Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus; A Little Help Here?


  • Please log in to reply
11 replies to this topic

#1 esquilo1

esquilo1

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 03 April 2008 - 09:22 PM

hey guys, i'm having a problem with my computer and i'm not sure as to what to do. i was recieveing pop-ups that were trying to get me t download anti-spyware software. in addition, i was not able to view icons and images in my web browser. i then did a system restore and the pop-ups stopped. now, i still can't view images, typing is slurred, and i keep recieving a warning about a file, "C:/WINDOWS/system32/drivers/svchost.exe" is infected by the "New Malware.j". finally, my system is running extremly slow. what do you guys sugguest??? thank you, -Joe

Edited by esquilo1, 04 April 2008 - 08:54 PM.


BC AdBot (Login to Remove)

 


#2 esquilo1

esquilo1
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 04 April 2008 - 09:05 PM

anyone think they can help me? i'm really freaking out

#3 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:06 PM

Posted 04 April 2008 - 09:36 PM

It would seem you have restored a previous infection? or did not go far enough back?

what program is giving you the warning, McAfee?
Chewy

No. Try not. Do... or do not. There is no try.

#4 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,906 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:06 PM

Posted 04 April 2008 - 10:24 PM

Hello esquilo1 and welcome to BC :flowers:

System Restore rarely resolves malware issues. In order to provide you with the proper disinfection procedures, we need some additional information.

What is your operating system: Windows XP, Vista, etc.?

What security programs do you have installed? Please name them.

receiving pop-ups that were trying to get me t download anti-spyware software


Can you please describe these popups and what anti-spyware they asked you to download? Even though you are no longer getting the popups, it is important information regarding the nature of the infection you have.

And to repeat DaChew's question: What is providing the alert about svchost?

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#5 esquilo1

esquilo1
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 04 April 2008 - 11:11 PM

okay, um, i have windows XP, he program giving me the warnings is mcafee (i also have "AVG anti-spyware 7.5", "Ad-Aware SE" and "spybot: Search and destroy") and i unfortunately can not remember any of the pop-ups, sorry. the only thing i can remember is what i'm still seeing which is "malware.j"

and back to DaChew, the restore point i used is the farthest one back i have (which, oddly enough, is maybe about 25 minutes after i got the virus in the first place)

Edited by esquilo1, 04 April 2008 - 11:17 PM.


#6 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:06 PM

Posted 05 April 2008 - 02:59 AM

Is teatimer loading(resident) at bootup?


Download and Install SuperAntiSpyware Free
  • Launch SuperAntiSpyware
  • Click Check for Updates and update to the latest definitions.
  • Click Scan your Computer
    • Check all boxes in the Scan Location box.
    • Check the Complete Scan radio button.
    • Click Scanning Preferences/Control Centre button.
      • Uncheck Ignore files larger than 4MB (recommended)
      • Check Scan Alternate Data Streams.
      • Click Close.
    • Click Next
  • SuperAntiSpyware will now scan your computer for infection. (This could take in excess of an hour depending on the number of files scanned)
  • When finished it will present you with a summary of its findings.
  • Click OK.
  • The Removal Screen will open.
    • Check the items in the list to mark them for Quarantine.
    • Click Next and SAS will Quarantine them.
[*]Click the Preferences button.
  • Click the Statistics/Logs tab.
    • Logs are listed by date and time, click on the latest one to highlight it (at the top).
    • Click View log.
  • This will open a log page.
  • Copy/Paste the contents in your next post please.
CAUTION: SuperAntiSpyware comes with a programme called Bootsafe, do not for any reason use this programme, if used on an infected computer it could render it UNBOOTABLE.

I would like you to install and update Super from regular mode then after setting preferences reboot into safe mode and do the scan.

TeaTimer and McAfee shouldn't interfer with any fixes in safe mode.

Edited by DaChew, 05 April 2008 - 03:05 AM.

Chewy

No. Try not. Do... or do not. There is no try.

#7 esquilo1

esquilo1
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 05 April 2008 - 03:17 PM

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/05/2008 at 02:00 PM

Application Version : 4.0.1154

Core Rules Database Version : 3432
Trace Rules Database Version: 1424

Scan type : Complete Scan
Total Scan Time : 02:24:29

Memory items scanned : 498
Memory threats detected : 3
Registry items scanned : 7440
Registry threats detected : 54
File items scanned : 108056
File threats detected : 566

Trojan.Unclassified/AffiliateBundle
C:\WINDOWS\SYSTEM32\JKKIXOIA.DLL
C:\WINDOWS\SYSTEM32\JKKIXOIA.DLL
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\jkkIXOIA

Adware.Vundo Variant/Resident
C:\WINDOWS\SYSTEM32\LJJDWPIJ.DLL
C:\WINDOWS\SYSTEM32\LJJDWPIJ.DLL

Trojan.Csrssc/Systemc-A
C:\DOCUME~1\SMOKE\LOCALS~1\TEMP\CSRSSC.EXE
C:\DOCUME~1\SMOKE\LOCALS~1\TEMP\CSRSSC.EXE
[Jnskdfmf9eldfd] C:\DOCUME~1\SMOKE\LOCALS~1\TEMP\CSRSSC.EXE
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\CSRSSC.EXE
C:\WINDOWS\Prefetch\CSRSSC.EXE-11CDEF28.pf

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{060BB0AB-4B09-4C51-9ECB-9580A6D08D7F}
HKCR\CLSID\{060BB0AB-4B09-4C51-9ECB-9580A6D08D7F}
HKCR\CLSID\{060BB0AB-4B09-4C51-9ECB-9580A6D08D7F}\InprocServer32
HKCR\CLSID\{060BB0AB-4B09-4C51-9ECB-9580A6D08D7F}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{060bb0ab-4b09-4c51-9ecb-9580a6d08d7f}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{060BB0AB-4B09-4C51-9ECB-9580A6D08D7F}
HKCR\CLSID\{060BB0AB-4B09-4C51-9ECB-9580A6D08D7F}

MyWay Search Assistant Computers
HKLM\Software\Classes\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32#ThreadingModel
HKCR\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}\Programmable
C:\PROGRAM FILES\MYWAYSA\SRCHASDE\1.BIN\DESRCAS.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP777\A0136687.DLL

Adware.Vundo-Variant/Small-A
HKLM\Software\Classes\CLSID\{5cfd96f2-3580-4b01-8487-333c55667b02}
HKCR\CLSID\{5CFD96F2-3580-4B01-8487-333C55667B02}
HKCR\CLSID\{5CFD96F2-3580-4B01-8487-333C55667B02}\inprocserver32
HKCR\CLSID\{5CFD96F2-3580-4B01-8487-333C55667B02}\inprocserver32#ThreadingModel
C:\WINDOWS\SYSTEM32\VHPUBOKU.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP776\A0135329.DLL

Adware.Vundo-Variant
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dab2f8a0-12f2-4780-aa39-5bf47038712b}
HKCR\CLSID\{DAB2F8A0-12F2-4780-AA39-5BF47038712B}
HKCR\CLSID\{DAB2F8A0-12F2-4780-AA39-5BF47038712B}\inprocserver32
HKCR\CLSID\{DAB2F8A0-12F2-4780-AA39-5BF47038712B}\inprocserver32#ThreadingModel

Unclassified.Unknown Origin
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler#{af3fd9a8-1287-4159-9212-9a5b4494af70}

Adware.Tracking Cookie
C:\Documents and Settings\Smoke\Cookies\smoke@silkyporn[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@porninspector[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornmembers[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.revsci[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cdn.atwola[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sales.liveperson[3].txt
C:\Documents and Settings\Smoke\Cookies\smoke@redorbit[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenbodybuilding[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@888[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexycelebpix[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@hits.clickandtrack[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@porn.iwantanewgirlfriend[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@icc.intellisrv[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adknowledge[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@audit.median[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@click.payserve[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@nextag[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cgi-bin[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.bleepbot[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@bannerspace[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@azjmp[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@admin.teenrevenue[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@anat.tacoda[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24296[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.findtherightschool[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cassava[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.burstbeacon[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.screensavers[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.expedia[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.click4cum[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adopt.hbmediapro[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@a[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.maxpornmovies[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.directanetworks[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teentvmovies.about[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@wetrack[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@carfinderservice[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@qnsr[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adopt.specificclick[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@specialteenvideos[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.gimmesex[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@partners.adultadworld[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@atwola[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.hd-teen[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@focalex[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@anad.tacoda[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.screensaver[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@slingmedia[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adecn[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@belgacom[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.nudexxxpics[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.realtechnetwork[3].txt
C:\Documents and Settings\Smoke\Cookies\smoke@komtrack[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@entrepreneur[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@toplist[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@belnk[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@eyewonder[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@skynet[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@i.screensavers[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.mobiledia[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@exitexchange[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@xiti[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sales.liveperson[4].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.glispa[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@a.websponsors[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@vhost.oddcast[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@hqxxxp[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@screensaver[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.interno-porn[3].txt
C:\Documents and Settings\Smoke\Cookies\smoke@jays-xxx-links[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.xxxratedchicks[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@countingdown[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@stats.art-du-deplacement[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.jokeroo[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@maxxx-videos[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@mysexdreams[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@counter.mtree[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.maxxx-videos[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.finalteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@insightexpress[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexothumbs[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornenmeer[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.homesweethomesex[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.snowpornmovies[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.vipsexworld[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.soundtrackcollector[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.xtramsn.co[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@track.vivid[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexyyounggirls[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@asiaporno[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cz5.clickzs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@malwarewipe[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@gcc-00.googleadservices[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.greenmarquee[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@hornymatches[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adultmoviezone[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@vaginafree[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@image.masterstats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@1.adbrite[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.groovystats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@counter.cnw[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cf.dhdmedia[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@thexxxfree[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.findit-quick[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@counter.surfcounters[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.clicksex.com[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@stats.streettrickz[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.contactmusic[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@babespornmag[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexmoviepost[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pinkteenpussy[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@hornypharaoh[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.newadultblogs[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@debbieteen.everestcash[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@mrtrack.dada[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@movieland[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@list[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornmoviesarchive[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.flingweb[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cz11.clickzs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@land-xxx[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.googleadservices[5].txt
C:\Documents and Settings\Smoke\Cookies\smoke@click.maxxandmore[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@bannerlandia.com[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexy-celebs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www4.addfreestats[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@hardcorepornmag[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@server.cpmstar[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@dist.belnk[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@drunkenteens[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adultlounge[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@105-bmp.googleadservices[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornsickle[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@offeroptimizer[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@209.9.174[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.hotsexbombs[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www2.addfreestats[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sex-team[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pstats[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@exit.adult[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@lost-media[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@chokertraffic[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cz4.clickzs[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@xxxlivepics[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.zanox[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornhub[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@bleep-love[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@petiteteenager[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexfarmer[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.rich1.adbn[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@burstnet[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.planetactive[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@superstats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@twelvefifteen[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.foodbuzz[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@famouspornstars[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornenmeer[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24278[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.xplusone[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@trafficdashboard[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cz9.clickzs[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@crossmediaservices[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24218[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.upspiral[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexplanet[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@megateengirls[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.addfreestats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@hotfreesex4all[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24297[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adultadworld[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.as4x.tmcs[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@traffic.kaspiemail[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexy-photos[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.zanox-affiliate[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sale.spyguardpro[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.teenboat[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@usenext[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sonymediasoftware[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.amellyteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@try.screensavers[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.cashstrappedteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.teenax[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@m1.webstats.motigo[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@virusranger[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www6.addfreestats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.xxxlivepics[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cz6.clickzs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornstar-paradise[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24303[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.realtechnetwork[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@new-teen-video[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sex-xvideo[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.boybleepsgirl[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.mybigteenmovie[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@h.starware[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@epicteen[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.porn365[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@herfirstanalsex[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@c.alladultchannel[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.hornycrocodile[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@likecrack[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@find815[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.jouwstats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.contentmedianetwork[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@partner2profit[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@warlog[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.today[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.teengee[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@kanoodle[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.alladultchannel[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@dtr[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@drivecleaner[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexy-flix[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sideshow.directtrack[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.searchextreme[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@vip.clickzs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@try.starware[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@bannerng.oi.com[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ultra-xxx[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@oosex[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@alannah[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@realmedia.co[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.exit-traffic[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www5.addfreestats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@soundtrack[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@porneta[3].txt
C:\Documents and Settings\Smoke\Cookies\smoke@tryteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sextask[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.ideal-teens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@smileycentral[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@hotreflexteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@hot-teen-movies[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.teenist[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@steeplemedia[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@iqcounter[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornaccess[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad1.clickhype[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexrancher[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@mycounter.tinycounter[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@free.teen-teacher[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24304[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.adult-empire[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@partners.tattomedia[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@alladultchannel[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cz8.clickzs[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@fire-sex[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.gamesbannernet[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@data2.perf.overture[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@tour.pornstarslikeitbig[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24302[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.clubteenpix[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www7.addfreestats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@filipinobleep[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.coolbleepgirl[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@38270[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cpvfeed[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexyculo[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@galleries.teens3some[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.teenpalacetgp[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.bleepergalleries[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24305[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@fatherteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@socialmedia[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sex-ultra[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@iqcounter[3].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornhit[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24207[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexparking[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.morpheus[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.oosex[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@realsexcash[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenlib[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adultsallowed[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexycanadiangirls[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@porno.dreammovies[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@statsaholic[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@clickbank[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24279[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.hotteenpussy[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@38262[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@findphoto[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@1sexin18[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teensyou[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.nexxx[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.digitalmedianet[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@galleries1.indianpornpass[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@38298[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@mycuteteens[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornclipsclub[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@mebleepyoulongtime[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.xxxnrg[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexsearchcom[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexproper[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@xxxpower[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenwells[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.adultplayersclub[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@24280[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sex-xvideo[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.trafficadept[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.0stats[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@soundtrack.us.intellitxt[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@bleepmyjeans[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@enhance[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@realteenpictureclub[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.inthecrack[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www3.addfreestats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenax[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teens-photos[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.clevercounter[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@lovebleepk[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.sfomedia[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@media.cardomain[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@8teenpornstars[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@video.pornorama[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.keygen[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@count.primawebtools[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@streamsex[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.wildwidesex[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.tns-counter[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.movfinder[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.cumpornvideo[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ar.atwola[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@max.queerclick[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.public-porno[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.gmodules[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.cnn[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@soundtrackcollector[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@xxxblackbook[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@protect.spyguardpro[3].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornstars-collection[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.jointheporn[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.megapornmovs[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornhit[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@259[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@stats.drivecleaner[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@hit.stat[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@engine.adnet[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@crazy-traffic[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@43995[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@financialcontent.advertserve[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.teenycinema[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pop-porno[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cz3.clickzs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@trackoutlet[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenstryanal.wet-blog[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@primedia.us.intellitxt[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexymovs[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www8.addfreestats[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@tour.sexproadventures[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornopillow[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornolunch[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@clickaider[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@tracker.e-sport[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@euros4click[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornorama[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexburger[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@eas.apm.emediate[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@t1-j1.frathousebleepfest[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexyamateurclips[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.us.e-planning[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.manbleepswomen[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@trafficroup[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenagemovs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@cz2.clickzs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexulus[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sex[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.diamondteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornofantasy[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@track.bestbuy[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornjoy[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.freshxxxclips[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenpalacetgp[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.worldmovieporn[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornmovies2[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.newpornchicks[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.drivecleaner[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@scanner.malware-scan[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@men4sexnow[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sextasya[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexyoung[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.best-free-sex[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@wildpornreview[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@dawsonmillerteen[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@stats.crossmediaservices[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sex.magicmovies[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.addesktop[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.find815[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teens3some[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexbabesweb[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@antispywaresuite[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornmovies2[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@countryroadjunction[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.shopica[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornhub[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornblograbbit[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@findtuition[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@screensavers[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@wt.sexsearch[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexysoftbabes.deecash[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.agava.tbn[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@fliptrack[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@interclick[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sex-blust[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.jizzfinder[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@netmediagroup[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.xxxpornz[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.adultsexblogs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad2.doublepimp[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@media6degrees[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@media-convert[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenstitsandass[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adultsexblogs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@debbieteen.everestcash[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@nakedmaturewoman[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.mintteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.fatherteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.teenswishes[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.warezquality[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pixel.ilsemedia[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.teensnow[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@usenext[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.streamsex[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@itxt.vibrantmedia[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.flux[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexproadventures[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.mediamayhemcorp[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenbe[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teens-time[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@gimmesex[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.amateur-porn0[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@media.pc.ign[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@rotor6.newzfind[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornhub[3].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornstargalore[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www1.addfreestats[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@gostats[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@tracking.foxnews[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenstakeitbig[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@spyguardpro[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@media-bucket[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@youporn[3].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sales.liveperson[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@frathousebleepfest[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@collective-media[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexypattycake[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.psyporn[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.gmodules[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.gmodules[4].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.crakmedia[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adult-youtube-8[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@findology[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@t0.counter43[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@xxxspacegirls[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@clicksor[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.text.tbn[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.tbn[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.afterhourteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@mediafire[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@stat.www[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.bnmedia[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@media.stars.ign[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.my-teensex[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teensexymodels[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@shopica[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads2.firingsquad[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@join.porntube[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adnetserver[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexualbench[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@b5media.us.intellitxt[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@path.pureadstracking[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@findphoto[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexulus[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ad.adocean[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@a.findarticles[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teengee[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.porntube[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@badteensblog[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@208.122.40[3].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.wtfmedia[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornorama[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@stats.ilsemedia[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.pornstar-land[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.veoh[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@allmypornstars[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ah-teens[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@teenbz[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@208.122.40[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@monstersandcritics.advertserve[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adverticum[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@tagiq.clickforensics[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@findmeatune[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.mylovedpornstars[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@sexupmyday[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.fatpenguinmedia[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@porn.gonzo-movies[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@vortexmediagroup[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@scholarship.findtuition[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adultblogdirectory[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@mediasoftware.sonypictures[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@livecams.youporn[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@systemerrorfixer[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.bravoteens[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.techguy[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@optimize.indieclick[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@protect.spyguardpro[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@newadultblogs[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@thecityteens[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@join.frathousebleepfest[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.gametrust[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.reallyeighteen[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@clicks.smartbizsearch[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@linkto.mediafire[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@tour.sexsearchcom[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@adsrevenue[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.everythingtrackandfield[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@mintteens[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.teensofworld[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.virusheat[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.hornywifephotos[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@pornzio[2].txt
C:\Documents and Settings\Smoke\Cookies\smoke@porntube[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@indiads[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@antispykit[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@trafficgigolos[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@ads.ak.facebook[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.googleadservices[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.sexyvideox[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@galleries.adult-empire[1].txt
C:\Documents and Settings\Smoke\Cookies\smoke@www.porn[1].txt

Adware.MovieLand/MediaPipe
HKLM\Software\MediaPipe
HKLM\Software\MediaPipe\Prefs
HKLM\Software\MediaPipe\Prefs#version
HKLM\Software\MediaPipe\Prefs#ItBill
HKLM\Software\MediaPipe\Prefs#ProductFamily
HKLM\Software\MediaPipe\Prefs#Country
HKLM\Software\MediaPipe\Prefs#Provider
HKLM\Software\MediaPipe\Prefs#TRAFFIC_COUNTRY
HKLM\Software\MediaPipe\Prefs#TRAFFIC_PROGRAM
HKLM\Software\MediaPipe\Prefs#TRAFFIC_SOURCE
HKLM\Software\MediaPipe\Prefs#TRAFFIC_SUBSOURCE
HKLM\Software\MediaPipe\Prefs#JOIN_FORM_ID
HKLM\Software\MediaPipe\Prefs#modem
HKLM\Software\MediaPipe\Prefs#GUID
HKLM\Software\MediaPipe\Prefs#Filename
HKLM\Software\MediaPipe\Prefs\ItBill
HKLM\Software\MediaPipe\Prefs\ItBill#Provider
C:\Program Files\MovieLand Terms.html
C:\Program Files\MediaPipe\install.log
C:\Program Files\MediaPipe\ItBill_terms.txt
C:\Program Files\MediaPipe\MediaPipe.ini
C:\Program Files\MediaPipe\p2pl.exe
C:\Program Files\MediaPipe
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP777\A0136690.EXE

Trojan.Anti-Virus Pro
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK\0000#DeviceDesc
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK\0000#Capabilities
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SECUREDISK\0000\LogConf
C:\Documents and Settings\Smoke\Desktop\Anti-Virus-Pro.pkg

Malware.Notifier
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#ishost.exe [ ishost.exe ]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#issearch.exe [ issearch.exe ]
C:\WINDOWS\SYSTEM32\ISMON.EXE
C:\WINDOWS\SYSTEM32\ISNOTIFY.EXE

Trojan.Downloader-WNSET/N
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\2219956974.EXE
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\1134822534.EXE
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\1750149552.EXE
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\1883652372.EXE
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\2383954066.EXE
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\2866573988.EXE
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\3222158904.EXE

Rogue.VirusHeat
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\BR37.EXE
C:\DOCUMENTS AND SETTINGS\SMOKE\LOCAL SETTINGS\TEMP\~NSU.TMP\AU_.EXE

Trojan.Unclassified/Multi-Dropper (Packed)
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP775\A0134228.EXE

Adware.SXGAdvisor-A
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP775\A0134229.DLL

Trojan.Unclassified/GTS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP775\A0134230.DLL

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP775\A0134241.ICO
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP775\A0134242.ICO

Trojan.FakeAlert-Gen/Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP775\A0134243.DLL

Rogue.NetProject-Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP775\A0134245.EXE

Trojan.Downloader-Gen/MROFIN
C:\WINDOWS\MROFINU1535.EXE

Trace.Known Threat Sources
C:\Documents and Settings\Smoke\Local Settings\Temp\Temporary Internet Files\Content.IE5\OLFUCXH3\g_default[1].gif

#8 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:06 PM

Posted 05 April 2008 - 03:35 PM

In regular mode now

be sure and unload teatimer and MacAfee from running before the scan, you might even disconnect from the internet until MBAM finishes
  • Please download Malwarebytes' Anti-Malware and save it to a convenient location.
  • Double click on mbam-setup.exe to install it.
  • Before clicking the Finish button, make sure that these 2 boxes are checked (ticked):
    • Update Malwarebytes' Anti-Malware
      Launch Malwarebytes' Anti-Malware
  • Malwarebytes' Anti-Malware will now check for updates. If your firewall prompts, please allow it. If you can't update it, select the Update tab. Under Update Mirror, select one of the websites and click on Check for Updates.
  • Select the Scanner tab. Click on Perform full scan, then click on Scan.
  • Leave the default options as it is and click on Start Scan.
  • When done, you will be prompted. Click OK, then click on Show Results.
  • Checked (ticked) all items and click on Remove Selected.
  • After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest.

Edited by DaChew, 05 April 2008 - 03:43 PM.

Chewy

No. Try not. Do... or do not. There is no try.

#9 esquilo1

esquilo1
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 05 April 2008 - 03:54 PM

oh wait, dude, that scan was done in regular mode. should i do the next on in safe-mode or what???

oh yea, could you remind me of the best way to restart in safe mode??? i always forget {shrugs}

#10 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:06 PM

Posted 05 April 2008 - 04:22 PM

http://www.malwareremoval.com/tutorials/safemodeboot.php

start back over with SAS

this will tell us what malware reloaded and give us some clues as to what SAS was missing in normal mode?
Chewy

No. Try not. Do... or do not. There is no try.

#11 esquilo1

esquilo1
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:06 AM

Posted 05 April 2008 - 10:30 PM

yo, my computer won't boot in safemode (despite trying multiple methods) and now it won't boot at all. on all occasions it would say that "an error was detected and windows was forced to shut down" (even when i try to start it normally) so i have no idea what to do.

what do i do now?? {sigh} shall i take it somewhere???

#12 DaChew

DaChew

    Visiting Alien


  • BC Advisor
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:12:06 PM

Posted 05 April 2008 - 11:27 PM

I had one I was trying to fix a couple of years ago, it wouldn't let me boot into safe mode and when I disconnected from the internet it wouldn't let me boot into normal mode, I reloaded.

You might be able to recover some data with the drive in another computer, however your infection was a newer particularly malicious one, either a bundle of crud or multiple seperate ones, and I would be suspicious of anything saved from P2P downloads

Running windows as a repair disk then running MBAM might get you up and running, however having McAfee running or teatimer might break the computer again

A factory restore would be the best option

Edited by DaChew, 05 April 2008 - 11:32 PM.

Chewy

No. Try not. Do... or do not. There is no try.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users