I need help Urgently

Forum Rules

When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.

If you have not received help after three days, please post a link to your topic HERE.

2 Pages
1
2
→

You cannot start a new topic
You cannot reply to this topic

I need help Urgently Sytem Tool infection

#1 rnr67

Member

Group: Members
Posts: 58
Joined: 02-February 08
Location:Mississauga, Ontario, Canada

Posted 09 February 2011 - 08:17 PM

I somehow got infected with the system tool virus and wants me to install it's software to remove it...for a fee of course.
The computer is unresponsive for most of the desktop, which has been hijacked, and keeps rebooting on occasion.
Kinda scared to shut it down for the night. Please help A.S.A.P.

#2 boopme

To Insanity and Beyond

Group: Global Moderator
Posts: 48,761
Joined: 10-September 04
Gender:Male
Location:NJ USA

Posted 09 February 2011 - 08:34 PM

Hello and welcome.
Please follow our Removal Guide here Remove System Tool and SystemTool .
You will move to the Automated Removal Instructions

After you completed that, post your scan log here,let me know how things are.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.

How do I get help? Who is helping me?
Staying Updated Calendar of Updates.
For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....
Become a BleepingComputer fan: Facebook

#3 rnr67

Member

Group: Members
Posts: 58
Joined: 02-February 08
Location:Mississauga, Ontario, Canada

Posted 09 February 2011 - 08:46 PM

I already have Malwarebytes and Hijackthis installed on the computer from an earlier problem. Can I just skip to the safe mode and use them?

#4 boopme

To Insanity and Beyond

Group: Global Moderator
Posts: 48,761
Joined: 10-September 04
Gender:Male
Location:NJ USA

Posted 09 February 2011 - 08:54 PM

Yes but update MBAm first. Do not post a HJT log here and if you are not trained in using you should not even use it. HijackThis is an advanced enumerator (similar in some respects to a registry editor) that is used to display certain areas of the Windows registry where the majority of malware reside. HijackThis will scan these areas of your system and then create a log to help diagnose the presence of undetected malware in known hiding places. However, since HijackThis only scans certain areas of your system/registry, a log may not always show all the malware on your system and other investigative tools need to be used. Most of the log entries are required to run a computer and removing essential ones can potentially cause serious damage such as loss of Internet connectivity or problems with your operating system which could preventing it from starting. Using HijackThis requires advanced knowledge about the Windows Operating System and relies on trained experts to interpret the log entries and investigate them in order to determine what needs to be fixed.

#5 rnr67

Member

Group: Members
Posts: 58
Joined: 02-February 08
Location:Mississauga, Ontario, Canada

Posted 09 February 2011 - 09:04 PM

OK, I was able to download and run rkill successfully it would seem without rebooting. Warnings have stopped popping up. Ready for the next step.

#6 boopme

To Insanity and Beyond

Group: Global Moderator
Posts: 48,761
Joined: 10-September 04
Gender:Male
Location:NJ USA

Posted 09 February 2011 - 09:16 PM

Next run MBAM (MalwareBytes): Then move to step 22 in the removal guide
.
Please download Malwarebytes Anti-Malware and save it to your desktop.

Download Link 1

Download Link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

Make sure the "Perform Quick Scan" option is selected.
Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

Click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware

This post has been edited by boopme: 09 February 2011 - 09:18 PM

#7 rnr67

Member

Group: Members
Posts: 58
Joined: 02-February 08
Location:Mississauga, Ontario, Canada

Posted 10 February 2011 - 12:22 AM

This has been done successfully and rebooted. Seems to be normal desktop. Took almost 3 hours, but worth it.

Here is the Malwarebytes Log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5726

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.11

10/02/2011 12:00:07 AM
mbam-log-2011-02-10 (00-00-07).txt

Scan type: Full scan (C:\|D:\|F:\|G:\|H:\|I:\|)
Objects scanned: 275496
Time elapsed: 2 hour(s), 48 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nCcDoNm08200 (Rogue.SystemTool) -> Value: nCcDoNm08200 -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("%1" %*) Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\all users\application data\nccdonm08200\nccdonm08200.exe (Rogue.SystemTool) -> Quarantined and deleted successfully.
c:\documents and settings\compaq_administrator\my documents\my videos\convertxtodvd 3.3.4.106e and keygen [1337x]\Keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

Any further steps I need to take?

#8 boopme

To Insanity and Beyond

Group: Global Moderator
Posts: 48,761
Joined: 10-September 04
Gender:Male
Location:NJ USA

Posted 10 February 2011 - 10:51 AM

Hello, this was good. I see you have not installed service pack 3 for Internet explorer. It covers some security leaks in that application.
I see that you infected this by installing a keygen.
IMPORTANT NOTE: The practice of using cracking tools, keygens, warez or any pirated software is not only considered illegal activity but it is a serious security risk.

Quote

Cracking applications are used for illegally breaking (cracking) various copy-protection and registration techniques used in commercial software. These programs may be distributed via Web sites, Usenet, and P2P networks.

trendmicro.com/vinfo

Quote

...warez and crack web pages are being used by cybercriminals as download sites for malware related to VIRUT and VIRUX. Searches for serial numbers, cracks, and even antivirus products like Trend Micro yield malcodes that come in the form of executables or self-extracting files...quick links in these sites also lead to malicious files. Ads and banners are also infection vectors...

Keygen and Crack Sites Distribute VIRUX and FakeAV

Quote

...warez/piracy sites ranked the highest in downloading spyware...just opening the web page usually sets off an exploit, never mind actually downloading anything. And by the time the malware is finished downloading, often the machine is trashed and rendered useless.

University of Washington spyware study

Quote

...One of the most aggressive and intrusive of all bad websites on the Internet are serial, warez, software cracking type sites...they sneak malware onto your system...Where do trojan viruses originate? One of the biggest malware distributors on the Internet are serial/warez/code cracking sites.

Bad Web Sites: Malware

When you use these kind of programs, be forewarned that some of the worst types of malware infections can be contracted and spread by visiting crack, keygen, warez and other pirated software sites. In many cases, those sites are infested with a smörgåsbord of malware and an increasing source of system infection. Those who attempt to get software for free can end up with a computer system so badly damaged that recovery is not possible and it cannot be repaired. When that happens there is nothing you can do besides reformatting and reinstalling the OS.

Before we can continue, I need you to remove all cracks and keygens immediately to reduce the risk of infection/reinfection. If not, then we are just wasting time trying to clean your system. Further, other tools used during the disinfection process may detect crack and keygens so we need to ensure they have been removed.

Using these types of programs or the websites you visited to get them is almost a guaranteed way to get yourself infected!!

I am quite sure there is still more on here because of thet download. So we'll do a Safe mode and an Online scan.

Next run ATF and SAS: If you cannot access Safe Mode,run in normal ,but let me know.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
Close all open browsers before using, especially FireFox. <-Important!!!
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.

Please perform a scan with Eset Online Antiivirus Scanner.
This scan requires Internet Explorer,Opera or Firefox to work. Vista/Windows 7 users need to run Internet Explorer as Administrator.
To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run As Administrator from the context menu.

Click the green button.
Read the End User License Agreement and check the box:
Check .
Click the button.
Accept any security warnings from your browser.
Check
Check Remove found threats and Scan potentially unwanted applications. (If given the option, choose "Quarantine" instead of delete.)
Click the Start button.
ESET will then download updates for itself, install itself, and begin scanning your computer.
If offered the option to get information or buy software at any point, just close the window.
The scan will take a while so be patient and do NOT use the computer while the scan is running. Keep all other programs and windows closed.
When the scan completes, push
Push , and save the file to your desktop as ESETScan.txt.
Push the button, then Finish.
Copy and paste the contents of ESETScan.txt in your next reply.

Note: A log.txt file will also be created and automatically saved in the C:\Program Files\EsetOnlineScanner\ folder.
If you did not save the ESETScan log, click Posted Image

> Run..., then type or copy and paste everything in the code box below into the Open dialogue box:

C:\Program Files\ESET\EsetOnlineScanner\log.txt

Click Ok and the scan results will open in Notepad.
Copy and paste the contents of log.txt in your next reply.

-- Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.

NOTE: In some instances if no malware is found there will be no log produced.

Please ask any needed questions,post logs and Let us know how the PC is running now.

#9 rnr67

Member

Group: Members
Posts: 58
Joined: 02-February 08
Location:Mississauga, Ontario, Canada

Posted 10 February 2011 - 07:51 PM

I have completed the Safe Mode steps successfully, here is the SUPERAntiSpyware logs:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/10/2011 at 07:34 PM

Application Version : 4.48.1000

Core Rules Database Version : 6376
Trace Rules Database Version: 4188

Scan type : Complete Scan
Total Scan Time : 01:27:55

Memory items scanned : 221
Memory threats detected : 0
Registry items scanned : 9495
Registry threats detected : 0
File items scanned : 30075
File threats detected : 213

Adware.Tracking Cookie
cdn.gotraffic.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\LEPG8YAY ]
core.queerclick.netdna-cdn.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\LEPG8YAY ]
media.crooksandliars.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\LEPG8YAY ]
media.hamptonroads.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\LEPG8YAY ]
media.kyte.tv [ C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\LEPG8YAY ]
media.lintvnews.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\LEPG8YAY ]
media.theonion.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\LEPG8YAY ]
www.99counters.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\LEPG8YAY ]
www.royalmediamarketing.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\LEPG8YAY ]
ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adinterax.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adinterax.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.yieldmanager.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.doubleclick.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.lfstmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.lfstmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.lfstmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.apmebf.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.imrworldwide.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.imrworldwide.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.avgtechnologies.112.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
jsfp.coremetrics.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
click.tigeronline.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
click.tigeronline.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adcentriconline.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
super.kitnmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
super.kitnmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.realmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.pelmorexmedia.122.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.bs.serving-sys.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
tracking.hostgator.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.affiliates.commissionaccount.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.affiliates.commissionaccount.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
stats.justhost.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
user.lucidmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
adsplash.rotator.hadj1.adjuggler.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.richmedia.yahoo.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.specificclick.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.specificclick.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.specificclick.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.specificclick.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.specificmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.questionmarket.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.chitika.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.lucidmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
adserver.exgfnetwork.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.canoe.112.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.tribalfusion.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
in.getclicky.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adultfriendfinder.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adultfriendfinder.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adxpose.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
dc.tremormedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ads.networldmedia.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ads.networldmedia.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ads.networldmedia.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ads.networldmedia.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.networldmedia.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.pro-market.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
vitamine.networldmedia.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.vitamine.networldmedia.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ru4.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.casalemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.pervpornsites.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.pervpornsites.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.questionpro.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.questionpro.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
stats.justhost.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
s03.flagcounter.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.c.gigcount.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
rbc.bridgetrack.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.mediabrandsww.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adecn.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.questionmarket.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
stats.justhost.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
stats.justhost.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
stats.justhost.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.bellcan.adbureau.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.sympatico.112.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.canadapost.112.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.questionmarket.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.r1-ads.ace.advertising.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.content.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.realmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.realmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.bellglobemediapublishing.122.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.insightexpressai.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.torstardigital.122.2o7.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adserver.adtechus.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.at.atwola.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.at.atwola.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.tacoda.at.atwola.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.at.atwola.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.dmtracker.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.adbrite.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
super.kitnmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
content2.kitnmedia.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]
.content.yieldmanager.com [ C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\e05puql3.default\cookies.sqlite ]

Trojan.Agent/Gen-Nullo[Short]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{106CF321-99A3-4E3A-9103-1BD027606A99}\RP769\A0234214.EXE

I will continue on to the next step now.

#10 boopme

To Insanity and Beyond

Group: Global Moderator
Posts: 48,761
Joined: 10-September 04
Gender:Male
Location:NJ USA

Posted 10 February 2011 - 08:59 PM

Thank you after we review the ESET log we can mop up.

#11 rnr67

Member

Group: Members
Posts: 58
Joined: 02-February 08
Location:Mississauga, Ontario, Canada

Posted 11 February 2011 - 12:37 AM

All is done. Here are the results of ESETScan:

C:\Documents and Settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\10\2361c0ca-174c13b5 multiple threats deleted - quarantined
C:\Documents and Settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\56\16fe3838-4dd29fd5 multiple threats deleted - quarantined
C:\Documents and Settings\Compaq_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\62\4bd616be-611d6a97 multiple threats deleted - quarantined

Any further actions to take?

#12 boopme

To Insanity and Beyond

Group: Global Moderator
Posts: 48,761
Joined: 10-September 04
Gender:Male
Location:NJ USA

Posted 11 February 2011 - 11:16 AM

What version of JAVA,if any, is running?
Go into Control Panel>Add Remove Programs. Be sure the 'Show Updates' box is checked. Go down the list and tell me what Java applications are installed and their version. (Highlight the program to see this).

#13 rnr67

Member

Group: Members
Posts: 58
Joined: 02-February 08
Location:Mississauga, Ontario, Canada

Posted 11 February 2011 - 05:29 PM

Java™6 Update 5
Java™6 Update 7
and Java™6 Update 23

#14 rnr67

Member

Group: Members
Posts: 58
Joined: 02-February 08
Location:Mississauga, Ontario, Canada

Posted 11 February 2011 - 06:37 PM

Point of interest: I got this doing a Google Search doing research for work, clicked a normal looking page and got a balloon saying there was a Java update avaliable. Looked like my regular update balloons,so clicked it and that's when hell broke loose. I was using Firefox at the time instead of IE which I usually use.

Are we done yet or are there any more steps to take?

#15 boopme

To Insanity and Beyond

Group: Global Moderator
Posts: 48,761
Joined: 10-September 04
Gender:Male
Location:NJ USA

Posted 11 February 2011 - 08:19 PM

Yes we need to remove those two older ones. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

This is correct and Java™6 Update 23
Java™6 Update 5
Java™6 Update 7
Go into Control Panel and remove those (updates 5 & 7),when done reboot.

In the future this is where you update

:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Look for "Java Platform, Standard Edition".
Click the "Download JRE" button to the right.
Select your Platform: "Windows" (32-bit) or "Windows x64" (64-bit).
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "I agree to the Java SE...License Agreement".
Click Continue and the page will refresh.
Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
Close any programs you may have running - especially your web browser.

Go to

> Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.

Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u23-windows-i586.exe to install the newest version.
If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
When the Java Setup - Welcome window opens, click the Install > button.
If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:

Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
Click Ok and reboot your computer.

If there are no more problems or signs of infection, you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

Go to Start > Programs > Accessories > System Tools and click "System Restore".
Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

Then use Disk Cleanup to remove all but the most recently created Restore Point.
Go to Start > Run and type: Cleanmgr
Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
Click the "More Options" tab, then click the "Clean up" button under System Restore.
Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
Click Yes, then click Ok.
Click Yes again when prompted with "Are you sure you want to perform these actions?"
Disk Cleanup will remove the files and close automatically.

Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.

Tips to protect yourself against malware and reduce the potential for re-infection:

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

• Keeping Autorun enabled on USB and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. To learn more about this risk, please read: