View Full Version : Need help removing zlob.zcodec
After running Spybot it says:
Error during check!: Zlob.ZCodec (Ungültiger Datentyp für '')
Then below that it says no immediate threats were found.
Here's HJT logfile.
Logfile of HijackThis v1.99.1
Scan saved at 7:07:47 PM, on 2/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\MSN\MSNCoreFiles\MSN.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Downloads\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar6.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?27dcceb48c974d16b81db0be78db9b83
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?27dcceb48c974d16b81db0be78db9b83
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {1DB93715-3B60-43EE-93E6-279BB3E1DF76} (OCXDownloadChecker Control) - http://71.39.77.105:8888/cab/OCXChecker_6110.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX28.cab
O16 - DPF: {7FE26BE2-B923-4B41-9834-E84DA1CC1F96} (Maid Control) - http://vsp.closetmaid.com/vsp/cmaidctl_vsp.closetmaid.com_downloader.cab
O16 - DPF: {A78856A6-334B-43AF-96F5-58574005910D} (CEinstaller Object) - https://secure200.ipixmedia.com/code/Einstaller.cab
O16 - DPF: {DBAFE6AD-DC14-45DF-A3F7-F8832289A1CD} (DownloadFile Control) - http://71.39.77.105:8888/cab/DownloadFile_6110.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
Thank you for the help.
teacup61
2007-02-04, 08:58
Hello emjh95,
Welcome to Safer Networking Forums :)
Please download SmitfraudFix (http://siri.urz.free.fr/Fix/SmitfraudFix.zip) (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.
Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Thanks,
tea
After installing and running SmitfraudFix,here's what came up:
SmitFraudFix v2.139
Scan done at 23:16:06.12, Mon 02/05/2007
Run from C:\Documents and Settings\Helfrich\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Helfrich
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Helfrich\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HELFRICH\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Thanks.
teacup61
2007-02-06, 14:31
Hello,
So you won't worry, looks like if there is something there it's just a remnant. :)
Download the trial version of Spy Sweeper from
Here (http://www.webroot.com/shoppingcart/tryme.php?bjpc=64011&vcode=DT14)
Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)
You will be prompted to check for updated definitions, please do so.
(This may take several minutes)
Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.
Click on Sweep and allow it to fully scan your system.
When the sweep has finished, click Remove. Click Select All and then Next
From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.
Exit Spy Sweeper.
Restart your computer, and then please copy and paste the SpySweeper log into this thread.
Thanks,
tea
Here's the log file
4:50 AM: Removal process completed. Elapsed time 00:00:22
4:50 AM: Quarantining All Traces: adprofile cookie
4:50 AM: Quarantining All Traces: 123count cookie
4:50 AM: Quarantining All Traces: ugo cookie
4:50 AM: Quarantining All Traces: hermoment.com cookie
4:50 AM: Quarantining All Traces: adknowledge cookie
4:50 AM: Quarantining All Traces: dealtime cookie
4:50 AM: Quarantining All Traces: exitexchange cookie
4:50 AM: Quarantining All Traces: infospace cookie
4:50 AM: Quarantining All Traces: trb.com cookie
4:50 AM: Quarantining All Traces: ic-live cookie
4:50 AM: Quarantining All Traces: advertising cookie
4:50 AM: Quarantining All Traces: yieldmanager cookie
4:50 AM: Quarantining All Traces: ask cookie
4:50 AM: Quarantining All Traces: searchadnetwork cookie
4:50 AM: Quarantining All Traces: clicktracks cookie
4:50 AM: Quarantining All Traces: howstuffworks cookie
4:50 AM: Quarantining All Traces: mygeek cookie
4:50 AM: Quarantining All Traces: xiti cookie
4:50 AM: Quarantining All Traces: tribalfusion cookie
4:50 AM: Quarantining All Traces: bannerspace cookie
4:50 AM: Quarantining All Traces: trafficmp cookie
4:50 AM: Quarantining All Traces: ru4 cookie
4:50 AM: Quarantining All Traces: banner cookie
4:50 AM: Quarantining All Traces: adecn cookie
4:50 AM: Quarantining All Traces: atwola cookie
4:50 AM: Quarantining All Traces: tracking cookie
4:50 AM: Quarantining All Traces: military cookie
4:50 AM: Quarantining All Traces: screensavers.com cookie
4:50 AM: Quarantining All Traces: hbmediapro cookie
4:50 AM: Quarantining All Traces: clickandtrack cookie
4:50 AM: Quarantining All Traces: reunion cookie
4:50 AM: Quarantining All Traces: stlyrics cookie
4:50 AM: Quarantining All Traces: server.iad.liveperson cookie
4:50 AM: Quarantining All Traces: realmedia cookie
4:50 AM: Quarantining All Traces: hitslink cookie
4:50 AM: Quarantining All Traces: belointeractive cookie
4:50 AM: Quarantining All Traces: homestore cookie
4:50 AM: Quarantining All Traces: ads.adsag cookie
4:50 AM: Quarantining All Traces: bizrate cookie
4:50 AM: Quarantining All Traces: carsbelowinvoice cookie
4:50 AM: Quarantining All Traces: 64.62.232 cookie
4:50 AM: Quarantining All Traces: customer cookie
4:50 AM: Quarantining All Traces: ads.businessweek cookie
4:50 AM: Quarantining All Traces: pricegrabber cookie
4:50 AM: Quarantining All Traces: mediaplex cookie
4:50 AM: Quarantining All Traces: overture cookie
4:50 AM: Quarantining All Traces: pub cookie
4:50 AM: Quarantining All Traces: tacoda cookie
4:50 AM: Quarantining All Traces: adminder cookie
4:50 AM: Quarantining All Traces: monstermarketplace cookie
4:50 AM: Quarantining All Traces: did-it cookie
4:50 AM: Quarantining All Traces: atlas dmt cookie
4:50 AM: Quarantining All Traces: zedo cookie
4:50 AM: Quarantining All Traces: go2net.com cookie
4:50 AM: Quarantining All Traces: affiliatefuel.com cookie
4:50 AM: Quarantining All Traces: rightmedia cookie
4:50 AM: Quarantining All Traces: webtrends cookie
4:50 AM: Quarantining All Traces: a cookie
4:50 AM: Quarantining All Traces: go.com cookie
4:50 AM: Quarantining All Traces: l2m.net cookie
4:50 AM: Quarantining All Traces: belnk cookie
4:50 AM: Quarantining All Traces: gamespy cookie
4:50 AM: Quarantining All Traces: 360i cookie
4:50 AM: Quarantining All Traces: servlet cookie
4:50 AM: Quarantining All Traces: gostats cookie
4:50 AM: Quarantining All Traces: adrevolver cookie
4:50 AM: Quarantining All Traces: toplist cookie
4:50 AM: Quarantining All Traces: about cookie
4:50 AM: Quarantining All Traces: kount cookie
4:50 AM: Quarantining All Traces: nextag cookie
4:50 AM: Quarantining All Traces: 2o7.net cookie
4:50 AM: Removal process initiated
10:24 PM: Traces Found: 151
10:24 PM: Custom Sweep has completed. Elapsed time 00:53:38
10:24 PM: File Sweep Complete, Elapsed Time: 00:50:31
10:19 PM: Warning: SweepCompressedFiles: Access violation at address 00401D84 in module 'SpySweeper.exe'. Read of address 7DCA000C
10:19 PM: Warning: SweepCompressedFiles: Access violation at address 00401D84 in module 'SpySweeper.exe'. Read of address 7DEB000C
10:17 PM: Warning: SweepCompressedFiles: Access violation at address 00401D84 in module 'SpySweeper.exe'. Read of address 7E24000C
10:17 PM: Warning: SweepCompressedFiles: Access violation at address 00401D84 in module 'SpySweeper.exe'. Read of address 7E45000C
10:13 PM: Warning: TCompressedFile.GetStreams(2): Stream read error
10:13 PM: Warning: TCompressedFile.GetStreams(2): Stream read error
10:09 PM: Warning: Failed to open file "c:\documents and settings\localservice\application data\webroot\spy sweeper\data\settings.dat". The process cannot access the file because it is being used by another process
10:09 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
10:09 PM: Warning: Failed to open file "c:\documents and settings\localservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
10:09 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat". The process cannot access the file because it is being used by another process
10:09 PM: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat.log". The process cannot access the file because it is being used by another process
10:09 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
10:09 PM: Warning: Failed to open file "c:\documents and settings\networkservice\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
10:09 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat". The process cannot access the file because it is being used by another process
10:09 PM: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat.log". The process cannot access the file because it is being used by another process
10:04 PM: Warning: Failed to open file "c:\documents and settings\helfrich\local settings\application data\microsoft\windows defender\filetracker\{c1686772-9f40-428c-8ecc-4d4defa69b77}". The process cannot access the file because it is being used by another process
10:02 PM: Warning: Failed to open file "c:\documents and settings\helfrich\local settings\application data\microsoft\windows\usrclass.dat.log". The process cannot access the file because it is being used by another process
10:02 PM: Warning: Failed to open file "c:\documents and settings\helfrich\local settings\application data\microsoft\windows\usrclass.dat". The process cannot access the file because it is being used by another process
9:51 PM: Warning: Failed to open file "c:\documents and settings\helfrich\ntuser.dat.log". The process cannot access the file because it is being used by another process
9:51 PM: Warning: Failed to open file "c:\documents and settings\helfrich\ntuser.dat". The process cannot access the file because it is being used by another process
9:51 PM: Warning: Failed to open file "c:\documents and settings\all users\drm\cache\indiv04.tmp". The process cannot access the file because it is being used by another process
9:36 PM: Warning: Failed to open file "c:\windows\softwaredistribution\eventcache\{9663407c-ce16-437d-831f-8909035ab302}.bin". The process cannot access the file because it is being used by another process
9:36 PM: Warning: Failed to open file "c:\windows\system32\catroot2\edb.log". The process cannot access the file because it is being used by another process
9:36 PM: Warning: Failed to open file "c:\windows\system32\catroot2\tmp.edb". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\default". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\software". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\system". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\sam.log". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\default.log". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\system.log". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\software.log". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\security.log". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\sam". The process cannot access the file because it is being used by another process
9:35 PM: Warning: Failed to open file "c:\windows\system32\config\security". The process cannot access the file because it is being used by another process
9:33 PM: Warning: Failed to open file "c:\pagefile.sys". Access is denied
9:33 PM: Starting File Sweep
9:33 PM: Cookie Sweep Complete, Elapsed Time: 00:00:11
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@adprofile[2].txt (ID = 2084)
9:33 PM: Found Spy Cookie: adprofile cookie
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@www.adminder[1].txt (ID = 2079)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@www.abcnews.go[2].txt (ID = 2729)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@radio.disney.go[2].txt (ID = 2729)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@adisney.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@dealtime[2].txt (ID = 2505)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@atwola[2].txt (ID = 2255)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@phoenix.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@go2net[1].txt (ID = 2730)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@register.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@abcnews.go[2].txt (ID = 2729)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@did-it[2].txt (ID = 2523)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@a[1].txt (ID = 2027)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@bizrate[1].txt (ID = 2308)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@l2m[1].txt (ID = 2913)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@nextag[1].txt (ID = 5014)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@tracking[2].txt (ID = 3571)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@tracking[1].txt (ID = 3571)
Here's the second half
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@go[2].txt (ID = 2728)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@disney.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@iq.kount[1].txt (ID = 2912)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@bbq.about[2].txt (ID = 2038)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@interiordec.about[2].txt (ID = 2038)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@familyfun.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\networkservice\cookies\helfrich@about[1].txt (ID = 2037)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www.disney.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@palmtops.about[2].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@123count[2].txt (ID = 1927)
9:33 PM: Found Spy Cookie: 123count cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@vgstrategies.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@dealtime[1].txt (ID = 2505)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@ugo[2].txt (ID = 3608)
9:33 PM: Found Spy Cookie: ugo cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www2.hermoment[1].txt (ID = 2774)
9:33 PM: Found Spy Cookie: hermoment.com cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@adknowledge[2].txt (ID = 2072)
9:33 PM: Found Spy Cookie: adknowledge cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@vetmedicine.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@exitexchange[1].txt (ID = 2633)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www.dealtime[2].txt (ID = 2506)
9:33 PM: Found Spy Cookie: dealtime cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@sleepdisorders.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@count3.exitexchange[1].txt (ID = 2634)
9:33 PM: Found Spy Cookie: exitexchange cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@homestore[1].txt (ID = 2793)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@infospace[2].txt (ID = 2865)
9:33 PM: Found Spy Cookie: infospace cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@trb[1].txt (ID = 3587)
9:33 PM: Found Spy Cookie: trb.com cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@ic-live[2].txt (ID = 2821)
9:33 PM: Found Spy Cookie: ic-live cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@experts.about[2].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@psc.disney.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@advertising[1].txt (ID = 2175)
9:33 PM: Found Spy Cookie: advertising cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@compnetworking.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@servlet[4].txt (ID = 3345)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@disney.go[2].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@ad.yieldmanager[2].txt (ID = 3751)
9:33 PM: Found Spy Cookie: yieldmanager cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@forums.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@healing.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@ask[1].txt (ID = 2245)
9:33 PM: Found Spy Cookie: ask cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@about[1].txt (ID = 2037)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@searchadnetwork[2].txt (ID = 3311)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www.searchadnetwork[1].txt (ID = 3312)
9:33 PM: Found Spy Cookie: searchadnetwork cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@photography.about[2].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@stats2.clicktracks[1].txt (ID = 2407)
9:33 PM: Found Spy Cookie: clicktracks cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@howstuffworks[2].txt (ID = 2805)
9:33 PM: Found Spy Cookie: howstuffworks cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@mygeek[1].txt (ID = 3041)
9:33 PM: Found Spy Cookie: mygeek cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@server.iad.liveperson[3].txt (ID = 3341)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@xiti[1].txt (ID = 3717)
9:33 PM: Found Spy Cookie: xiti cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@tribalfusion[2].txt (ID = 3589)
9:33 PM: Found Spy Cookie: tribalfusion cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@customer[2].txt (ID = 2481)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@bannerspace[1].txt (ID = 2284)
9:33 PM: Found Spy Cookie: bannerspace cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@trafficmp[2].txt (ID = 3581)
9:33 PM: Found Spy Cookie: trafficmp cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@edge.ru4[1].txt (ID = 3269)
9:33 PM: Found Spy Cookie: ru4 cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@banner[2].txt (ID = 2276)
9:33 PM: Found Spy Cookie: banner cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@adecn[2].txt (ID = 2063)
9:33 PM: Found Spy Cookie: adecn cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@atwola[1].txt (ID = 2255)
9:33 PM: Found Spy Cookie: atwola cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@familycrafts.about[2].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@childparenting.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@parentingteens.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@tracking[3].txt (ID = 3571)
9:33 PM: Found Spy Cookie: tracking cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@military[1].txt (ID = 2996)
9:33 PM: Found Spy Cookie: military cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@desktoppub.about[2].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www.screensavers[1].txt (ID = 3298)
9:33 PM: Found Spy Cookie: screensavers.com cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@adopt.hbmediapro[2].txt (ID = 2768)
9:33 PM: Found Spy Cookie: hbmediapro cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@hits.clickandtrack[2].txt (ID = 2397)
9:33 PM: Found Spy Cookie: clickandtrack cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@reunion[2].txt (ID = 3255)
9:33 PM: Found Spy Cookie: reunion cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@stlyrics[2].txt (ID = 3461)
9:33 PM: Found Spy Cookie: stlyrics cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@paranormal.about[2].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@server.iad.liveperson[2].txt (ID = 3341)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@abc.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@rsi.abc.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@gostats[2].txt (ID = 2747)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@server.iad.liveperson[1].txt (ID = 3341)
9:33 PM: Found Spy Cookie: server.iad.liveperson cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@realmedia[1].txt (ID = 3235)
9:33 PM: Found Spy Cookie: realmedia cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www.pricegrabber[2].txt (ID = 3186)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@counter.hitslink[1].txt (ID = 2790)
9:33 PM: Found Spy Cookie: hitslink cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@ads.belointeractive[1].txt (ID = 2295)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@belointeractive[2].txt (ID = 2294)
9:33 PM: Found Spy Cookie: belointeractive cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@homebuying.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@media.homestore[1].txt (ID = 2794)
9:33 PM: Found Spy Cookie: homestore cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@abclocal.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@adsag[2].txt (ID = 2110)
9:33 PM: Found Spy Cookie: ads.adsag cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@bizrate[2].txt (ID = 2308)
9:33 PM: Found Spy Cookie: bizrate cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@belnk[2].txt (ID = 2292)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@carsbelowinvoice[2].txt (ID = 2352)
9:33 PM: Found Spy Cookie: carsbelowinvoice cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@ath.belnk[1].txt (ID = 2293)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@64.62.232[1].txt (ID = 1987)
9:33 PM: Found Spy Cookie: 64.62.232 cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@trucks.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@abcnews.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@dlr.reservations.disney.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@servlet[3].txt (ID = 3345)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@southernfood.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@rsi.abcnews.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@paypal.112.2o7[1].txt (ID = 1958)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@familyfun.go[2].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@customer[1].txt (ID = 2481)
9:33 PM: Found Spy Cookie: customer cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@ads.businessweek[1].txt (ID = 2113)
9:33 PM: Found Spy Cookie: ads.businessweek cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@pricegrabber[1].txt (ID = 3185)
9:33 PM: Found Spy Cookie: pricegrabber cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@media.adrevolver[1].txt (ID = 2089)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@mediaplex[1].txt (ID = 6442)
9:33 PM: Found Spy Cookie: mediaplex cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@interiordec.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@overture[1].txt (ID = 3105)
9:33 PM: Found Spy Cookie: overture cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@pub[1].txt (ID = 3205)
9:33 PM: Found Spy Cookie: pub cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@tacoda[1].txt (ID = 6444)
9:33 PM: Found Spy Cookie: tacoda cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@familyinternet.about[2].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@hunting.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www.monstermarketplace[1].txt (ID = 3007)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www.adminder[1].txt (ID = 2079)
9:33 PM: Found Spy Cookie: adminder cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www.abcnews.go[2].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@radio.disney.go[2].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@adisney.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@monstermarketplace[2].txt (ID = 3006)
9:33 PM: Found Spy Cookie: monstermarketplace cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@did-it[1].txt (ID = 2523)
9:33 PM: Found Spy Cookie: did-it cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@atdmt[2].txt (ID = 2253)
9:33 PM: Found Spy Cookie: atlas dmt cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@zedo[1].txt (ID = 3762)
9:33 PM: Found Spy Cookie: zedo cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@phoenix.about[1].txt (ID = 2038)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@go2net[1].txt (ID = 2730)
9:33 PM: Found Spy Cookie: go2net.com cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@www.affiliatefuel[2].txt (ID = 2202)
9:33 PM: Found Spy Cookie: affiliatefuel.com cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@register.go[1].txt (ID = 2729)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@rightmedia[1].txt (ID = 3259)
9:33 PM: Found Spy Cookie: rightmedia cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@m.webtrends[1].txt (ID = 3669)
9:33 PM: Found Spy Cookie: webtrends cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@a[1].txt (ID = 2027)
9:33 PM: Found Spy Cookie: a cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@servlet[1].txt (ID = 3345)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@go[2].txt (ID = 2728)
9:33 PM: Found Spy Cookie: go.com cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@l2m[1].txt (ID = 2913)
9:33 PM: Found Spy Cookie: l2m.net cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@dist.belnk[1].txt (ID = 2293)
9:33 PM: Found Spy Cookie: belnk cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@gamespy[1].txt (ID = 2719)
9:33 PM: Found Spy Cookie: gamespy cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@ct.360i[1].txt (ID = 1962)
9:33 PM: Found Spy Cookie: 360i cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@servlet[2].txt (ID = 3345)
9:33 PM: Found Spy Cookie: servlet cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@iq.kount[1].txt (ID = 2912)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@c3.gostats[1].txt (ID = 2748)
9:33 PM: Found Spy Cookie: gostats cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@adrevolver[1].txt (ID = 2088)
9:33 PM: Found Spy Cookie: adrevolver cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@toplist[1].txt (ID = 3557)
9:33 PM: Found Spy Cookie: toplist cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@bbq.about[2].txt (ID = 2038)
9:33 PM: Found Spy Cookie: about cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@msnportal.112.2o7[1].txt (ID = 1958)
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@kount[2].txt (ID = 2911)
9:33 PM: Found Spy Cookie: kount cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@nextag[1].txt (ID = 5014)
9:33 PM: Found Spy Cookie: nextag cookie
9:33 PM: c:\documents and settings\helfrich\cookies\helfrich@2o7[1].txt (ID = 1957)
9:33 PM: Found Spy Cookie: 2o7.net cookie
9:33 PM: Starting Cookie Sweep
9:33 PM: Registry Sweep Complete, Elapsed Time:00:00:25
9:33 PM: Starting Registry Sweep
9:33 PM: Memory Sweep Complete, Elapsed Time: 00:02:25
9:30 PM: Starting Memory Sweep
9:30 PM: Start Custom Sweep
9:30 PM: Sweep initiated using definitions version 845
9:28 PM: None
9:28 PM: Traces Found: 0
9:28 PM: Sweep Canceled
9:28 PM: Start Full Sweep
9:28 PM: Sweep initiated using definitions version 845
9:24 PM: Your definitions are up to date.
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: Off
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
9:24 PM: Shield States
9:24 PM: Spyware Definitions: 845
9:23 PM: Spy Sweeper 5.3.1.2344 started
9:23 PM: Spy Sweeper 5.3.1.2344 started
9:23 PM: | Start of Session, Tuesday, February 06, 2007 |
***************
Thanks for the help.
teacup61
2007-02-07, 13:43
Hello,
Are you still getting the error? What version os Spybot are you running? You should have Spybot - Search & Destroy version: 1.4. If not, then please update to this version, then let me know if the error still happens. :)
Regards,
tea
Hello,
Are you still getting the error? What version os Spybot are you running? You should have Spybot - Search & Destroy version: 1.4. If not, then please update to this version, then let me know if the error still happens. :)
Regards,
tea
I was running version 1.3 and still getting the error. I downloaded version 1.4
and ran it after updating and recieved no error message! Thank you very much for the time and help in resolving this I really appreciate it!
emjh95.
teacup61
2007-02-08, 00:23
You're most welcome. :)
http://mvps.org/winhelp2002/unwanted.htm
Take care!
tea