Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Non-deleting Cookies


  • Please log in to reply
43 replies to this topic

#1 newkid

newkid

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 08 December 2004 - 04:39 PM

If I'm in the wrong forum please direct me to the correct one.

Cookies I've deleted on my C Disk will always return.

I've tried every software out there with the same results. ALL THE COOKIES RETURN.

I'm using Microsoft XP Home, Norton System Works 2005 Version 8.02 Build: 6,
Ad-Aware SE Plus Build 1.05, SpySubtract PRO 2.61, CWShredder v2.10, X-Cleaner Deluxe Version, CCleaner v1.15.078, AnalogX Cookiewall Version 1.01, Webroot Version 2.2.0 Build 44. Nothing has helped.

If I go: Start/Explore/Documents and Settings/User/Cookies and delete the cookies (with the any of the different softwares or one each into the Recycle Bin, and then clean out the Bin) they will still be deleted. If I restart my computer, they will still be deleted. But, once I connect with my INTERNET provider (Earthlink) EVERYONE IS BACK.

Can anyone help me?!!!

BC AdBot (Login to Remove)

 


m

#2 newkid

newkid
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 13 December 2004 - 04:08 PM

Here is the latest HJT scan. Anyone interested in helping solve this problem? It's defeated others.


Logfile of HijackThis v1.98.2
Scan saved at 3:05:43 PM, on 12/13/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Broderbund\Atomic Clock 8.0\AtomClk.exe
C:\Program Files\AnalogX\CookieWall\cookie.exe
C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Michael J\My Documents\My Received Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\elnIE.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Atomic Clock] C:\Program Files\Broderbund\Atomic Clock 8.0\AtomClk.exe
O4 - HKLM\..\Run: [CookieWall] C:\Program Files\AnalogX\CookieWall\cookie.exe
O4 - HKCU\..\Run: [PPWebCap] C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O4 - Global Startup: Norton System Doctor.LNK = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {AA59BA6E-B44F-4514-AB3C-0C1DD2306FC3} (MSN Money Charting) - http://fdl.msn.com/public/investor/v12/invinstl.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {DED22F57-FEE2-11D0-953B-00C04FD9152D} (CarPoint Auto-Pricer Control) - http://autos.msn.com/components/ocx/autopr.../autopricer.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab

#3 jgweed

jgweed

  • Staff Emeritus
  • 28,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:07:56 PM

Posted 13 December 2004 - 06:49 PM

It may be the cookies are placed there by your ISP since, as I take it, they show up immediately after you log in, but before you make any page change in your browser.
Cheers,
John
Whereof one cannot speak, thereof one should be silent.

#4 newkid

newkid
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 13 December 2004 - 07:20 PM

So can you figure out a solution to keep them deleted?

#5 jgweed

jgweed

  • Staff Emeritus
  • 28,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:07:56 PM

Posted 13 December 2004 - 07:28 PM

Since I have not had a similar problem, I cannot suggest anything at this time. However, I use Mozilla as my browser, and it has a very good cookie manager, and I generally retain some cookies that are useful, and only delete those that are presented to me by Ad-AwareSE or Spybot. I suspect, that if they are placed there by Earthlink (you will have to determine this), they are harmless and have some function that your ISP uses.
Cheers,
John
Whereof one cannot speak, thereof one should be silent.

#6 newkid

newkid
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 13 December 2004 - 08:16 PM

None of the softwares show any of them to be any kind of spyware. As far as Earthlink they had no answer. They gave me directions on emptying Temporary Internet Files. Which wasn't the problem. I've got cookies from sites that I visited years ago looking for a cell phone. I'll never visit those sites again, so why keep the cookie. Besides, I should be able to decide what I want to keep, and some bug is stopping me. XP is not working the way it should.

#7 jgweed

jgweed

  • Staff Emeritus
  • 28,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:07:56 PM

Posted 13 December 2004 - 08:33 PM

You might want to try completely overwriting them, assuming you can identify which cookies you want to get rid of. Spybot, for example, has a shredder tool, and you can also download Tolv's Eraser (free application):

http://www.tolvanen.com/eraser/

Either of these should rid your HD of the offenders.
Cheers,
John
Whereof one cannot speak, thereof one should be silent.

#8 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:06:56 PM

Posted 14 December 2004 - 01:17 AM

N/T

Edited by ddeerrff, 14 December 2004 - 01:19 AM.

Derfram
~~~~~~

#9 newkid

newkid
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 14 December 2004 - 02:39 PM

Thanks for the suggestion of "Eraser", but I've tried to use SpySubtract which uses an over writer, X-Cleaner, and Spybot. They and other software state " be sure you want these items cleaned out because they will permanently be gone. The cookies still come back.

The only thing that is doing anything is Cookie Wall, but that just weeds out the cookies you don't want to show up on the disk. Yet their still there.

#10 newkid

newkid
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 15 December 2004 - 01:41 PM

I went back to "Earthlink" for their help(?). They had me go into the Task Panel/Options/Privacy Tools and had me bring the security to High which then brought in an option "Delete all cookies except these". Clicked Apply/OK.
Emptied "Coookiewall" deleted All the cookies using "X-Cleaner. Checked to see if the cookies were gone. They were. Shut down and restarted my computer. Checked. They were still gone. Connected to "Earthlink". THEIR ALL BACK. Earthlinks solution to raise the option didn't work either!

Anymore ideas out there?

#11 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,388 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:07:56 PM

Posted 16 December 2004 - 05:20 PM

What sites are these cookies for? The log is clean

#12 newkid

newkid
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 16 December 2004 - 05:53 PM

Any, and all "Text Document" cookies. Here's the latest HJT scan I just did with the cookies present under "User",

Logfile of HijackThis v1.98.2
Scan saved at 4:47:48 PM, on 12/16/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Broderbund\Atomic Clock 8.0\AtomClk.exe
C:\Program Files\AnalogX\CookieWall\cookie.exe
C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Michael J\My Documents\My Received Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\elnIE.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Atomic Clock] C:\Program Files\Broderbund\Atomic Clock 8.0\AtomClk.exe
O4 - HKLM\..\Run: [CookieWall] C:\Program Files\AnalogX\CookieWall\cookie.exe
O4 - HKCU\..\Run: [PPWebCap] C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O4 - Global Startup: Norton System Doctor.LNK = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {AA59BA6E-B44F-4514-AB3C-0C1DD2306FC3} (MSN Money Charting) - http://fdl.msn.com/public/investor/v12/invinstl.exe
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {DED22F57-FEE2-11D0-953B-00C04FD9152D} (CarPoint Auto-Pricer Control) - http://autos.msn.com/components/ocx/autopr.../autopricer.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab

#13 EdBee

EdBee

  • Members
  • 208 posts
  • OFFLINE
  •  
  • Local time:08:56 PM

Posted 16 December 2004 - 06:05 PM

Ditto re the clean log--I also use Earthlink. I dont know if the EL Search Asst could be doing it--or something in your registry that puts the cookies back--possible? One thing is that going back to a old restore point I guess could do that
-suggest YOU DONT you dont mess with any entries on your HJT until Griner gets back to you. This is a simple but pesky, annoying problem. I use Cookie Wall--I will be checking to see what happens when I use the wall to rid myself of a cookie--whether it actually deletes the file from the WIN folder. I had assumed it did!!!

Edited by EdBee, 16 December 2004 - 06:07 PM.

EDBEE from NMUSA- RENOWNED MALWARE FIGHTER AND SWORN ENEMY OF ALL INTERNET HIJACKERS

#14 EdBee

EdBee

  • Members
  • 208 posts
  • OFFLINE
  •  
  • Local time:08:56 PM

Posted 16 December 2004 - 06:36 PM

NewKID--you are correct about cookiewall!!! The leftmost box should be left with the cookies you want to have automatically deleted as they come in!! This cookiewall is not designed to delete cookies in your files but to stop the ones you dont want ever. Good luck with your problem--dont give up!!+ :thumbsup:
EDBEE from NMUSA- RENOWNED MALWARE FIGHTER AND SWORN ENEMY OF ALL INTERNET HIJACKERS

#15 newkid

newkid
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 16 December 2004 - 07:21 PM

Thank you EdBEE,

Cookiewall is a good software. Cookie Jar does the same thing, but you right, they only mask the problem. Rather than keep using Cookiewall as a "Air Freshner" I'd like able to get rid of "The Stink".




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users