Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan.ADH was allowed to run/install; Am I safe???


  • Please log in to reply
11 replies to this topic

#1 Sarli

Sarli

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 24 February 2011 - 09:59 AM

Hello there,

It is my first time here… I’m not a very knowledgeable computer guy – but quite a curious user. I got infected with a “Trojan.ADH”.

(((I searched in previous posts, but … there are over 1000 entries for “Trojan”, and none for “Trojan.ADH” --- my apologies if this post is misplaced)))

System in question: Windows 7 ultimate 64, with Norton Security Suite offered by Comcast. I also have Registry Mechanic, Malwarebytes, and regularly use Firefox with Adblocker and NoScript extentions. This is a 4 years old AMD Athlon 64, 250Gb of HD (about 100Gb left), 2Gb of RAM (I think), used mostly for internet, communication, and office applications, and I have backups for my files. If all is lost, I loose hours of multiple installations only (only?!).

(I’m writing from a personal laptop – fairly new, and never had any virus… to my knowledge! This laptop is part of the same homegroup where the infected computer resides.)

History of the problem:
I had internet connection issues, and it took Comcast 5 days and 2 visits to fix it. In that time, I’m not sure who or how the computer was used – the Comcast technician is above any suspicion, but with the distraction, visitors, and kids playing in the house… everyone used that computer. I learned through logs and talks that:
- uTorrent was downloaded and installed(!)... It will be taken off.
- a zip file was downloaded from a torrent and Norton stopped its execution - “Trojan.ADH” was found and stopped.
- claiming that was a false positive, someone put down Norton temporarily, and run the file (w7lxe.exe), and 2 boots later, the computer was “looking normal”.
- At least 3 people (maybe more) tried to fix the problem before I was informed… God knows what they did… I could not get a clear history.
- Malwarebites and Norton say I have nothing running, but… How can I be sure I am not hosting a program, waiting for a signal?
- Newly installed in that computer is a Netgear wireless device (N300) to avoid all the cable work around the house. I use a Wireless Router with security WPA Personal, and encryption TKIP. As a precaution, the computer has remained physically out of network, unconnected to the internet, except for a one-time Norton update.

I wanted to revert it all to a restore point – but ALL my Windows 7 restore points were erased. Registry Mechanic says I have a registry restore point back in Dec/2010… I’m inclined to take that chance, but I did not do yet.

Symptoms:
- All Windows 7 restore points were erased.
- Some folders are now restricted access, and I can’t open them (such as “MSOCache”, “Documents and Settings”, “System Volume Information”, “Program data/Start Menu”, and others) even though I seem to have admin rights.
- There are new folders and new files all over the place – I’m not comfortable with them.
- Sometimes, I am unable to execute actions a admin should do – open certain folders, change the writes of a NEW guest account, etc.

I left Norton running a full scan last night, looking into zips and system files, and it found a “Trojan.ADH” 3 times – all deleted or in quarantine.

The real question here is: AM I SAFE? And also: “Is My Network safe? Is my Bank Account safe? Are my backups safe?” How can I make SURE the whole thing is clean?

(rhetorical: what is the latest thought on teenager punishment? :censored: )

NEW INFO: I am NOT safe!
- Using Windows Explorer, I deleted a "new" folder called "$Recycle.Bin".... but it came back! in a DOS window, I can see it has other directories in it, with strange names, etc....
- On C:\ I found a log file with the date of the infection, and some description -- it seems to be the log of the infection, if that exists. I have it saved. It is named "Khalinstall.log", and it goes like this:

=== Verbose logging started: 6/6/2010 9:25:24 Build type: SHIP UNICODE 3.01.4000.4039 Calling process: C:\DOCUME~1\Mario\LOCALS~1\Temp\{85E3C3B8-EC25-4130-A440-9A084C3EDED4}\setup.exe ===
MSI © (CC:34) [09:25:24:875]: Resetting cached policy values
MSI © (CC:34) [09:25:24:875]: Machine policy value 'Debug' is 0
MSI © (CC:34) [09:25:24:875]: ******* RunEngine:
******* Product: D:\1b-SetPoint\KHAL\KhalInstaller32.msi
...................

- NOW that I know this bug is still active, I need Help!

Edited by Sarli, 24 February 2011 - 10:39 AM.


BC AdBot (Login to Remove)

 


#2 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:08:59 AM

Posted 24 February 2011 - 10:33 AM

Can you please post the logs from Malwarebytes?

#3 Sarli

Sarli
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 24 February 2011 - 10:56 AM

ok -- I updated it and I'm running a full scan. I'll post it as soon as it finishes.
(THANK YOU for the quick reply!)

Here it is:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5868

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2/24/2011 12:51:09 PM
mbam-log-2011-02-24 (12-50-54).txt

Scan type: Full scan (C:\|)
Objects scanned: 481653
Time elapsed: 1 hour(s), 49 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Mario\documents\downloads_installation\3-dreamweaver8\KeyGen8.exe (RiskWare.Tool.CK) -> No action taken.
c:\Users\Mario\savingfiles\downloads_installation\3-dreamweaver8\KeyGen8.exe (RiskWare.Tool.CK) -> No action taken.


****************************************
After I saved this log, both instances were successfully cleaned (quarantine then delete). On the other hand, I have not ever used that file -- It came within several folders I kept from a previous computer.

The "Objects scanned" above says 481k files - but Norton scanned 935k files, and took 3.5 hours.

Also, I found another log from a quick scan executed right after the infection - it says:

Scan Stats:
Scan Time: 980 seconds
Scan Options:
Scan Targets: C:\Documents and Settings
Counts:
Total items scanned: 78,913
- Files & Directories: 78,913
- Registry Entries: 0
- Processes & Start-up Items: 0
- Network & Browser Items: 0
- Other: 0
- Trusted Files: 87
- Skipped Files: 0

Total security risks detected: 1
Total items resolved: 1
Total items that require attention: 0

Resolved Threats:
Trojan.ADH
Type: Compressed
Risk: High (High Stealth, High Removal, High Performance, High Privacy)
Categories: Virus
Status: Fully Resolved
-----------
1 File
[w7lxe.exe] inside of [c:\users\amy\downloads\windows.7.loader.extreme.edition.v3.503-napalum.zip] - Deleted

Unresolved Threats:
No unresolved risks


Edited by Sarli, 24 February 2011 - 01:04 PM.


#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:59 AM

Posted 24 February 2011 - 03:05 PM

IMPORTANT NOTE: Your scan log results indicate you are using keygens/crack tools.

The practice of using cracking tools, keygens, warez or any pirated software is not only considered illegal activity but it is a serious security risk.

Cracking applications are used for illegally breaking (cracking) various copy-protection and registration techniques used in commercial software. These programs may be distributed via Web sites, Usenet, and P2P networks.

trendmicro.com/vinfo

...warez and crack web pages are being used by cybercriminals as download sites for malware related to VIRUT and VIRUX. Searches for serial numbers, cracks, and even antivirus products like Trend Micro yield malcodes that come in the form of executables or self-extracting files...quick links in these sites also lead to malicious files. Ads and banners are also infection vectors...

Keygen and Crack Sites Distribute VIRUX and FakeAV

...warez/piracy sites ranked the highest in downloading spyware...just opening the web page usually sets off an exploit, never mind actually downloading anything. And by the time the malware is finished downloading, often the machine is trashed and rendered useless.

University of Washington spyware study

...One of the most aggressive and intrusive of all bad websites on the Internet are serial, warez, software cracking type sites...they sneak malware onto your system...Where do trojan viruses originate? One of the biggest malware distributors on the Internet are serial/warez/code cracking sites.

Bad Web Sites: Malware

When you use these kind of programs, be forewarned that some of the worst types of malware infections can be contracted and spread by visiting crack, keygen, warez and other pirated software sites. In many cases, those sites are infested with a smörgåsbord of malware and an increasing source of system infection. Those who attempt to get software for free can end up with a computer system so badly damaged that recovery is not possible and it cannot be repaired. When that happens there is nothing you can do besides reformatting and reinstalling the OS.

I strongly recommend that you remove all cracks and keygens immediately to reduce the risk of infection/reinfection. If not, then we are just wasting time trying to clean your system. Further, other tools used during the disinfection process may detect crack and keygens so we need to ensure they have been removed.

Using these types of programs or the websites visited to get them is almost a guaranteed way to get yourself infected!!


The "Objects scanned" above says 481k files - but Norton scanned 935k files, and took 3.5 hours.


The speed and ability to complete an anti-virus or anti-malware scan depends on a variety of factors.
  • The program itself and how its scanning engine is designed to scan: using a signature database vs heuristic scanning or a combination of both.
  • Options to scan for spyware, adware, riskware and potentially unwanted programs (PUPS).
  • Options to scan memory, boot sectors, registry and alternate data streams (ADS).
  • Type of scan performed: Deep, Quick or Custom scanning.
  • What action has to be performed when malware is detected.
  • A computer's hard drive size.
  • Disk used capacity (number of files to include temporary files) that have to be scanned.
  • Types of files (.exe, .dll, .sys, .cab, archived, compressed, packed, email, etc) that are scanned.
  • Whether external drives are included in the scan.
  • Competition for and utilization of system resources by the scanner.
  • Other running processes and programs in the background.
  • Interference from malware.
  • Interference from the user.
-- Using two security scanning engines at the same time can cause each to interfere with the other, cause systems hangs, false detections, unreliable results and other unpredictable behavior.

-- If the screensaver, hibernation or Sleep Mode are not turned off before scanning, those features can sometimes have odd effects when attempting to resume normal mode.


Note: It is not unusual for an anti-virus or anti-malware scanner to be suspicious of some compressed, archived, .cab .jar and packed files because they have difficulty reading what is inside them. These kind of files often trigger alerts by security software using heuristic detection because they are resistant to scanning (difficult to read). This resistance may also result in some scanners to stall (hang) on these particular types of files or just ignore (skip) them. Certain files in the System Volume Information Folder like the Tracking.log (created by the Distributed Link Tracking Service to store maintenance information) have also been reported as a source causing some scanners to hang.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 Sarli

Sarli
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 24 February 2011 - 03:50 PM

Hi,
While I agree with 100% of your remarks (regarding cracks and keygens), I would like to clarify: This computer has files added by many people - me included. Yes, I am deleting all such files as I encounter them.

--- regarding the "Keygen" file:

... I have not ever used that file -- It came within several folders I kept from a previous computer.


--- regarding the "w7lxe.exe" file: I have no idea what that file is / was.

--- the Norton and the Malwarebytes did not run at the same time, but rather independently.

So, as I understand, your only recommendation is for a full HD format. Is that correct? please confirm.
thanks!

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:59 AM

Posted 24 February 2011 - 06:56 PM

... I have not ever used that file -- It came within several folders I kept from a previous computer.

Whether you used it is not the point. Someone visited a crack site and downloaded that file.

So, as I understand, your only recommendation is for a full HD format. Is that correct? please confirm.

No. I only provided a warning about using cracks and keygens and that in some cases using such tools can end up with a computer system so badly damaged that recovery is not possible. When that happens there is nothing you can do besides reformatting and reinstalling the OS. That does not appear to be the case here so you can continue working with cryptodan.

BTW, w7lxe.exe is a file sharing torrent most likely related to Windows 7 Loader eXtreme Edition.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 Sarli

Sarli
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 25 February 2011 - 08:23 AM

Ok -- thanks again, Janitor.

CryptoDan, I'll be waiting for the next steps.
(Just FYI, since it is not related to this Trojan problem: my external HD is not accessible... what a great timing! I'll probably make another post asking about possible formatting... just in case.)
thanks again.

#8 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:08:59 AM

Posted 25 February 2011 - 09:25 AM

Now please run the following scans.

SUPERAntiSpyware:

Please download and scan with SUPERAntiSpyware Free

  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If it will not start, go to Start > All Prgrams > SUPERAntiSpyware and click on Alternate Start.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  • Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen and exit the program.
  • Do not run a scan just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:
  • Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.

Instructions:

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.


Now GMER

GMER does not work in 64bit Mode!!!!!!

Please download GMER from one of the following locations and save it to your desktop:

  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic Full Scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.
-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning
.



#9 Sarli

Sarli
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 26 February 2011 - 12:13 PM

Hi... it went on for a long time, but no problems to report. here are the logs:

SuperAntiSpyware:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/25/2011 at 07:49 PM

Application Version : 4.49.1000

Core Rules Database Version : 6483
Trace Rules Database Version: 4295

Scan type : Complete Scan
Total Scan Time : 03:26:29

Memory items scanned : 326
Memory threats detected : 0
Registry items scanned : 12717
Registry threats detected : 0
File items scanned : 315345
File threats detected : 398

Adware.Tracking Cookie
a.ads2.msads.net [ C:\Users\Ann\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\3Z5S4DUJ ]
cdn4.specificclick.net [ C:\Users\Ann\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\3Z5S4DUJ ]
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\ann@kahalaresort-px.trvlclick[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@a1.interclick[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@account.live[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@ad.wsod[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@adinterax[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@ads.pubmatic[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@ads.undertone[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@bizrate[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@chitika[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@clickfuse[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@collective-media[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@dealtime[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@edgeadx[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@event.trvlclick[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@finderscheapers[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@imrworldwide[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@interclick[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@invitemedia[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@kahalaresort-px.trvlclick[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@kahalaresort.trvlclick[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@linksynergy.walmart[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@lucidmedia[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@media6degrees[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@pointroll[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@reztrack[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@richmedia.yahoo[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@specificmedia[1].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@steelhousemedia[2].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@www.googleadservices[3].txt
C:\Users\Ann\AppData\Roaming\Microsoft\Windows\Cookies\Low\ann@www.googleadservices[4].txt
.interclick.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.interclick.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.interclick.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.specificmedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.pointroll.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.pointroll.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.media6degrees.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.media6degrees.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.adinterax.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.adinterax.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.collective-media.net [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.edgeadx.net [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.media6degrees.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.media6degrees.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.lucidmedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.mediabrandsww.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.lucidmedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.lucidmedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.adxpose.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.doubleclick.net [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.atdmt.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.atdmt.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.insightexpressai.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.insightexpressai.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.insightexpressai.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.insightexpressai.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.insightexpressai.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.insightexpressai.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.content.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.zedo.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.zedo.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.zedo.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.zedo.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.zedo.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.zedo.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.zedo.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.content.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.zedo.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.apmebf.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.mediaplex.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.yieldmanager.net [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
statse.webtrendslive.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.xm.xtendmedia.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.statcounter.com [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.yadro.ru [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.yadro.ru [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
.2o7.net [ C:\Users\Ann\AppData\Roaming\Mozilla\Firefox\Profiles\5ot21rtb.default\cookies.sqlite ]
bc.youporn.com [ C:\Users\Mary\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\E4RUWEEJ ]
clickjogos.uol.com.br [ C:\Users\Mary\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\E4RUWEEJ ]
media.mtvnservices.com [ C:\Users\Mary\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\E4RUWEEJ ]
media1.break.com [ C:\Users\Mary\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\E4RUWEEJ ]
secure-us.imrworldwide.com [
C:\Users\Mary\AppData\Roaming\Microsoft\Windows\Cookies\Low\mary@ads.undertone[1].txt
C:\Users\Mary\AppData\Roaming\Microsoft\Windows\Cookies\Low\mary@interclick[1].txt
C:\Users\Mary\AppData\Roaming\Microsoft\Windows\Cookies\Low\mary@invitemedia[1].txt
C:\Users\Mary\AppData\Roaming\Microsoft\Windows\Cookies\Low\mary@pointroll[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@008.free-counters.co[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@247realmedia[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@2o7[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ad.wsod[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ad.yieldmanager[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@adbrite[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ads.pointroll[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ads.undertone[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@advertising[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@apmebf[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@at.atwola[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@atdmt[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@bs.serving-sys[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@casalemedia[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@collective-media[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@content.yieldmanager[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@data.coremetrics[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@doubleclick[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@fastclick[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@imrworldwide[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@interclick[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@invitemedia[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@media.expedia[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@mediaplex[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@microsoftwindows.112.2o7[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@msnportal.112.2o7[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@pointroll[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@pro-market[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@questionmarket[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@revsci[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ru4[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@serving-sys[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@specificclick[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@statse.webtrendslive[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@t.pointroll[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@tacoda[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@tribalfusion[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@www.googleadservices[2].txt
atdmt.com [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
bannerfarm.ace.advertising.com [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
cdn4.specificclick.net [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
core.insightexpressai.com [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
interclick.com [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
m1.2mdn.net [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
media.tattomedia.com [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
objects.tremormedia.com [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
spe.atdmt.com [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
udn.specificclick.net [ C:\Windows.old\Documents and Settings\Ann\Application Data\Macromedia\Flash Player\#SharedObjects\GEVK47CK ]
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@005.free-counters.co[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@a.findarticles[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@a1.interclick[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@accounts[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ad.wsod[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ad.yieldmanager[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@adbrite[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@adinterax[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ads.bluelithium[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ads.cnn[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ads.healthcare[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ads.undertone[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ads.widgetbucks[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@advertising[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@adxpose[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@ameriprisestats[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@apmebf[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@atdmt[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@bizrate[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@chitika[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@collective-media[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@countrywide[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@dc.tremormedia[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@dealtime[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@directhomediscount[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@discountramps[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@doubleclick.hertz[3].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@doubleclick[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@euroclick[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@eyewonder[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@fastclick[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@findarticles[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@findarticles[3].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@findwhat[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@forcefinder[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@imagebank.ipcmedia[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@incentaclick[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@interclick[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@intermundomedia[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@invitemedia[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@keywordmax[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@landing.hitfarm[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@media.expedia[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@media.mtvnservices[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@media.photobucket[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@media.zoominfo[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@media303[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@media6degrees[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@mediaplex[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@mlspropertyfinder[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@partner2profit[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@pointroll[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@pt.crossmediaservices[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@qnsr[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@richmedia.yahoo[3].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@server2.bkvtrack[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@sitestat.mayoclinic[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@socialmedia[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@sojern.122.2o7[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@specificmedia[3].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@steelhousemedia[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@suncountry[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@t2.trackalyzer[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@thefind[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@track.bestbuy[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@tracking.foundry42[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@tracking.foundry42[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@tribalfusion[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@www.directnetadvertising[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@www.forcefinder[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@www.googleadservices[1].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@www.googleadservices[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@www.googleadservices[3].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@www.incentaclick[2].txt
C:\Windows.old\Documents and Settings\Ann\Cookies\ann@www.vertadnet[1].txt
bc.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Macromedia\Flash Player\#SharedObjects\FE5KUP3B ]
www.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Macromedia\Flash Player\#SharedObjects\FE5KUP3B ]
statse.webtrendslive.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.myweather.112.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.statcounter.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.invitemedia.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.invitemedia.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
banners.argohost.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.yadro.ru [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.nextag.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.nextag.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.nextag.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.nextag.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.nextag.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.nextag.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.dealtime.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
stat.dealtime.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.cpocommerceinc.112.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.imrworldwide.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.imrworldwide.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.bnkicom.112.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.freddiemac.122.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
.stats.paypal.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Application Data\Mozilla\Firefox\Profiles\xfgboe4t.default\cookies.sqlite ]
C:\Windows.old\Documents and Settings\ZZZ_CleanedMary\Cookies\mary@collective-media[1].txt
adknowledge.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
babbasex.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
bc.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
cdn-www.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
content3.pornkolt.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
crackle.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
files.adbrite.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
files.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
host-d.oddcast.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
interclick.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media.biertijd.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media.cnbc.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media.monster.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media.mtvnservices.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media.scanscout.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media.tattomedia.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media.uniquepeek.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media.xpock.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media0.fux.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
media1.break.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
mediastorm.org [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
oddcast.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
pornoprinzen.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
pornotube.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
secure-us.imrworldwide.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
sexoamador.uol.com.br [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
static.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
video1.redorbit.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
www.pornhost.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
www.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
www.pornotube.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
youporn.videobox.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Macromedia\Flash Player\#SharedObjects\9GBYUMXY ]
.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.invitemedia.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.invitemedia.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.pornstarclassics.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.imrworldwide.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.imrworldwide.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
banners.argohost.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
flagcounter.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
media.mtvnservices.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
media.mtvnservices.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.pointroll.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.pointroll.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.statcounter.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
stats1.clicktracks.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
stats1.clicktracks.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
stats1.clicktracks.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
stats1.clicktracks.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.generalelectric.112.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.yadro.ru [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
www8.addfreestats.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.atdmt.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.atdmt.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.overture.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.overture.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.doubleclick.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.cz5.clickzs.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.cz5.clickzs.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.dowjones.122.2o7.net [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.pornhub.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.naiadsystems.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.naiadsystems.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
.youporn.com [ C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Mozilla\Firefox\Profiles\j2bk6yjn.default\cookies.sqlite ]
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@ad.text.tbn[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@adinterax[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@count.rbc[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@komtrack[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@newzfind[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@toyboxxx[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@tracking.foxnews[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@www.adultfilmcentral[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@www.pornotv.com[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@www.sexxyshop.com[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@www.sexytimes[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\MarySue@www.softclick.com[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@247realmedia[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@a1.interclick[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@ad.wsod[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@ad.yieldmanager[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@adbrite[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@ads.undertone[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@adtracker.americantowns[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@bs.serving-sys[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@collective-media[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@content.yieldmanager[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@eyewonder[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@imrworldwide[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@interclick[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@invitemedia[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@media.expedia[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@media6degrees[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@oasn04.247realmedia[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@partner2profit[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@pluckit.demandmedia[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@pointroll[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@richmedia.yahoo[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@serving-sys[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@socialmedia[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@specificclick[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@specificmedia[2].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@visitnewengland.advertserve[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@www.googleadservices[1].txt
C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Cookies\mary_sue@www.googleadservices[5].txt

Trojan.Vundo-Variant/F
C:\WINDOWS.OLD\PROGRAM FILES\ADOBE\ACROBAT 7.0\ACROBAT\PLUG_INS\PAPERCAPTURE\SERVER\ROMAN\CODECVT.DLL
C:\WINDOWS.OLD\PROGRAM FILES\ADOBE\ACROBAT 7.0\ACROBAT\PLUG_INS\PAPERCAPTURE\SERVER\ROMAN\MEMIO.DLL
C:\WINDOWS.OLD\PROGRAM FILES\ADOBE\ACROBAT 7.0\ACROBAT\PLUG_INS\PAPERCAPTURE\SERVER\ROMAN\OCRUTIL.DLL
C:\WINDOWS.OLD\PROGRAM FILES\ADOBE\ACROBAT 7.0\ACROBAT\PLUG_INS\PAPERCAPTURE\SERVER\ROMAN\PCCRSDK.DLL
C:\WINDOWS.OLD\PROGRAM FILES\ADOBE\ACROBAT 7.0\ACROBAT\PLUG_INS\PAPERCAPTURE\SERVER\ROMAN\POST.DLL
C:\WINDOWS.OLD\PROGRAM FILES\ADOBE\ACROBAT 7.0\ACROBAT\PLUG_INS\PAPERCAPTURE\SERVER\ROMAN\TUHAND32.DLL
C:\WINDOWS.OLD\PROGRAM FILES\ADOBE\ACROBAT 7.0\ACROBAT\PLUG_INS\PAPERCAPTURE\SERVER\ROMAN\TUMACH32.DLL
C:\WINDOWS.OLD\PROGRAM FILES\CANON\PHOTORECORD\PROGRAM\XMLPARSE.DLL
C:\WINDOWS.OLD\PROGRAM FILES\CANON\PHOTORECORD\PROGRAM\XMLTOK.DLL


__________________________________________________________________

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-02-25 22:26:30
Windows 6.1.7600
Running: ydupzbx6.exe


---- Files - GMER 1.0.15 ----

File C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Ahead\Nero BackItUp\Info Files\20091904_003438_090418_Backup\C\DOCUME~1\ANNCON~1\APPLIC~1\MACROM~1\FLASHP~1\#SHARE~1\GEVK47CK\CONTEN~1.COM\images\store\category\designer\default\0114\swf 0 bytes
File C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Ahead\Nero BackItUp\Info Files\20091904_003438_090418_Backup\C\DOCUME~1\MARYS~1\APPLIC~1\MACROM~1\FLASHP~1\#SHARE~1\9GBYUMXY\A332GA~1.NET\f\332\936\12h\WWWEDM~1.COM\media\1024hp\2008 0 bytes
File C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Ahead\Nero BackItUp\Info Files\20091904_003438_090418_Backup\C\DOCUME~1\MARYS~1\APPLIC~1\MACROM~1\FLASHP~1\#SHARE~1\9GBYUMXY\A332GA~1.NET\f\332\936\12h\WWWEDM~1.COM\media\1024hp\2008\0901 0 bytes
File C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Ahead\Nero BackItUp\Info Files\20091904_003438_090418_Backup\C\DOCUME~1\MARYS~1\APPLIC~1\MACROM~1\FLASHP~1\#SHARE~1\9GBYUMXY\A332GA~1.NET\f\332\936\12h\WWWEDM~1.COM\media\1024hp\2008\1103 0 bytes
File C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Ahead\Nero BackItUp\Info Files\20091904_003438_090418_Backup\C\DOCUME~1\MARYS~1\APPLIC~1\MACROM~1\FLASHP~1\#SHARE~1\9GBYUMXY\A332GA~1.NET\f\332\936\12h\WWWEDM~1.COM\media\1024hp\2008\1110 0 bytes
File C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Ahead\Nero BackItUp\Info Files\20091904_003438_090418_Backup\C\DOCUME~1\MARYS~1\APPLIC~1\MACROM~1\FLASHP~1\#SHARE~1\9GBYUMXY\A332GA~1.NET\f\332\936\12h\WWWEDM~1.COM\media\1024hp\2008\1117 0 bytes
File C:\Windows.old\Documents and Settings\ZZZ_CleanedMarySue\Application Data\Ahead\Nero BackItUp\Info Files\20091904_003438_090418_Backup\C\DOCUME~1\MARYS~1\APPLIC~1\MACROM~1\FLASHP~1\#SHARE~1\9GBYUMXY\A332GA~1.NET\f\332\936\12h\WWWEDM~1.COM\media\1024hp\2008\1208 0 bytes

---- EOF - GMER 1.0.15 ----




My questions:
1) What does it all mean? Did it solve the "problem"? (other than the usage issues I'll have to address)
2) Can I run those 2 tools in my personal computer as well? I have the same Norton, and Norton did not find nor protect against all the stuff reported above.
3) What tool should I have installed to prevent all that stuff above (assuming the behavior of the users change some as well)
thanks,

#10 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:08:59 AM

Posted 26 February 2011 - 12:19 PM

What SAS Found was tracking cookies and Vundo. Are you still experiencing issues with security.

#11 Sarli

Sarli
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:59 AM

Posted 27 February 2011 - 01:57 PM

Hi (Crypto)Dan,
I don't know -- the computer still has some folders locked away from me, but some other folders became accessible once again. I don't know what to think.

Please let me know if there is still something else I can do to guarantee it is clean now.

#12 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:08:59 AM

Posted 27 February 2011 - 03:07 PM

If you want to make sure its clean then Please follow the instructions in ==>This Guide<==.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include the link to this topic in your new topic and a description of your computer issues and what you have done to resolve them.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

Once you have created the new topic, please reply back here with a link to the new topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users