode after i clicked 'scan for harmful software'. Should it look the same in safe mode as in normal mode? thanks

quietman7 View Member Profile	Dec 11 2008, 07:18 AM Post #6
Bleepin' Janitor Group: Global Moderator Posts: 18,040 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	To clear the Java Runtime Environment (JRE) cache, do this: Click Start > Settings > Control Panel. Double-click the Java icon. - The Java Control Panel appears. Click "Settings" under Temporary Internet Files. - The Temporary Files Settings dialog box appears. Click "Delete Files" at the bottom. - The Delete Temporary Files dialog box appears with options to delete: Applications and Applets Trace and Log Files Click "OK". Click "OK" on the Temporary Files Settings window. Close the Java Control Panel. If you cannot run SuperAntispyware properly in safe mode, then do the scan in normal mode. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2009 Member of UNITE, Unified Network of Instructors and Trusted Eliminators

waterface View Member Profile	Dec 11 2008, 09:21 AM Post #7
Forum Regular Group: Members Posts: 166 Joined: 10-September 07 Member No.: 155,930	Ok, i did clear the JRE cache as said. I ran SuperAntispyware in normal mode & was offline whilst it ran! I often watch a bit of porn, but have done for a while & these sites never have caused issues as they are used by lots of people & this issue only happened the other day! also the bank issue! Here's my log & thanks for your help. SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 12/11/2008 at 02:10 PM Application Version : 4.23.1006 Core Rules Database Version : 3671 Trace Rules Database Version: 1650 Scan type : Complete Scan Total Scan Time : 00:25:36 Memory items scanned : 336 Memory threats detected : 0 Registry items scanned : 3845 Registry threats detected : 0 File items scanned : 18440 File threats detected : 141 Adware.Tracking Cookie C:\Documents and Settings\Administrator\Cookies\administrator@bs.serving-sys[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[2].txt .teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .videos.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .videos.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .videos.teensnow.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .video.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .video.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .video.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .sexole.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .video.bleep.sc [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .video.bleep.sc [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .files.streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .files.streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultfriendfinder.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultfriendfinder.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultfriendfinder.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultfriendfinder.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultfriendfinder.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .sex.magicmovies.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .sex.magicmovies.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .xxx.xnxxmovies.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .xxx.xnxxmovies.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .porn.gonzo-movies.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .porn.gonzo-movies.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .pornhub.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .pornhub.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.pornhub.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adultadworld.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.streamsex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] pornorama.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .porno.dreammovies.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .porno.dreammovies.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .2o7.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .msnportal.112.2o7.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adtech.de [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.gimmesex.biz [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] www.gimmesex.biz [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .at.atwola.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .at.atwola.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .tacoda.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .tacoda.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .tacoda.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .tacoda.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .revsci.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .serving-sys.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .serving-sys.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .serving-sys.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .serving-sys.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .serving-sys.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .serving-sys.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .bs.serving-sys.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .trafficmp.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .trafficmp.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .trafficmp.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .trafficmp.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .trafficmp.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adopt.euroclick.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adbrite.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adbrite.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adbrite.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .adbrite.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .pornstarxs.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .questionmarket.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .questionmarket.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .ads.pointroll.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .ads.pointroll.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .ads.pointroll.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .ads.pointroll.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .ads.pointroll.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .ads.pointroll.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .ads.pointroll.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .247realmedia.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .247realmedia.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ] .atoc.112.2o7.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\90yhb3fy.default\cookies.txt ]

quietman7 View Member Profile	Dec 11 2008, 11:05 AM Post #8
Bleepin' Janitor Group: Global Moderator Posts: 18,040 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	How is your computer running now? Any more reports/signs of infection? -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2009 Member of UNITE, Unified Network of Instructors and Trusted Eliminators

waterface View Member Profile	Dec 11 2008, 11:14 AM Post #9
Forum Regular Group: Members Posts: 166 Joined: 10-September 07 Member No.: 155,930	Hi Quietman & thanks It seems ok, i just wonder what happened when my Avira found what it did above, the 'HEUR/HTML.Malware [heuristic]' Was there Malware on my pc from opening the link & is my security ok!! could my details, bank etc have been stolen? How did the log look? My pc is running ok it seems, it hasn't ever run bad, touch wood, i just was concerned with the security issue & what my anti virus found. many thanks wf This post has been edited by waterface: Dec 11 2008, 11:16 AM

quietman7 View Member Profile	Dec 11 2008, 11:26 AM Post #10
Bleepin' Janitor Group: Global Moderator Posts: 18,040 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	QUOTE i just wonder what happened when my Avira found what it did above, the 'HEUR/HTML.Malware [heuristic]' Many anti-virus programs utilize optional heuristic features to detect brand new viruses, based on behaviors and coding patterns that infections commonly use. Heuristic analysis is the ability of an anti-virus program to detect *possible new variants of malware* before the vendor can get samples and update the program's definitions for detection. Heuristics uses non-specific detection methods to find new or unknown malware which allows the anti-virus to detect and stop if before doing any harm to your system. The techniques involves inspecting the code in a file to see if it contains virus-like characteristics. If the number of these characteristics/instructions exceeds a pre-defined threshold, the file is flagged as a possible virus. The disadvantage to using heuristics is that it is not as reliable as signature-based detection (blacklisting) and can potentially increase the chances that a non-malicious program is flagged as malicious. With heuristics, there is always a potential risk for a "False Positive" when the heuristic analysis flags a file as suspicious or infected that contains no malware. Reducing the detection sensitivity will minimize the risk but then that increases the possibility for new malware to infect your system. In your case, the anti-virus flagged something in your Firefox cache which is why I had you clean it out. When a specific file is identified, you can get a second opinion, by submitting the file to jotti's virusscan or virustotal.com. In the "File to upload & scan" box, browse to the location of the suspicious file and submit (upload) it for scanning/analysis. The SAS scan only found cookies. Cookies are text string messages given to a Web browser by a Web server. Whenever you visit a web page or navigate different pages with your browser, the web site generates a unique ID number which your browser stores in a text (cookie) file that is sent back to the server each time the browser requests a page from that server. Cookies allow third-party providers such as ad serving networks, spyware or adware providers to track personal information. The main purpose of cookies is to identify users and prepare customized Web pages for them. The type of cookie that is a cause for some concern are "tracking cookies" because they can be considered a privacy risk. These types of cookies are used to track your Web browsing habits (your movement from site to site). Ad companies use them to record your activity on all sites where they have placed ads. They can keep count of how many times you visited a web page, store your username and password so you don't have to log in and retain your custom settings. When you visit one of these sites, a cookie is placed on your computer. Each time you visit another site that hosts one of their ads, that same cookie is read, and soon they have assembled a list of which of their sites you have visited and which of their ads that you have clicked on. They are used all over the Internet and advertisement companies often plant them whenever your browser loads one of their banners. Cookies are NOT a "threat". As text files they cannot be executed to cause any damage. Cookies do not cause any pop ups nor do they install malware. As long as you surf the Internet, you are going to get cookies and some of your security programs will flag them for removal. However, you can minimize this by reading "Blocking & Managing Unwanted Cookies" and "Block Third-Party Cookies in IE7". -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2009 Member of UNITE, Unified Network of Instructors and Trusted Eliminators

waterface View Member Profile	Dec 11 2008, 11:47 AM Post #11
Forum Regular Group: Members Posts: 166 Joined: 10-September 07 Member No.: 155,930	Ok, so clearing the JRE cache cleaned my cache in Firefox?, as i'm not sure it i did it correct in ATF cleaner! So as the log showed just cookies, i'm free of mal/spyware? & i shouldn't worry about my security & should be more careful in future! I will read more & understand your post in an hour as i have to go out, but it seems you are saying that all seems well? many thanks for your expertise quietman wf

quietman7 View Member Profile	Dec 11 2008, 12:14 PM Post #12
Bleepin' Janitor Group: Global Moderator Posts: 18,040 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	I'm saying I don't see evidence of any serious infection based on what you have described and what the one scan is showing. Usually when infected, there will be other symptoms like slow performance, pop ups, browser redirects, suspicious files in Task Manager, etc. No single product is 100% foolproof and can detect and remove all threats at any given time. The security community is in a constant state of change as new infections appear. Each vendor has its own definition of what constitutes malware and scanning your computer using different criteria will yield different results. The fact that each program has its own definition files means that some malware may be picked up by one that could be missed by another. Thus, a *multi-layered defense using several anti-spyware products* (including an effective firewall) to supplement your anti-virus combined with common sense and safe surfing habits provides the most complete protection. Tips to protect yourself against malware: • "Simple and easy ways to keep your computer safe". • "How did I get infected?, With steps so it does not happen again!". • "Hardening Windows Security - Part 1 & Part 2". • "IE Recommended Minimal Security Settings" - "How to Secure Your Web Browser". • "Use Task Manager to close pop-up messages to safely exit malware attacks" • Avoid gaming sites, underground web pages, pirated software, crack sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2009 Member of UNITE, Unified Network of Instructors and Trusted Eliminators

waterface View Member Profile	Dec 11 2008, 01:28 PM Post #13
Forum Regular Group: Members Posts: 166 Joined: 10-September 07 Member No.: 155,930	ok, well i don't see evidence of what you mentioned may be happening to my pc! I guess the Heuristic virus is gone as i guess it would've been seen on the log. My Avir Antivir 'disallowed access' as opposed to quarantine it, is that the best option? SuperAntispyware seems quite effective. It found things Spybot & Adaware didn't find. Do you recomend me using it regularly alongside Spybot, Adaware & my Antivir. Again, many thanks. wf

quietman7 View Member Profile	Dec 11 2008, 01:35 PM Post #14
Bleepin' Janitor Group: Global Moderator Posts: 18,040 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	Yes SAS is effective and I recommend keeping it. Another effective tool is Malwarebytes Anti-Malware. mvps.org is no longer recommending Spybot S&D or Ad-Aware due to poor testing results. See here - (scroll down and read under Freeware Antispyware Products). This post has been edited by quietman7: Dec 11 2008, 01:36 PM -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2009 Member of UNITE, Unified Network of Instructors and Trusted Eliminators

waterface View Member Profile	Dec 12 2008, 09:52 PM Post #15
Forum Regular Group: Members Posts: 166 Joined: 10-September 07 Member No.: 155,930	Hello & thanks you! Can you please tell me the settings that i need to apply in 'peferences' in SAS? I see lots of options that i'm unaware how to set them, the check boxes etc in the Preferences area 'General startup', 'Real time protection' & 'Scanning control'. Anything else i need to know!, should i delete all it finds if i run it weekly & should i use it & disable Spybot & Adaware & just use SAS alongside my Antivir if Spybot & Adaware are no longer worth while? The same goes for Malwarebytes, i have this from last time i had an issue here, but i thought i should only use it with guidance!! What should i do with this & is it compatable with all SAS & should i run it alongside anythig else i have!? Many thanks wf This post has been edited by waterface: Dec 12 2008, 09:56 PM

« Next Oldest · Am I infected? What do I do? · Next Newest »

2 User(s) are reading this topic (2 Guests and 0 Anonymous Users)

0 Members:

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Virus Removal Guides