Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hijacking, Popups, And Desktop Shortcut Creations


  • This topic is locked This topic is locked
19 replies to this topic

#1 Cani

Cani

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:47 PM

Posted 27 May 2006 - 08:53 AM

Hello forum,

I am seeking help! Let me give some background.... I have a 5 year old computer, and its survived through my college years. Yes, taht's right... survived. THroguh this time many different people have been on my computer downloading all sorts of things, and visiting all sorts of sites. I didn't midn, because my computer always worked, and never really got popups.... until now!

When I got back to my CPU and logged onto aim, I noticed my aim started going crazy and sending out soem weird messages with links.... so I uninstalled aim, and got the new version and that stopped. Then I began to get some popups. Okay.... so this was a little annoying. However, through the course of 7-10 days the popups became overwhelming and my computer running extremely slow. I was pissed, and concerned about being able to retrieve my documents (that I, the cpu slacker didn't backup). So I was like wtf, and searched teh web, and found some info saying goto msconfig and on the startup turn a bunch of things off... cause alot of that crap is probably malware or unnecessary. So that worked decently to get my cpu kind of stable.

SO when I connect to the internet... it was mainly IE popups. I was like greaaat... Maybe if I uninstall IE I'll be bugged but it won't popup.... WRONG. Id idn't try to uninstall and reinstall, but soon thereafter I began to get these annoying Firefox popups. This is when I became friggin pissed, and hateful of the creator of such malware programs. Ok ok, so I got some popups... I can just right click and close.... ya they're annoying. UNTIL.... I would browse the web (trying my best to close/ignore popups) and BAM.... now all of sudden my browser is being hijacked and taking me to advertisements. I end up closing my main browser unaware of this fact. Previously I didn't know wtf a HOMEPAGE HIJACKER was... until this rude awakening.

I searched teh web on SURFSIDEKICK3 and found a page from bleepingcomputer.com forums. I attempted to remove it with the add/remove programs. I was able to kind of do it. I also deleted some associated files (the article suggested 4 files, but I only found 2 : sskknwrd.dll and ssk.exe)

Now I am here, seeking help. I've run Ad-aware SE many times(v 1.06), and removed as much as crap as possible. Even though I remove a ton, it all comes back, no matter how many times I reboot and rescan and rescan and rescan. This is a list of what I cannot remove with Ad-aware:

I click fix, but these keep showing up after scanning:
-Adware.look2me (1ojb)
-Virtualbouncer (6obj)
-AbetterInternet.Nail (1obj)
-Windows (dunno, just said "windows")
-Adware.DollareRevenue (3obj)
-Adware Yazzle (1obj)
-IEHijacker.Zestyfind (1obj)

I click fix, but these cannot be removed because they'r ebeing used and maybe can after a reboot:
-C:windows\system32\n64s0gh7e64



So then, I tried Spybot Search and Destroy. I was able to remove a ton of crap, but there are numerous remaining issues. These will keep appearing, now matter how many times I fix after scanning:

Everything on this list gets "fixed" but reshows up after another scan. Except for 2 which won't get "fixed" at all and thus keep showing up on subsequent scans:
-Network Monitor
-Minibug (won't get fixed when I click fix)
-Rotue
-Command Service (won't get fixed when I click fix)
-Smitfraud-C
-SurfSideKick
-Wild Tangents
-Windows Security Center UpdateDisableNotify
-Windows Security Center AntivirusDisableNotify
-Windows Security Center Antivirusoverride
-Windows Security Center FirewallDisableNotify
-Windows Security Center SP2Update


I got the HiJackThis software, adn installed it. I am not sure how to use it... that is why I have come here for advice. Here is a "log" of my HJT.

Logfile of HijackThis v1.99.1
Scan saved at 6:48:18 AM, on 5/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\TWFqaWQ\command.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Jgnrzia\Wbot.exe
C:\WINDOWS\sys010242833692.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\DIGStream\digstream.exe
C:\windows\system32\rlvknlg.exe
C:\defender23.exe
C:\Program Files\Common Files\svchostsys\svchostsys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Earthlink DSL\TaskPanl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wmiapsrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Earthlink DSL\FastLane\IPClient.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie...ton/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie...ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.askmen.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcclub.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\aoiqp.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,ljoubkh.exe
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\Earthlink DSL\PnEL.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [w004c3ba.dll] RUNDLL32.EXE w004c3ba.dll,I2 000e7b320004c3ba
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Trmuwfd] C:\Program Files\Jgnrzia\Wbot.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe
O4 - HKLM\..\Run: [sys010242833692] C:\WINDOWS\sys010242833692.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [{81-1C-CE-E9-ZN}] c:\windows\system32\dwdsregt.exe GID003
O4 - HKLM\..\Run: [w002818a.dll] RUNDLL32.EXE w002818a.dll,I2 000e7b320002818a
O4 - HKLM\..\Run: [RelevantKnowledge] c:\windows\system32\rlvknlg.exe -boot
O4 - HKLM\..\Run: [w039773e.dll] RUNDLL32.EXE w039773e.dll,I2 000e7b320039773e
O4 - HKLM\..\Run: [newname] C:\\newname23.exe
O4 - HKLM\..\Run: [defender] C:\\defender23.exe
O4 - HKLM\..\Run: [keyboard] C:\\keyboard23.exe
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\Earthlink DSL\TaskPanl.exe" -winstart
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.pcclub.com
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305...meInstaller.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F13B39B-6C50-41A8-A60C-1EC62A3F58AC}: NameServer = 207.69.188.186 207.69.188.185
O17 - HKLM\System\CCS\Services\Tcpip\..\{C16B5623-1F45-40BA-ADD6-97F30A7C5295}: NameServer = 207.69.188.185,207.69.188.186
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\j00s0ad7ed0.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWFqaWQ\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Microsoft WMI Performance Adapter AddOn (WMIPerAddOn) - Unknown owner - C:\WINDOWS\wmiapsrv.exe






I'm dyinggggg. I have no TV, only internet... and I can'te even use the internet because of this darn malware. HELPPPP. THanks sooo much in advance. I'm so frustrated. I"m willing to try anything before I send myself to the poor house buying a new CPU. THX!!


-Cani P

BC AdBot (Login to Remove)

 


#2 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:47 AM

Posted 27 May 2006 - 09:49 AM

Welcome aboard.. :thumbsup:

You have pretty badly infected PC. We'll need to do this in few steps. Please follow this topic and reply in timely manners.

Lets get started.

==

Please download Look2Me-Destroyer to your desktop.
  • Double-click Look2Me-Destroyer.exe to run it.
  • Put a check next to Run this program as a task.
  • You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 1 minute. Click OK
  • When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
  • Once it's done scanning, click the Remove L2M button.
  • You will receive a Done Scanning message, click OK.
  • When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
  • Your computer will then shutdown.
  • Turn your computer back on.
  • Please post the contents of C:\Look2Me-Destroyer.txt in your next reply.
If Look2Me-Destroyer does not reopen automatically, reboot and try again.

==

You will also need Anti-virus software. There's free programs available.

Please get the free version of AVG.

Download & install it, configure it how you wish, update it. Next, run a scan with it (set it to scan everything it can). Remove/quarantine EVERYTHING found. Reboot again.

==

Post back with the contents of C:\Look2Me-Destroyer.txt along with a fresh HijackThis log. :flowers:
Hi there, stranger!

#3 Cani

Cani
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:47 PM

Posted 27 May 2006 - 11:31 AM

Okay,

I've got AVG, scanned and deleted like 55 items, (90 infected files). I also ran the L2M destroyer.

This is my L2M-destroyer txt:


Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 5/27/2006 9:18:07 AM

Infected! C:\WINDOWS\system32\enjol1131.dll

Attempting to delete infected files...

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DateTime

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{13E33D24-B856-4E39-BED3-2FB173D526FE}"
HKCR\Clsid\{13E33D24-B856-4E39-BED3-2FB173D526FE}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5C8224F2-0040-427B-8A07-802B3369F349}"
HKCR\Clsid\{5C8224F2-0040-427B-8A07-802B3369F349}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{8F5C3DAA-DE09-49B8-AC75-155ADBBBA841}"
HKCR\Clsid\{8F5C3DAA-DE09-49B8-AC75-155ADBBBA841}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{02A13D22-A759-4A39-8798-685D276E5535}"
HKCR\Clsid\{02A13D22-A759-4A39-8798-685D276E5535}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{89EA4DE3-80B1-4DAE-A7D3-F77248D91080}"
HKCR\Clsid\{89EA4DE3-80B1-4DAE-A7D3-F77248D91080}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{6E4B1B97-D8A2-4C73-824D-499A21783D24}"
HKCR\Clsid\{6E4B1B97-D8A2-4C73-824D-499A21783D24}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded










This is my HJT log:


Logfile of HijackThis v1.99.1
Scan saved at 9:23:49 AM, on 5/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\sys010242833692.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\DIGStream\digstream.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\windows\system32\rlvknlg.exe
C:\defender23.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\svchostsys\svchostsys.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Earthlink DSL\TaskPanl.exe
C:\WINDOWS\TWFqaWQ\command.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\iPod\bin\iPodService.exe




Thanks so much for your assistance. I appreciate it.

#4 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:47 AM

Posted 27 May 2006 - 11:44 AM

Hi, your HijackThis log got cut off. Could you post it completely, please :thumbsup:

Also, go ahead and delete Look2Me-Destroyer.
Hi there, stranger!

#5 Cani

Cani
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:47 PM

Posted 27 May 2006 - 12:45 PM

Repost of HJT log:


Logfile of HijackThis v1.99.1
Scan saved at 10:42:40 AM, on 5/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\sys010242833692.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\DIGStream\digstream.exe
C:\windows\system32\rlvknlg.exe
C:\defender23.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\svchostsys\svchostsys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Earthlink DSL\TaskPanl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Earthlink DSL\FastLane\IPClient.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie...ton/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie...ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.askmen.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcclub.com
R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,ljoubkh.exe
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\Earthlink DSL\PnEL.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [jvuepd] C:\WINDOWS\system32\jeqmqf.exe reg_run
O4 - HKLM\..\Run: [w004c3ba.dll] RUNDLL32.EXE w004c3ba.dll,I2 000e7b320004c3ba
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe
O4 - HKLM\..\Run: [sys010242833692] C:\WINDOWS\sys010242833692.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [{81-1C-CE-E9-ZN}] c:\windows\system32\dwdsregt.exe GID003
O4 - HKLM\..\Run: [w002818a.dll] RUNDLL32.EXE w002818a.dll,I2 000e7b320002818a
O4 - HKLM\..\Run: [RelevantKnowledge] c:\windows\system32\rlvknlg.exe -boot
O4 - HKLM\..\Run: [w039773e.dll] RUNDLL32.EXE w039773e.dll,I2 000e7b320039773e
O4 - HKLM\..\Run: [defender] C:\\defender23.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [fscgr] C:\WINDOWS\system32\jeqmqf.exe reg_run
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\Earthlink DSL\TaskPanl.exe" -winstart
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.pcclub.com
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305...meInstaller.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F13B39B-6C50-41A8-A60C-1EC62A3F58AC}: NameServer = 207.69.188.186 207.69.188.185
O17 - HKLM\System\CCS\Services\Tcpip\..\{C16B5623-1F45-40BA-ADD6-97F30A7C5295}: NameServer = 207.69.188.185,207.69.188.186
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Microsoft WMI Performance Adapter AddOn (WMIPerAddOn) - Unknown owner - C:\WINDOWS\wmiapsrv.exe (file missing)

#6 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:47 AM

Posted 27 May 2006 - 01:15 PM

-> Click Start, Run and type in: msconfig
-> Hit Enter
-> Click on the Startup-tab and make sure there are checkmarks in every entry.
-> Then hit OK until the window closes.

Post back with a fresh HijackThis log.

I need to see all the entries to be successfull with the cleaning. :thumbsup:
Hi there, stranger!

#7 Cani

Cani
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:47 PM

Posted 27 May 2006 - 01:28 PM

Logfile of HijackThis v1.99.1
Scan saved at 11:23:20 AM, on 5/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\sys010242833692.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\DIGStream\digstream.exe
C:\windows\system32\rlvknlg.exe
C:\defender23.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ICQ\ICQLite\ICQLite.exe
C:\Program Files\Common Files\svchostsys\svchostsys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Earthlink DSL\TaskPanl.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\HijackThis\HijackThis.exe
C:\Program Files\Earthlink DSL\TaskPanl.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie...ton/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie...ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.askmen.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcclub.com
R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,ljoubkh.exe
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\Earthlink DSL\PnEL.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [jvuepd] C:\WINDOWS\system32\jeqmqf.exe reg_run
O4 - HKLM\..\Run: [w004c3ba.dll] RUNDLL32.EXE w004c3ba.dll,I2 000e7b320004c3ba
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe
O4 - HKLM\..\Run: [sys010242833692] C:\WINDOWS\sys010242833692.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [{81-1C-CE-E9-ZN}] c:\windows\system32\dwdsregt.exe GID003
O4 - HKLM\..\Run: [w002818a.dll] RUNDLL32.EXE w002818a.dll,I2 000e7b320002818a
O4 - HKLM\..\Run: [RelevantKnowledge] c:\windows\system32\rlvknlg.exe -boot
O4 - HKLM\..\Run: [w039773e.dll] RUNDLL32.EXE w039773e.dll,I2 000e7b320039773e
O4 - HKLM\..\Run: [defender] C:\\defender23.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQ\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147838810\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [fscgr] C:\WINDOWS\system32\jeqmqf.exe reg_run
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\Earthlink DSL\TaskPanl.exe" -winstart
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQ\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.pcclub.com
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305...meInstaller.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C16B5623-1F45-40BA-ADD6-97F30A7C5295}: NameServer = 207.69.188.185,207.69.188.186
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Microsoft WMI Performance Adapter AddOn (WMIPerAddOn) - Unknown owner - C:\WINDOWS\wmiapsrv.exe (file missing)


Thanks so much, I can already tell I'm not as bugged up...

#8 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:47 AM

Posted 27 May 2006 - 03:04 PM

Hi again.. Lets continue :thumbsup:

Please download Brute Force Uninstaller to your desktop.
  • Right-click the BFU folder on your desktop, and choose Extract All
  • Click "Next"
  • In the box to choose where to extract the files to,
  • Click "Browse"
  • Click on the + sign next to "My Computer"
  • Click on "Local Disk ( C: ) or whatever your primary drive is
  • Click "Make New Folder"
  • Type in BFU
  • Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download QooFix.bat by LonnyRJones.
Save it in the same folder you made earlier (c:\BFU).

Please close ALL other open windows & explorer folder's, then double-click on QooFix.bat.
Choose option 1# (Qoolfix autofix) and follow the prompts.
Please be patient, it will take about five minutes.
Then please post back with a fresh HijackThis log by using AddReply. :flowers:
Hi there, stranger!

#9 Cani

Cani
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:47 PM

Posted 27 May 2006 - 03:25 PM

Ok. Downloaded, and extracted BFU. ALso d/l'd the qoofix. Ran that, and did #1. Reboot, now here is what my HJT log says:

Logfile of HijackThis v1.99.1
Scan saved at 1:20:10 PM, on 5/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\sys010242833692.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\system32\rlvknlg.exe
C:\defender23.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ICQ\ICQLite\ICQLite.exe
C:\Program Files\Common Files\svchostsys\svchostsys.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Earthlink DSL\TaskPanl.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie...ton/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie...ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.askmen.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcclub.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\Earthlink DSL\PnEL.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [w004c3ba.dll] RUNDLL32.EXE w004c3ba.dll,I2 000e7b320004c3ba
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe
O4 - HKLM\..\Run: [sys010242833692] C:\WINDOWS\sys010242833692.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [{81-1C-CE-E9-ZN}] c:\windows\system32\dwdsregt.exe GID003
O4 - HKLM\..\Run: [w002818a.dll] RUNDLL32.EXE w002818a.dll,I2 000e7b320002818a
O4 - HKLM\..\Run: [RelevantKnowledge] c:\windows\system32\rlvknlg.exe -boot
O4 - HKLM\..\Run: [w039773e.dll] RUNDLL32.EXE w039773e.dll,I2 000e7b320039773e
O4 - HKLM\..\Run: [defender] C:\\defender23.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQ\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147838810\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\Earthlink DSL\TaskPanl.exe" -winstart
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQ\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.pcclub.com
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305...meInstaller.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C16B5623-1F45-40BA-ADD6-97F30A7C5295}: NameServer = 207.69.188.185,207.69.188.186
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Microsoft WMI Performance Adapter AddOn (WMIPerAddOn) - Unknown owner - C:\WINDOWS\wmiapsrv.exe (file missing)

#10 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:47 AM

Posted 27 May 2006 - 03:33 PM

Well, we are progressing all the time.. :thumbsup:

Go ahead and delete Qoofix.bat.

==

Please print these instructions out, or write them down, as you can't read them during the fix.

1. Please download the trial version of Ewido Anti-malware here:
http://www.ewido.net/en/download/

Please read Ewido Setup Instructions
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

==

2. RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:\BFU).

Do not do anything with these yet!

==

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


==

3. Once in Safe Mode, Run Ewido:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • You will be prompted to clean the first infection.
  • Select "Perform action on all infections", then proceed.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop or a location where you can find it easily.
Close Ewido anti-malware.

==

4. Then, please go to Start > My Computer and navigate to the C:\BFU folder.
  • Start the Brute Force Uninstaller by double-clicking BFU.exe
  • Behind the scriptline to execute field click the folder icon Posted Image and select alcanshorty.bfu
  • Press Execute and let it do itís job. (You ought to see a progress bar if you did this correctly.)
  • Wait for the Complete script execution box to pop up and hit OK.
  • Press Exit to terminate the BFU program.
Reboot into normal Windows and post the contents of Ewido log that you saved along with a fresh HiJackThis log. :flowers:
Hi there, stranger!

#11 Cani

Cani
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:47 PM

Posted 27 May 2006 - 08:02 PM

the whole log couldn't fit into this message. So I deleted it to save eye strain. The following posts are my Ewido log (in 2 posts), and then my HJT log in the 3rd post (latest post).

Edited by Cani, 27 May 2006 - 08:24 PM.


#12 Cani

Cani
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:47 PM

Posted 27 May 2006 - 08:06 PM

EWIDO LOG:

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 5:39:53 PM, 5/27/2006
+ Report-Checksum: 8F7A81F0

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup
HKLM\SOFTWARE\PerfectNav -> Adware.KeenValue : Cleaned with backup
:mozilla.6:C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\9zqvn1em.default\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup
:mozilla.7:C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\9zqvn1em.default\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@ads1.revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@banners.searchingbooth[1].txt -> TrackingCookie.Searchingbooth : Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@media.top-banners[1].txt -> TrackingCookie.Top-banners : Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\LocalService\Cookies\system@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\LocalService\Desktop\TagASaurus.exe -> Hijacker.Small : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4TIBG1E7\newname22[1].exe -> Hijacker.VB.no : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4TIBG1E7\NNSCAA638[1].EXE -> Adware.NewDotNet : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SXYFK16N\drsmartload46a[1].exe -> Downloader.Adload.bq : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SXYFK16N\keyboard22[1].exe -> Backdoor.VB.ary : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\WLQF4P23\drsmartload45a[1].exe -> Downloader.Adload.bq : Cleaned with backup
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\WLQF4P23\ZIGID003[1].exe -> Adware.ZenoSearch : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@ad.adition[2].txt -> TrackingCookie.Adition : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@ad.yieldmanager[4].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@adorigin[2].txt -> TrackingCookie.Adorigin : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@ads.euniverseads[1].txt -> TrackingCookie.Euniverseads : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@ads.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@ads1.revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@ads18.bpath[1].txt -> TrackingCookie.Bpath : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@anat.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@banner.paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@c.goclick[2].txt -> TrackingCookie.Goclick : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@cochranfirm.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@com[2].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@cz5.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@cz8.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@data2.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@data3.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@data4.perf.overture[2].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@e-2dj6wfl4egajgco.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@e-2dj6wfliwoczoeo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@h.starware[2].txt -> TrackingCookie.Starware : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@hypertracker[2].txt -> TrackingCookie.Hypertracker : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@kmpads[1].txt -> TrackingCookie.Kmpads : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@metacafe.122.2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@revenue[2].txt -> TrackingCookie.Revenue : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@riptownmedia.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@specificpop[1].txt -> TrackingCookie.Specificpop : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@targetnet[1].txt -> TrackingCookie.Targetnet : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@track.adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@try.starware[2].txt -> TrackingCookie.Starware : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@www.epilot[1].txt -> TrackingCookie.Epilot : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@www.myaffiliateprogram[2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@www.popuptraffic[1].txt -> TrackingCookie.Popuptraffic : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@y-1shz2prbmdj6wvny-1sez2pra2dj6wfkikmcpwgpqidj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@y-1shz2prbmdj6wvny-1sez2pra2dj6wjliehczoaqasdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Majid\Application Data\Earthlink\6.0\canibusspice@earthlink.net\Cookies\majid@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.12:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.114:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.115:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup
:mozilla.116:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.131:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.132:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.133:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.135:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Centrport : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Centrport : Cleaned with backup
:mozilla.159:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup
:mozilla.177:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.178:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.179:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.180:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.181:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.182:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.183:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.185:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.190:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.191:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.192:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.193:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.194:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.195:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.431:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.439:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.440:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.441:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.442:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.443:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.448:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup
:mozilla.449:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Pro-market : Cleaned with backup
:mozilla.454:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.475:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.485:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup
:mozilla.494:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.495:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.496:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.497:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.532:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.533:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.554:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.555:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.559:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.560:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.561:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.562:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.563:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.565:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.629:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned with backup
:mozilla.694:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned with backup
:mozilla.704:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.705:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.706:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.707:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.708:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.709:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.710:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.711:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.734:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.735:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.736:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.737:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.738:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.745:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.760:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.761:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.762:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.763:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.764:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.765:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.771:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.772:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.773:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.778:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.779:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.795:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\lxx0n3x6.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.80:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.81:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.82:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.86:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.87:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.88:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.89:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.97:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.103:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.104:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.105:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.110:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.111:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.112:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.113:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.114:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.115:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.116:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.117:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.118:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.119:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.120:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.127:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.128:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.129:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.130:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adbrite : Cleaned with backup
:mozilla.139:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.140:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.141:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.142:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.143:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.152:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.183:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.185:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.193:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.194:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.195:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.196:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.197:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.216:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.219:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.228:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.229:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.230:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.231:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.232:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.233:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.234:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.240:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup
:mozilla.241:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup
:mozilla.242:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup
:mozilla.249:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.250:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.259:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup
:mozilla.260:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup
:mozilla.294:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.295:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.296:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.297:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.298:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.299:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.300:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.301:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.308:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.347:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.429:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.480:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.481:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.486:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.492:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.504:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.505:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> Track

#13 Cani

Cani
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:47 PM

Posted 27 May 2006 - 08:08 PM

EWIDO LOG CONT'D

:mozilla.505:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.506:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.507:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.508:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.515:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.528:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.529:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.530:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.531:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.532:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
:mozilla.538:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.550:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.563:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.564:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.565:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.566:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.567:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.574:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.575:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.576:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.577:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.578:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.579:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.580:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.581:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.582:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.583:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.586:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.594:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.595:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.603:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.604:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.606:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.607:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.608:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.609:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.610:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.611:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.612:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.613:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.614:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.616:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.617:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.618:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.619:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.645:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.646:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.647:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.648:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.649:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.651:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.652:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.653:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.655:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.656:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.657:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.658:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.659:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.660:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.661:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.662:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.663:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.664:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.665:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.667:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.668:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.669:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.670:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.671:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.672:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.673:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.674:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.675:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.691:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.692:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Enhance : Cleaned with backup
:mozilla.693:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup
:mozilla.694:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup
:mozilla.695:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup
:mozilla.696:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup
:mozilla.697:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup
:mozilla.702:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.719:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Goldenpalace : Cleaned with backup
:mozilla.726:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.727:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.731:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Tracking101 : Cleaned with backup
:mozilla.732:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.733:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.734:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.735:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.736:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.737:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.763:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.764:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.765:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.767:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.768:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.769:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.770:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.771:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.772:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.773:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.774:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.775:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.776:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.777:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.778:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.779:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.786:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.787:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.792:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.793:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.794:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.795:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.796:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.797:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.798:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.799:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.834:C:\Documents and Settings\Majid\Application Data\Mozilla\Firefox\Profiles\utx1ywf1.Daoud\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\Majid\Cookies\majid@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Majid\Cookies\majid@com[2].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Majid\Cookies\majid@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Majid\Cookies\majid@specificpop[1].txt -> TrackingCookie.Specificpop : Cleaned with backup
C:\Documents and Settings\Majid\Cookies\majid@stats3.porntrack[1].txt -> TrackingCookie.Porntrack : Cleaned with backup
C:\Documents and Settings\Majid\Cookies\majid@www.popuptraffic[2].txt -> TrackingCookie.Popuptraffic : Cleaned with backup
C:\NNSCAA638.EXE -> Adware.NewDotNet : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\anyuser@ads.link4ads[1].txt -> TrackingCookie.Link4ads : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\anyuser@ehg-dig.hitbox[3].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\anyuser@gm.preferences[1].txt -> TrackingCookie.Preferences : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\anyuser@oxcash[2].txt -> TrackingCookie.Oxcash : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\anyuser@preferences[2].txt -> TrackingCookie.Preferences : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\anyuser@track-star[1].txt -> TrackingCookie.Track-star : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@com[1].txt -> TrackingCookie.Com : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@ehg-dig.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@ehg-dig.hitbox[4].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@ehg-dig.hitbox[5].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@ehg.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@hg1.hitbox[3].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@hg1.hitbox[4].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@oxcash[2].txt -> TrackingCookie.Oxcash : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@oxcash[3].txt -> TrackingCookie.Oxcash : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@oxcash[4].txt -> TrackingCookie.Oxcash : Cleaned with backup
C:\OLD_DOCS\Documents and Settings\C2\Cookies\c2@stats3.porntrack[1].txt -> TrackingCookie.Porntrack : Cleaned with backup
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Cleaned with backup
C:\Program Files\BearShare\Installer\saveinstwm.exe/VVSN.exe -> Adware.SaveNow : Cleaned with backup
C:\Program Files\BearShare\Installer\saveinstwm.exe/VVSN.exe -> Adware.SaveNow : Cleaned with backup
C:\Program Files\Common Files\misc001\webhc1.exe/whAgent.exe -> Adware.WebHancer : Cleaned with backup
C:\Program Files\Common Files\svchostsys\svchostrun.exe -> Downloader.Small : Cleaned with backup
C:\Program Files\Common Files\svchostsys\svchostsys.exe -> Downloader.Small : Cleaned with backup
C:\Program Files\Common Files\svchostsys\svchostupdate.exe -> Downloader.Small : Cleaned with backup
C:\Program Files\Kazaa\PerfectNavUninstall.exe -> Downloader.Keenval.e : Cleaned with backup
C:\WINDOWS\icont.exe -> Adware.AdURL : Cleaned with backup
C:\WINDOWS\NDNuninstall7_22.exe -> Adware.NewDotNet : Cleaned with backup
C:\WINDOWS\sys010242833692.exe -> Adware.Enbrow : Cleaned with backup
C:\WINDOWS\system32\dwdsregt.exe_tobedeleted -> Adware.ZenoSearch : Cleaned with backup
C:\WINDOWS\system32\rk.bin -> Adware.RK : Cleaned with backup
C:\WINDOWS\system32\rlls.dll -> Adware.RK : Cleaned with backup
C:\WINDOWS\system32\rlvknlg.exe -> Adware.RK : Cleaned with backup
C:\WINDOWS\system32\ZICORN003.exe -> Adware.ZenoSearch : Cleaned with backup
C:\WINDOWS\system32\ѕystem\services.exe -> Downloader.PurityScan.cl : Cleaned with backup
C:\ZIGID003.exe -> Adware.ZenoSearch : Cleaned with backup

#14 Cani

Cani
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:47 PM

Posted 27 May 2006 - 08:10 PM

HJT Log


Logfile of HijackThis v1.99.1
Scan saved at 5:55:35 PM, on 5/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\htpatch.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\ICQ\ICQLite\ICQLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Earthlink DSL\TaskPanl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie...ton/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie...ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.askmen.com/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcclub.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\Earthlink DSL\PnEL.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [w004c3ba.dll] RUNDLL32.EXE w004c3ba.dll,I2 000e7b320004c3ba
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [{81-1C-CE-E9-ZN}] c:\windows\system32\dwdsregt.exe GID003
O4 - HKLM\..\Run: [w002818a.dll] RUNDLL32.EXE w002818a.dll,I2 000e7b320002818a
O4 - HKLM\..\Run: [w039773e.dll] RUNDLL32.EXE w039773e.dll,I2 000e7b320039773e
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQ\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1147838810\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\Earthlink DSL\TaskPanl.exe" -winstart
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQ\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.pcclub.com
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305...meInstaller.exe
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C16B5623-1F45-40BA-ADD6-97F30A7C5295}: NameServer = 207.69.188.185,207.69.188.186
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Microsoft WMI Performance Adapter AddOn (WMIPerAddOn) - Unknown owner - C:\WINDOWS\wmiapsrv.exe (file missing)





I just realized my post would preview full length, but the forum limits the characters or something. So I had to continue my log posting ni multiple replies. Geeeeez, I never knew my cpu was this disgusting. =X




THanks for your continued help!! :thumbsup:

#15 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:47 AM

Posted 28 May 2006 - 04:08 AM

Ok..

Go ahead and uninstall Ewido (if you want).

Through Add/Remove programs, uninstall the following entry:

Viewpoint Manager

Run a scan with HijackThis and check the following objects for removal:

R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [w004c3ba.dll] RUNDLL32.EXE w004c3ba.dll,I2 000e7b320004c3ba
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [{81-1C-CE-E9-ZN}] c:\windows\system32\dwdsregt.exe GID003
O4 - HKLM\..\Run: [w002818a.dll] RUNDLL32.EXE w002818a.dll,I2 000e7b320002818a
O4 - HKLM\..\Run: [w039773e.dll] RUNDLL32.EXE w039773e.dll,I2 000e7b320039773e
O4 - HKCU\..\Run: [sys_up1] C:\Program Files\Common Files\svchostsys\svchostsys.exe


Now close ALL other open windows except for HijackThis and hit FIX CHECKED. Close HijackThis.

==

Please download WebRoot SpySweeper from HERE (It's a 2 week trial):
  • Click Download Now to download the program.
  • Install it. Once the program is installed, it will open.
  • It will prompt you to update to the latest definitions, click Yes.
  • Once the definitions are installed, click Options on the left side.
  • Click the Sweep Options tab.
  • Under What to Sweep please put a check next to the following:
    • Sweep Memory
    • Sweep Registry
    • Sweep Cookies
    • Sweep All User Accounts
    • Enable Direct Disk Sweeping
    • Sweep Contents of Compressed Files
    • Sweep for Rootkits
    • Please UNCHECK Do not Sweep System Restore Folder.
  • Click Sweep Now on the left side.
  • Click the Start button.
  • When it's done scanning, click the Next button.
  • Make sure everything has a check next to it, then click the Next button.
  • It will remove all of the items found.
  • Click Session Log in the upper right corner, copy everything in that window.
  • Click the Summary tab and click Finish.
  • Paste the contents of the session log you copied into your next reply. :thumbsup:

Edited by Rawe, 28 May 2006 - 04:10 AM.

Hi there, stranger!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users