Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help With Pop-ups


  • Please log in to reply
29 replies to this topic

#1 8484

8484

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 21 January 2006 - 11:48 AM

I was Infected by Spy Sheriff and something 32. I followed 2 things that were posted that seemed to help someone else with the same problem. Now I have pop ups like crazy. I never had this problem before.
Can you please HELP!

P.S.

I've had a older version of hijackthis on my computer. I ran this first and I've ran it several time since. I'm saying this to say there's a chance I may have deleted something my system needs. However other than pop ups it works fine. Slower, but fine.

Logfile of HijackThis v1.99.1
Scan saved at 11:38:31 AM, on 1/21/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\System32\ctfmon.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\system32\rundll32.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINNT\System32\PSDrvCheck.exe -CheckReg
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O20 - Winlogon Notify: msctl32.dll - C:\WINNT\
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: Unimodem - C:\WINNT\system32\f0l0la3m1d.dll

BC AdBot (Login to Remove)

 


#2 Daisuke

Daisuke

    Cleaner on Duty


  • Members
  • 5,575 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Romania
  • Local time:05:34 PM

Posted 22 January 2006 - 06:33 AM

Hi :thumbsup:

Download System Security Suite here:
System Security Suite Download. Unzip it to your desktop. Install the program. Don't use it yet.


Download: ResetProtocolDefaults.reg
http://www.mvps.org/winhelp2002/ResetProtocolDefaults.reg

Locate "ResetProtocolDefaults.reg"
Right-click and select: Merge (Ok the prompt)


Run HijackThis!, press Scan, and put a checkmark next to all these:

O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O20 - Winlogon Notify: msctl32.dll - C:\WINNT\


Close all other windows and browsers, and press the Fix Checked button.


With all windows and browsers closed.
Clean out temporary and Temporary Internet Files.
A. Open System Security Suite.
B. In the Items to Clear tab thick:
- Internet Explorer (left pane): Cookies & Temporary files
- My Computer (right pane): Temporary files & Recycle Bin
Press the Clear Selected Items button.
Close the program.


You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so! This Fix must NOT be run in safe mode for it to work.

if you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."...then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.
Everyday is virus day. Do you know where your recovery CDs are ?
Did you create them yet ?

Posted Image

#3 8484

8484
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 23 January 2006 - 08:42 PM

I clicked on http://www.mvps.org/winhelp2002/ResetProtocolDefaults.reg and this is what came up. What do I do with this?

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]
@=""
"http"=dword:00000003
"https"=dword:00000003
"ftp"=dword:00000003
"file"=dword:00000003
"@ivt"=dword:00000001
"shell"=dword:00000000

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]
@=""
"http"=dword:00000003
"https"=dword:00000003
"ftp"=dword:00000003
"file"=dword:00000003
"@ivt"=dword:00000001
"shell"=dword:00000000

#4 Daisuke

Daisuke

    Cleaner on Duty


  • Members
  • 5,575 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Romania
  • Local time:05:34 PM

Posted 24 January 2006 - 12:45 AM

I clicked on

Right click and save as.
Everyday is virus day. Do you know where your recovery CDs are ?
Did you create them yet ?

Posted Image

#5 8484

8484
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 24 January 2006 - 09:26 PM

I followed up to this error

C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications

in l2mfix.exe.

When ran option 5 it took me to a site and when I click the version of XP i'm running, it prompted me to unzip some files that it said would fix the problem. But nothing happened. I tried to run option 1 again and got the same error. What now?

#6 Daisuke

Daisuke

    Cleaner on Duty


  • Members
  • 5,575 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Romania
  • Local time:05:34 PM

Posted 25 January 2006 - 04:33 PM

copy autoexec.nt from c:\windows\repair\ folder to c:\windows\system32\ folder.

Run again lm2fix.
Everyday is virus day. Do you know where your recovery CDs are ?
Did you create them yet ?

Posted Image

#7 8484

8484
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 25 January 2006 - 10:49 PM

I copied it into C:\windows\system32, but I still get that error message. When I orginally downloaded the files I clicked open with and my system tried to open it with acrobat reader. Now every time I download it it automatically tries to open with that. Which it can't.

#8 Daisuke

Daisuke

    Cleaner on Duty


  • Members
  • 5,575 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Romania
  • Local time:05:34 PM

Posted 26 January 2006 - 02:32 AM

Download WebRoot SpySweeper from HERE (It's a 2 week trial):
  • Click the Download the trial link under "Try Spy Sweeper for Free" to download the program. NOTE: DO NOT click any Free Spyware Scan link and let me know if you can't find the free trial.
  • Install it.
  • Once the program is installed, it will open.
  • It will prompt you to update to the latest definitions, click Yes.
  • Once the definitions are installed, click Sweep Now on the left side.
  • Click the Start button.
  • When it's done scanning, click the Next button.
  • Make sure everything has a check next to it, then click the Next button.
  • It will remove all of the items found.
  • Click Session Log in the upper right corner, copy everything in that window.
  • Click the Summary tab and click Finish.
  • Paste the contents of the session log you copied into your next reply.
Then reboot your computer - IMPORTANT
Then post a new HJT log
Everyday is virus day. Do you know where your recovery CDs are ?
Did you create them yet ?

Posted Image

#9 8484

8484
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 26 January 2006 - 09:46 PM

here's the session log. I'll post the HJT log after I reboot

*******
8:57 PM: | Start of Session, Thursday, January 26, 2006 |
8:57 PM: Spy Sweeper started
8:57 PM: Sweep initiated using definitions version 606
8:57 PM: Starting Memory Sweep
8:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
8:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
8:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
8:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
8:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
8:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
8:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
8:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
8:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
8:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
8:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
8:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
9:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
9:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
9:02 PM: Memory Sweep Complete, Elapsed Time: 00:04:46
9:02 PM: Starting Registry Sweep
9:02 PM: Found Adware: blazefind
9:02 PM: HKLM\software\microsoft\windows\currentversion\uninstall\windows sr 2.0\ (4 subtraces) (ID = 104552)
9:02 PM: Found Adware: cws_pnpsvc
9:02 PM: HKLM\system\currentcontrolset\services\eventlog\application\pnpsvc\ (2 subtraces) (ID = 123428)
9:02 PM: HKLM\system\currentcontrolset\services\pnpsvc\ (13 subtraces) (ID = 123429)
9:02 PM: Found Adware: esyndicate bho
9:02 PM: HKCR\interface\{941e3071-658d-4f7a-8848-a39e9a43aa97}\ (8 subtraces) (ID = 125838)
9:02 PM: HKLM\software\classes\interface\{941e3071-658d-4f7a-8848-a39e9a43aa97}\ (8 subtraces) (ID = 125842)
9:02 PM: HKLM\software\classes\typelib\{b526170e-491f-4e29-8bfb-c6157d02fefd}\ (9 subtraces) (ID = 125843)
9:02 PM: HKLM\software\microsoft\windows\currentversion\uninstall\esyndicate\ (4 subtraces) (ID = 125847)
9:02 PM: HKCR\typelib\{b526170e-491f-4e29-8bfb-c6157d02fefd}\ (9 subtraces) (ID = 125848)
9:02 PM: Found Adware: gain - common components
9:02 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\winnt\downloaded program files\hdplugin1019.dll (ID = 126794)
9:02 PM: Found Adware: ieplugin
9:02 PM: HKCR\interface\{3e589169-86ad-44fe-b426-f0bf105d5582}\ (8 subtraces) (ID = 128148)
9:02 PM: HKLM\software\classes\interface\{3e589169-86ad-44fe-b426-f0bf105d5582}\ (8 subtraces) (ID = 128167)
9:02 PM: HKLM\software\classes\typelib\{57add57b-173e-418a-8f70-17e5c9f2bcc9}\ (9 subtraces) (ID = 128169)
9:02 PM: HKCR\typelib\{57add57b-173e-418a-8f70-17e5c9f2bcc9}\ (9 subtraces) (ID = 128201)
9:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
9:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
9:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
9:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
9:02 PM: Found Adware: navexcel navhelper
9:02 PM: HKCR\appid\nhelper.dll\ (1 subtraces) (ID = 135511)
9:02 PM: HKLM\software\classes\appid\nhelper.dll\ (1 subtraces) (ID = 135525)
9:02 PM: Found Adware: bho_sep
9:02 PM: HKCR\clsid\{c30793af-14b2-4300-8b5d-4bfa3987050e}\ (11 subtraces) (ID = 141623)
9:02 PM: HKLM\software\classes\clsid\{c30793af-14b2-4300-8b5d-4bfa3987050e}\ (11 subtraces) (ID = 141631)
9:02 PM: Found Adware: wildmedia
9:02 PM: HKLM\software\microsoft\windows\currentversion\uninstall\middadle\ (4 subtraces) (ID = 146958)
9:02 PM: HKLM\software\microsoft\windows\currentversion\uninstall\wbcm\ (4 subtraces) (ID = 146959)
9:02 PM: Found Adware: winad
9:02 PM: HKLM\software\microsoft\windows\currentversion\uninstall\windows adcontrol\ (2 subtraces) (ID = 147233)
9:02 PM: HKLM\software\windows adcontrol\ (5 subtraces) (ID = 147238)
9:02 PM: Found Adware: command
9:02 PM: HKLM\system\currentcontrolset\enum\root\legacy_cmdservice\0000\ (6 subtraces) (ID = 1016064)
9:02 PM: HKLM\system\currentcontrolset\enum\root\legacy_cmdservice\ (8 subtraces) (ID = 1016072)
9:02 PM: Found Trojan Horse: trojan-downloader-hochladen
9:02 PM: HKLM\system\currentcontrolset\services\i386p\ (12 subtraces) (ID = 1021419)
9:02 PM: Found Adware: zquest
9:02 PM: HKCR\clsid\{c5af2622-8c75-4dfb-9693-23ab7686a456}\ (4 subtraces) (ID = 1057025)
9:02 PM: HKLM\software\classes\clsid\{c5af2622-8c75-4dfb-9693-23ab7686a456}\ (4 subtraces) (ID = 1057030)
9:02 PM: Found Trojan Horse: trojan-downloader-dh
9:02 PM: HKLM\software\microsoft\windows\currentversion\uninstall\dh\ (2 subtraces) (ID = 1057035)
9:02 PM: Found Adware: browseraid
9:02 PM: HKU\S-1-5-21-682003330-1078145449-1060284298-1000\software\a70f6a1d-0195-42a2-934c-d8ac0f7c08eb\ (1 subtraces) (ID = 105078)
9:02 PM: Found Adware: cws-aboutblank
9:02 PM: HKU\S-1-5-21-682003330-1078145449-1060284298-1000\software\microsoft\internet explorer\main\ || search bar_bak (ID = 115924)
9:02 PM: HKU\S-1-5-21-682003330-1078145449-1060284298-1000\software\microsoft\internet explorer\main\ || search page_bak (ID = 115925)
9:02 PM: HKU\S-1-5-21-682003330-1078145449-1060284298-1000\software\esyn\ (7 subtraces) (ID = 125844)
9:02 PM: Found Adware: drsnsrch.com hijack
9:02 PM: HKU\S-1-5-21-682003330-1078145449-1060284298-1000\software\microsoft\search assistant\ || defaultsearchurl (ID = 128205)
9:02 PM: HKU\S-1-5-21-682003330-1078145449-1060284298-1000\software\sep\ (9 subtraces) (ID = 141642)
9:02 PM: Found Adware: sidesearch
9:02 PM: HKU\S-1-5-21-682003330-1078145449-1060284298-1000\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423)
9:02 PM: HKU\S-1-5-21-682003330-1078145449-1060284298-1000\software\microsoft\internet explorer\main\ || search page_bak (ID = 774883)
9:02 PM: Found Adware: mindset interactive - favoriteman
9:02 PM: HKU\S-1-5-21-682003330-1078145449-1060284298-1000\software\microsoft\windows\ || server (ID = 1025299)
9:02 PM: Found Adware: aflashcounter hijack
9:02 PM: HKU\S-1-5-20\software\microsoft\internet explorer\ || searchurl (ID = 103328)
9:02 PM: HKU\S-1-5-20\software\microsoft\internet explorer\main\ || search bar (ID = 103330)
9:02 PM: HKU\S-1-5-20\software\microsoft\internet explorer\search\ || searchassistant (ID = 103332)
9:02 PM: HKU\S-1-5-20\software\microsoft\internet explorer\searchurl\ || searchurl (ID = 103333)
9:02 PM: HKU\S-1-5-19\software\microsoft\internet explorer\ || searchurl (ID = 103328)
9:02 PM: HKU\S-1-5-19\software\microsoft\internet explorer\main\ || search bar (ID = 103330)
9:02 PM: HKU\S-1-5-19\software\microsoft\internet explorer\search\ || searchassistant (ID = 103332)
9:02 PM: HKU\S-1-5-19\software\microsoft\internet explorer\searchurl\ || searchurl (ID = 103333)
9:02 PM: HKU\S-1-5-18\software\microsoft\internet explorer\ || searchurl (ID = 103328)
9:02 PM: HKU\S-1-5-18\software\microsoft\internet explorer\main\ || search bar (ID = 103330)
9:02 PM: HKU\S-1-5-18\software\microsoft\internet explorer\search\ || searchassistant (ID = 103332)
9:02 PM: HKU\S-1-5-18\software\microsoft\internet explorer\searchurl\ || searchurl (ID = 103333)
9:02 PM: HKU\S-1-5-18\software\microsoft\internet explorer\extensions\cmdmapping\ || {000007c6-17df-4438-92a4-de5537471ba3} (ID = 530423)
9:02 PM: Registry Sweep Complete, Elapsed Time:00:00:30
9:02 PM: Starting Cookie Sweep
9:02 PM: Found Spy Cookie: zedo cookie
9:02 PM: hamm@zedo[1].txt (ID = 3762)
9:02 PM: Found Spy Cookie: trafficmp cookie

#10 8484

8484
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 27 January 2006 - 07:06 AM

Here's the HJT log. My computer seems to be working better than it has is a while. Thanks you all your help!!!! What happens in 14 days when trail ends? Are certain steps I need to follow? In past I've used trail versions and when the trail ended an I didn't buy the full version I started having problem again. Should I buy it? Thank again for your help It's been greatly appreciated.

ogfile of HijackThis v1.99.1
Scan saved at 6:55:23 AM, on 1/27/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINNT\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINNT\System32\ctfmon.exe
C:\WINNT\System32\wuauclt.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINNT\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O20 - Winlogon Notify: Dynamic Directory - C:\WINNT\system32\c8000idme80a0.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

#11 Daisuke

Daisuke

    Cleaner on Duty


  • Members
  • 5,575 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Romania
  • Local time:05:34 PM

Posted 28 January 2006 - 08:02 AM

Should I buy it?

Not yet. I'm not sure it could terminate Look2Me adware.

I'll be back.
Everyday is virus day. Do you know where your recovery CDs are ?
Did you create them yet ?

Posted Image

#12 Daisuke

Daisuke

    Cleaner on Duty


  • Members
  • 5,575 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Romania
  • Local time:05:34 PM

Posted 28 January 2006 - 03:05 PM

Make sure WebRoot SpySweeper signatures are up-to-date.

Scan again and fix all items found. Read carefuly my instructions and follow them exactly.

* Click the Start button.
* When it's done scanning, click the Next button.
* Make sure everything has a check next to it, then click the Next button.
* It will remove all of the items found.
* Click Session Log in the upper right corner, copy everything in that window.
* Click the Summary tab and click Finish.
* Paste the contents of the session log you copied into your next reply.

Then reboot your computer - IMPORTANT
Then post a new HJT log.
Everyday is virus day. Do you know where your recovery CDs are ?
Did you create them yet ?

Posted Image

#13 8484

8484
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 28 January 2006 - 07:34 PM

********
6:51 PM: | Start of Session, Saturday, January 28, 2006 |
6:51 PM: Spy Sweeper started
6:51 PM: Sweep initiated using definitions version 606
6:51 PM: Starting Memory Sweep
6:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:52 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:52 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:53 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:53 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:54 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:54 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:55 PM: Memory Sweep Complete, Elapsed Time: 00:03:13
6:55 PM: Starting Registry Sweep
6:55 PM: Registry Sweep Complete, Elapsed Time:00:00:29
6:55 PM: Starting Cookie Sweep
6:55 PM: Found Spy Cookie: atlas dmt cookie
6:55 PM: hamm@atdmt[2].txt (ID = 2253)
6:55 PM: Found Spy Cookie: pointroll cookie
6:55 PM: hamm@ads.pointroll[2].txt (ID = 3148)
6:55 PM: Found Spy Cookie: questionmarket cookie
6:55 PM: hamm@questionmarket[1].txt (ID = 3217)
6:55 PM: Found Spy Cookie: advertising cookie
6:55 PM: hamm@advertising[2].txt (ID = 2175)
6:55 PM: Found Spy Cookie: overture cookie
6:55 PM: hamm@overture[1].txt (ID = 3105)
6:55 PM: Found Spy Cookie: coremetrics cookie
6:55 PM: hamm@data.coremetrics[1].txt (ID = 2472)
6:55 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01
6:55 PM: Starting File Sweep
6:55 PM: Warning: Failed to open file "c:\pagefile.sys". Access is denied
6:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:55 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:55 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:55 PM: Warning: Failed to open file "c:\hiberfil.sys". Access is denied
6:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:56 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:56 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:57 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:57 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:58 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:58 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:59 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
6:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
6:59 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:01 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:01 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:02 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:02 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:03 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:03 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:04 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:04 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:05 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:05 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:06 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:06 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:06 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:06 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:06 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:06 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:06 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:06 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:07 PM: Warning: Failed to open file "c:\winnt\system32\wcninet.dll". The process cannot access the file because it is being used by another process
7:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:07 PM: Warning: Failed to open file "c:\winnt\system32\f40o0ed3eh0.dll". The process cannot access the file because it is being used by another process
7:07 PM: Warning: Failed to open file "c:\winnt\system32\lvn4095qe.dll". The process cannot access the file because it is being used by another process
7:07 PM: Found Adware: look2me
7:07 PM: guard.tmp (ID = 159)
7:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:07 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:07 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:08 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:08 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:08 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:08 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\system.log". The process cannot access the file because it is being used by another process
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\software.log". The process cannot access the file because it is being used by another process
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\default.log". The process cannot access the file because it is being used by another process
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\security.log". The process cannot access the file because it is being used by another process
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\sam.log". The process cannot access the file because it is being used by another process
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\default". The process cannot access the file because it is being used by another process
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\security". The process cannot access the file because it is being used by another process
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\software". The process cannot access the file because it is being used by another process
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\system". The process cannot access the file because it is being used by another process
7:08 PM: Warning: Failed to open file "c:\winnt\system32\config\sam". The process cannot access the file because it is being used by another process
7:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:09 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:09 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:10 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:10 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:11 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:11 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:12 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:12 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:12 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:13 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:13 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:14 PM: Warning: Failed to open file "c:\winnt\softwaredistribution\eventcache\{38d63b81-a7bb-43e8-b205-593bdaac51b4}.bin". The process cannot access the file because it is being used by another process
7:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:14 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:14 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:15 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:15 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:16 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:16 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:16 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:16 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:17 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:17 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:18 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:18 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:18 PM: Warning: Failed to open file "c:\documents and settings\hamm\ntuser.dat.log". The process cannot access the file because it is being used by another process
7:18 PM: Warning: Failed to open file "c:\documents and settings\hamm\ntuser.dat". The process cannot access the file because it is being used by another process
7:19 PM: Warning: Failed to open file "c:\documents and settings\hamm\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
7:19 PM: Warning: Failed to open file "c:\documents and settings\hamm\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
7:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:19 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:19 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:20 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat.log". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat.log". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7422d424-a80b-4ab8-9ea1-f228f5d08598.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfca906de-19a6-477a-888f-a04e30e460a2.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscb974e1d-af0f-436b-bbaf-d0459c36d4e8.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfdab9d4c-ba81-49af-b221-843a6b17003d.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs85a7a139-fe92-42b3-b55f-b29c962e3fe5.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4e1d9017-c800-4d8b-b885-edffe6d2f8f6.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb21afa35-1c7f-4576-92f2-397bde16e3ac.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1bf14e48-d9f1-498c-9508-2f8be9c6cc52.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1aece6a8-f2cb-4534-9dca-e5fd8d62689f.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs2163474c-cead-42d9-afa1-7429ba99d59c.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs2bde6834-d08a-4809-8f39-e7b70d5d65d7.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd7cb73d2-cf8b-4df8-811b-81499fdcf046.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8c1b2b26-717e-4c8b-9e4f-de55125bae3a.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc295b1a6-e24d-4a82-a237-8c2048b5d7df.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs01345940-3e97-45a0-9105-c1019485832f.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0909ca89-e0ae-4a2c-81cd-313d323050f3.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse1f18b88-9950-4180-a246-f160c441c6d2.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5576ff7a-0c2b-46d8-b284-3beda59be307.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse4169a6a-1526-4e4a-9d70-b7399c71e15d.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs257a9892-f540-40cc-8391-f3dfb89b14be.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs30f37066-1ca5-4e08-8961-fc8d904c0cc0.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs822c8844-2cd0-43f9-b647-96cd6db84872.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs11309538-8afc-42ba-874a-7d0ef2cf37f9.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3a70a2f1-2097-4f11-9d23-72634b0c44e1.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8dce6e5e-f6a3-4787-944b-7429cc9000be.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsfb42eeb2-09f0-476c-b05c-729e29c0833b.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscde43b77-2894-48c9-a7d6-1ff2310ddbd5.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs59b21d92-8930-4fee-95d7-e3a479891545.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3652493c-71b5-42df-af2f-38b771efc544.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs888ca19d-08e9-4902-b02a-c75795a1a2fe.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs75002b1b-8e5f-4d22-901e-d58fb0e4d893.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa5dea28a-83c1-4b44-9f01-bc8c04f941b6.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd4b3f1ab-3bdd-4473-828d-6320e6e4a0f6.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs91b98146-1266-45f1-b5f9-1c3e69c50c65.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsdf903a8f-5124-4600-bf5a-4877440b3be7.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse35f6179-190e-4e26-b985-3cf2343c729e.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsafa49178-ccfe-41da-97d5-82684c925436.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs186460cd-b4b0-4b87-9cdb-53a0ccd77726.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6ad0484d-7d96-47a7-a640-05351f059f8d.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs2eafe377-df6f-4ceb-b5b9-9fc341e252ea.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5f9f09ba-43a1-4d7d-a8fc-0581a0778169.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs13748846-16d8-48ea-bd25-86af64726819.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5c3eeb3d-d00f-49ac-b6cc-f3cb8e59ec35.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0cecb948-9f82-4021-a9df-50973a5ae345.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs235f4217-93f5-4305-b9e2-fbb7672deb5c.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsdea87c7e-1499-467e-a334-d4faa0b2ac5f.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc05efa68-bdec-4a08-8971-b5ad82bc9a9b.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs230b24b2-16d6-4fef-a580-d9977ef2ff28.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb26ae76e-2fb3-4d97-952f-9c5245fa921c.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa68979db-e6e2-4dff-bac5-eca5425b7ee5.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs055e48d4-6e31-40a6-a52e-953e9ddddd4e.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb7364a67-5a42-4fa9-a724-4aa9997b2cd9.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa1b20152-5c3d-46db-a8c9-f4af9eaee0af.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs4ae60674-0970-4b60-9e1c-389c80ac7152.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs10551d1b-a81c-4128-a289-297a4b728983.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs7d3ccaad-090a-48fd-8a57-b3a208f8141a.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc00fd92b-86e1-4fc4-b809-9658fd10788a.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5de4c59a-7f2a-45e9-bb4a-e965119323ec.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs10ee9ded-936d-4e06-bfe9-fd34fe2926b7.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5b03f34f-ca84-45d4-a67f-d19ddb49d043.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3466198b-8cc5-4d28-9ab5-4245ced88641.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0599bcb7-c4de-4df9-8270-e86d4ff27d4d.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1c294753-43d2-492d-be61-e15037e92955.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs532b3dcf-4825-4a8c-8985-6c6d3753989b.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs30f8cd03-79e0-45d6-a03d-d05a0bb0fc98.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa12c7442-fb06-4310-a449-45beb52e2554.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd620e3d4-7874-471a-bf4c-44a47a49df35.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs54ba1e84-c4c9-4b21-8190-77570884b9f3.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3c2236da-d49b-4dec-871c-c558d17cb4fb.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1a5f2253-e917-4835-af2e-8b3c89d4c4bd.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf0ac6d74-a734-44e0-8b5b-e48666950765.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3d0c2300-b0b2-46fa-87e1-d0e74a38556c.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs534f851c-c4aa-4af1-96ad-7149b3e69dc8.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5028c091-b61c-4eae-943e-5385deada76c.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs683b86c7-1b6d-4d58-beeb-793e49925a05.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs28f178a3-1081-403d-a0ec-54f57741d9a1.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsd875cc41-0930-4eea-b614-3453734c6d22.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsa4f66ad7-a27b-469e-a49e-7213ee18be47.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs63f408f1-70f5-4ebf-af13-41f2eedbed5f.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs75166aa3-ae55-45b6-8359-9bde614c12c0.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs38935bf3-c59f-4bbe-9da0-d69f53d69585.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs3a7206de-a519-4503-bcc8-eb1b3d1a9e81.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc51e0620-a2ea-4a48-8c38-6c921f7a4ea9.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsad8c7434-fad5-41e6-b981-30c4a13006c0.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse700a969-884c-4750-af96-cc65dd8ea03b.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs0818c648-f696-40a9-804c-2eae4c23f3a7.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscdcfe16c-e008-4626-a606-961ddd054da0.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs23c82710-fb3b-4ce9-8ac8-1d7c7870bec6.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsb57863ad-a422-4fd0-9dc8-01bb96e3e3bf.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs49b7bf8d-0625-4510-bac2-56beeac5bdf5.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsc595739f-ba6a-4cf9-9bb4-2598af562f94.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5555dab3-d7e6-4b48-a979-4ae96db4c6dc.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs022ef149-a87a-4860-91fc-773bd262e1d3.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5c0a0115-d655-4f21-b2b1-d84670d7ba27.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscscd64dea6-7501-4781-8b27-f8deb7bcb493.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsdda49e80-e024-4286-9119-085d8205af74.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs1531c902-3c67-47a3-adfc-65edac1b1f88.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscsf9ad133c-4d56-49e5-83cc-69c160ca77ff.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs54d22114-13f5-4d6d-a5fd-24fd36be9314.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs6018e38f-71f8-431e-a858-66fdd1cb3c22.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs8530805b-b617-4725-8b9d-20c696cf31b0.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscse80f10b5-6729-4b35-a395-3de52c7bdce8.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs62a3979a-b02c-4150-80f5-b58a3156d9e8.tmp". The process cannot access the file because it is being used by another process
7:20 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\temp\sscs5ef9990f-960d-4d79-aece-e4418818fe68.tmp". The process cannot access the file because it is being used by another process
7:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:20 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:20 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:21 PM: File Sweep Complete, Elapsed Time: 00:26:06
7:21 PM: Full Sweep has completed. Elapsed time 00:30:05
7:21 PM: Traces Found: 7
7:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:21 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:21 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:22 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:22 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:22 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:22 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:23 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:23 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:24 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:24 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:25 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:25 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:26 PM: Removal process initiated
7:27 PM: Quarantining All Traces: look2me
7:27 PM: look2me is in use. It will be removed on reboot.
7:27 PM: guard.tmp is in use. It will be removed on reboot.
7:27 PM: Quarantining All Traces: advertising cookie
7:27 PM: Quarantining All Traces: atlas dmt cookie
7:27 PM: Quarantining All Traces: coremetrics cookie
7:27 PM: Quarantining All Traces: overture cookie
7:27 PM: Quarantining All Traces: pointroll cookie
7:27 PM: Quarantining All Traces: questionmarket cookie
7:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:27 PM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
7:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:27 PM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
7:27 PM: Removal process completed. Elapsed time 00:00:51
********
3:48 AM: | Start of Session, Saturday, January 28, 2006 |
3:48 AM: Spy Sweeper started
3:48 AM: Sweep initiated using definitions version 606
3:49 AM: Starting File Sweep
3:49 AM: File Sweep Complete, Elapsed Time: 00:00:08
3:49 AM: Explorer Sweep has completed. Elapsed time 00:00:10
3:49 AM: Traces Found: 0
3:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:49 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:49 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:51 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:51 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:51 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:51 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:52 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:52 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:52 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:52 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:54 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:54 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:54 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:54 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:55 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:55 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:55 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:55 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:56 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:56 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:57 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:57 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:57 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:57 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:57 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:57 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:57 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:57 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:58 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:58 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:59 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:59 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:59 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:59 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:59 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:59 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
3:59 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
3:59 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:01 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:01 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:01 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:01 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:01 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:01 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:01 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:01 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:02 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:02 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:03 AM: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
4:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:03 AM: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
4:04 AM: The Spy Communica

#14 8484

8484
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:05:34 PM

Posted 28 January 2006 - 08:00 PM

Logfile of HijackThis v1.99.1
Scan saved at 7:58:11 PM, on 1/28/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINNT\System32\ctfmon.exe
C:\WINNT\System32\wuauclt.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: StillImage - C:\WINNT\system32\f40o0ed3eh0.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

#15 Daisuke

Daisuke

    Cleaner on Duty


  • Members
  • 5,575 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Romania
  • Local time:05:34 PM

Posted 28 January 2006 - 08:06 PM

Hi

It doesn't look good. Spyweeper cannot remove the malware and you cannot use the l2mfix tool.

It could be a new l2me verision (?!).
Everyday is virus day. Do you know where your recovery CDs are ?
Did you create them yet ?

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users