Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD using DOS Prompt and quickscan.bitdefender.com popup error


  • Please log in to reply
19 replies to this topic

#1 Damned Cortex

Damned Cortex

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:12:02 AM

Posted 16 May 2011 - 02:44 PM

Hello and Thanks to all who make this type of forum great!

I am having an extremely odd issue.

Windows 7 64bit
Dell e6410

I ran Windows Update approximately 8 days ago. After the reboot I can no longer copy files at the DOS Prompt (I'm a Unix hound and prefer using the CLI for batch copying using xcopy). Large files will copy, but when the verfication starts to close out the file on the remote end, Windows Blue Screens (sorry I have not copied the error). I thought nothing of this thinking a windows update caused the issue and in a few more updates it would be fixed.

Then other odd behavior like booting taking 3 minutes (this is a new i7 with 8 Gigs of RAM and snazzy fast HD), which is now almost twice as long as it took to boot up previously.

The MS Front End that is used for anti-virus (not my choice) didn't find anything.

I then went to http://quickscan.bitdefender.com/. In Internet Explorer I received a box up window with the title "Message from webpage" with a yellow triangle with exclamation point in it with the words "Wasting my time!" and an OK button.

Clicking on the QuickScan button doesn't do anything.

I then loaded the page in both Chrome and Firefox and did not get any error messages but did install the plug ins. The scans ran but with no negative findings.

I downloaded Hijackthis to see if anything odd came up but nothing appears out of the ordinary. Using searches for different items in the log have brought me to sites like this one, but I am not 100% positive. The registry and file's listed do not show up in my HijackThis log.

I downloaded Malwarebytes' Anti-malware to see if it could find anything and it came up negative.

I tried using Bitdefender's bootdisk, but certain drivers are not present so the Linux does not run properly.

I downloaded and ran Norton's 360 AV, AVG, ClamAV all installed and ran but with no negative results.

I use an SSL VPN from F5 Networks and it checks to see if any anti-virus is loaded and while I have anti-virus loaded on the Computer, it does not allow me to connect due to my system not meeting the minimum requirements. I even uninstalled and re-installed the VPN software to see if something had gotten corrupted. Still no connection.

All my Googling and Internet searches have turned up nothing, especially about the quickscan.bitdefender.com message that pops up.

Has anyone else come across this type of behavior?

Thank you in advance.

BC AdBot (Login to Remove)

 


#2 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:07:02 AM

Posted 16 May 2011 - 02:55 PM

First lets do:

We need to know more about your BSODs...

Download BlueScreenView (in Zip file)

No installation required.

Unzip downloaded file and double click on BlueScreenView.exe file to run the program and When scanning is done, go to Edit > Select All.

Then go to File > Save Selected Items, and save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

Compliments of Broni


Can you post the logs from Malwarebytes?

SUPERAntiSpyware:

Please download and scan with SUPERAntiSpyware Free

  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If it will not start, go to Start > All Prgrams > SUPERAntiSpyware and click on Alternate Start.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  • Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen and exit the program.
  • Do not run a scan just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:
  • Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.

Instructions:

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.


Now GMER

GMER does not work in 64bit Mode!!!!!!

Please download GMER from one of the following locations and save it to your desktop:

  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic Full Scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.
-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning
.



#3 Damned Cortex

Damned Cortex
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:12:02 AM

Posted 16 May 2011 - 03:14 PM

Thank you for the quick reply.

the Blue Screen View did not come up with anything in the windows, I checked the dump directory and there are no files (is there a limit to how long they stay?)

I forgot to mention that I ran SuperAntiSpyware, but not with your settings, so I will rerun that with your settings.

It states that GMER does not work in 64bit mode. Does that mean that it will not scan a 64bit windows box properly?

Again thank you for your time.

#4 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:07:02 AM

Posted 16 May 2011 - 03:25 PM

Use gmer anyways.

#5 Damned Cortex

Damned Cortex
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:12:02 AM

Posted 16 May 2011 - 05:09 PM

As I stated previously, the blue screen dump files are missing. I will attempt to repro later to see if it happens again (after happening 3 times last week, I stopped copying files from the CLI)

From SAS before using the settings from Cryptodan:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/16/2011 at 09:22 AM

Application Version : 4.52.1000

Core Rules Database Version : 7065
Trace Rules Database Version: 4877

Scan type : Complete Scan
Total Scan Time : 00:32:46

Memory items scanned : 710
Memory threats detected : 0
Registry items scanned : 14799
Registry threats detected : 0
File items scanned : 45884
File threats detected : 316

Adware.Tracking Cookie
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@atdmt[1].txt
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@ad.wsod[2].txt
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\administrator@msnportal.112.2o7[1].txt
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\test@ad.wsod[2].txt
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\test@atdmt[2].txt
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\test@doubleclick[1].txt
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\test@imrworldwide[2].txt
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\test@questionmarket[1].txt
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\test@www.visitortracklog[1].txt
.doubleclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.imrworldwide.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.imrworldwide.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.interclick.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.interclick.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ru4.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adxpose.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.lucidmedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.linuxquestions.org [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.linuxquestions.org [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.www.linuxquestions.org [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.www.linuxquestions.org [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.www.linuxquestions.org [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.www.linuxquestions.org [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediaplex.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.linuxquestions.org [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kontera.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.legolas-media.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adserver.adtechus.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.pro-market.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.liveperson.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.liveperson.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.apmebf.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adinterax.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adinterax.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
kb.mediatemple.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kb.mediatemple.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kb.mediatemple.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kb.mediatemple.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
dc.tremormedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.microsoftwindows.112.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.e-2dj6wjkysod5ccp.stats.esomniture.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.googleadservices.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediasmarthome.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediasmarthome.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediasmarthome.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.www.burstnet.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediasmarthome.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediasmarthome.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediasmarthome.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediasmarthome.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.statcounter.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.burstnet.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.realmedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.burstbeacon.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.burstbeacon.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
in.getclicky.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insight.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insight.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insight.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insight.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insight.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insight.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insight.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificmedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.specificmedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ihg.db.advertising.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.yieldmanager.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.onetruemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.etrade.122.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ru4.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.eyewonder.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.eyewonder.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kontera.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kontera.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.legolas-media.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.legolas-media.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.lucidmedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.microsoftsto.112.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
adserving.versaneeds.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.clickbooth.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.s.clickability.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.s.clickability.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
hpi.rotator.hadj7.adjuggler.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
hpi.rotator.hadj7.adjuggler.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
jmp.clickbooth.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.rotator.hadj7.adjuggler.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
beacon.dmsinsights.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
beacon.dmsinsights.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.rotator.hadj7.adjuggler.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
hpi.rotator.hadj7.adjuggler.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tribalfusion.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.realmedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
network.realmedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
counter.hitslink.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.otherworldcomputing.122.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.247realmedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media.adfrontiers.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media.adfrontiers.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
trafficking.nabbr.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.at.atwola.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.eyewonder.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.eyewonder.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.paypal.112.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.stats.paypal.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fastclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fastclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediaplex.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.googleadservices.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
rotator.adjuggler.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
rotator.adjuggler.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
rotator.adjuggler.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
rotator.adjuggler.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.statcounter.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.marinetraffic.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.at.atwola.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.at.atwola.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.msnbc.112.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ar.atwola.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.liveperson.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.zedo.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.synacorqwest.112.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.casalemedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.synacor.112.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.msnportal.112.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.questionmarket.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.questionmarket.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
tradefx.advertserve.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.wwwforextradingonlinecom.122.2o7.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ads.pointroll.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.interclick.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.a1.interclick.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.insightexpressai.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediabrandsww.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adbrite.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
statse.webtrendslive.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
www.visitortracklog.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.content.yieldmanager.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.toplist.cz [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.trafficmp.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.liveperson.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.interclick.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.trafficmp.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.trafficmp.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.lucidmedia.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fastclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.fastclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.burstnet.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
server.iad.liveperson.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediaplex.com [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ia.media-imdb.com [ C:\Users\bugmann\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MA8YUZQ ]
macromedia.com [ C:\Users\bugmann\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MA8YUZQ ]
media.king5.com [ C:\Users\bugmann\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MA8YUZQ ]
media.theonion.com [ C:\Users\bugmann\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MA8YUZQ ]
s0.2mdn.net [ C:\Users\bugmann\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MA8YUZQ ]
secure-us.imrworldwide.com [ C:\Users\bugmann\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MA8YUZQ ]
www.naiadsystems.com [ C:\Users\bugmann\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MA8YUZQ ]
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\Low\winadmloc@ad.yieldmanager[2].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\Low\winadmloc@ad.wsod[2].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\Low\winadmloc@www.visitortracklog[2].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\Low\winadmloc@interclick[1].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\Low\winadmloc@fastclick[1].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\Low\winadmloc@doubleclick[2].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\Low\winadmloc@atdmt[1].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\Low\winadmloc@microsoftwindows.112.2o7[1].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\winadmloc@atdmt[1].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\winadmloc@microsoftsto.112.2o7[1].txt
C:\Users\winadmloc\AppData\Roaming\Microsoft\Windows\Cookies\winadmloc@www.visitortracklog[1].txt
.ad.yieldmanager.com [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.atdmt.com [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.atdmt.com [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.fastclick.net [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.fastclick.net [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.fastclick.net [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.interclick.com [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.interclick.com [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.interclick.com [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.microsoftwindows.112.2o7.net [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
.doubleclick.net [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]
statse.webtrendslive.com [ C:\Users\winadmloc\AppData\Roaming\Mozilla\Firefox\Profiles\hhb0gkiy.default\cookies.sqlite ]



Logs from SAS using the settings that Cryptodan recommended:

UPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/16/2011 at 02:23 PM

Application Version : 4.52.1000

Core Rules Database Version : 7065
Trace Rules Database Version: 4877

Scan type : Complete Scan
Total Scan Time : 01:03:02

Memory items scanned : 340
Memory threats detected : 0
Registry items scanned : 13918
Registry threats detected : 0
File items scanned : 245333
File threats detected : 1

Adware.Tracking Cookie
.doubleclick.net [ C:\Users\bugmann\AppData\Local\Google\Chrome\User Data\Default\Cookies ]


So it looks like the previous run actually cleared out the majority of collected items.


From the GMER log:

GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-16 14:39:27
Windows 6.1.7601 Service Pack 1
Running: gmer.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\1c659d03ae4d
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\5cac4cf8e6a1
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\5cac4cf9aa85
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\5cac4cfd991e
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\5cac4cfddbe0
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\70f1a15183c0
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38aa34fe
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38ac070f
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38cd46a0
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export ?????????????????????h???? ???????????c?*i??????????????????????5????????e??????vwifimp.ndi?27??????????????????????????????????????????Microsoft???????????????????????????????????????????????????????????????text??????N???????????D??????????????????????????"??????#???????????????????????? x??????6?????9-C????????????8????????g????.NTAMD64?????????????????!??????????????????????????????? ???????????????????????????#?????????????????????????7?????!??????????????????????????????? ???????????????????????????#?????????????????????????8?????!??????????????????????????????? ??????????????????????????????????????????????????????????E????????????????????????????????????????????????????????????????????????????????%??????????????????????????????HID_Keyboard_Inst???prepdrvr?n???????????????????x???3???h???? ??????????????????????????c??????T_???????????????????@???????e???????????????????????????????????????????h??? ???????????????????????????????????????????????????6?????????????????????????????????????????????????????
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\1c659d03ae4d (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\5cac4cf8e6a1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\5cac4cf9aa85 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\5cac4cfd991e (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\5cac4cfddbe0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\70f1a15183c0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38aa34fe (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38ac070f (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38cd46a0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Export ???k?s??{8ECC055D-047F-11D1-A537-0000F8753ED1}??????@%systemroot%\system32\drivers\RdpRefMp.sys,-101?}???k?k?k?k?k?k?k????X??????5???5???????f???@???e???w??????Volume???????t?t?s??????????????????????WinUsb??????? ???????j?????k?????k?,???????????????????P??????N??k???_????D6_{??? ???????k???????????j?,????????V???????????LegacyDriver?i???k??WUDFRd?????????k?&???????k???D??s????????????/???????/??LegacyDriver?????????k??????s????????1??{8ECC055D-047F-11D1-A537-0000F8753ED1}???????????k???????????g?j?k?k?k?k?k???????????????????4???????j???e???e?????????????????s?????????i???a???????l?l????? ???????j?????k?????k?,?????????????????????Y??????????????????????? ???????k???????????k?,????????b?????????????N??k????????D??????? ??f???4???e?????k?&??{8ECC055D-047F-11D1-A537-0000F8753ED1}???????j?j?k?j?k??????????????? ???????k???????e??????????????????????{8ECC055D-047F-11D1-A537-0000F8753ED1}??????? \??k???i?????ume???k??????????? r??n???0?????4?4???????~???k???????????????????k??{71a27cdd-812a-11d0-bec7-08002be209

---- EOF - GMER 1.0.15 ----


edit: sorry forgot the Malwarebytes' Anti-Malware logs. here now:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6592

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

5/16/2011 11:23:22 AM
mbam-log-2011-05-16 (11-23-22).txt

Scan type: Full scan (C:\|)
Objects scanned: 422346
Time elapsed: 29 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Edited by Damned Cortex, 16 May 2011 - 05:13 PM.


#6 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:07:02 AM

Posted 16 May 2011 - 05:30 PM

What were you doing at the time the BSOD's happened?


Also lets disable automatic restarts on errors by right clicking on My Computer > Properties > Advanced System Settings > Advanced > Startup and Recovery.

#7 Damned Cortex

Damned Cortex
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:12:02 AM

Posted 16 May 2011 - 05:45 PM

The BSOD's happened when i was using the Windows PC as an intermediary to copy .ISO files from a jump box to an internal server.


JUMP BOX (SAMBA) <---> Windows 7 PC <----> Internal Server (SAMBA)

using syntax similar to:

xcopy z:\imagefiles\image.iso x:\imagefiles\



I have set the DUMP settings under SYSTEM -> Advanced System Settings -> Advanced -> Startup and Recovery -> Settings -> System Failure, unchecked Automatically restart.

I am unable to attempt the repro and will attempt to do so later today/night or first thing in the AM.

Thank you again Cryptodan for your assistance.

#8 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:07:02 AM

Posted 16 May 2011 - 05:58 PM

I would set a log in for the windows 7 PC on the jumpbox and use Network Neighborhood to copy files.

#9 Damned Cortex

Damned Cortex
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:12:02 AM

Posted 17 May 2011 - 10:59 AM

The Server repository is a 3TB raided array and depending on the directory, can take 10 minutes to 1 hour to render using Windows Explorer. Using the CLI is usually much more efficient (at least until now).

I am unable to repro the behavior of the Blue Screens. I believe that is due to not transferring via the VPN and the VPN no longer loads because it cannot verify that the Anti-virus is running.

#10 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:07:02 AM

Posted 17 May 2011 - 11:06 AM

Try reinstalling the VPN Software.

#11 Damned Cortex

Damned Cortex
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:12:02 AM

Posted 17 May 2011 - 03:11 PM

Uninstalled the VPN Software, rebooted and re-installed.

Still not allowing it to load due to OS issue and I still get that funky Message Window when visiting http://quickscan.bitdefender.com/

Is there a utility I can use to watch interactions of Windows Programs and DLL's? In a Unix world there's Strace, ltrace, etc.

#12 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:07:02 AM

Posted 17 May 2011 - 03:38 PM

Whats the message on the window? When going to that site?

#13 Damned Cortex

Damned Cortex
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:12:02 AM

Posted 17 May 2011 - 05:29 PM

In Internet Explorer I received a box up window with the title "Message from webpage" with a yellow triangle with exclamation point in it with the words "Wasting my time!" and an OK button.

I'm trying to get a screen shot.

That message does not appear in Firefox or Chrome and I am able to run the plug in for both Chrome and Firefox but nothing is found.

#14 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:07:02 AM

Posted 17 May 2011 - 05:33 PM

I wonder if the VPN Software and IE is not compatible.

#15 Damned Cortex

Damned Cortex
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:12:02 AM

Posted 17 May 2011 - 05:40 PM

FirePass VPN is IE compatible. It was not Firefox compatible for quite a while (but is now) and does not work on Chrome.

In fact Firepass VPN was supposedly written for IE exclusively on Windows (there used to be IE for MAC but that is now defunct).

It also worked up until a week or so ago.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users