View Full Version : Multiple trojans and virus again!
citywomanpg
2008-01-28, 15:25
Hi,
I'd been helped, with success, in this forum before and now seem to have become re-infected by multiple virus and trojans!
My warning was when Norton caught one trojan. I ran the Norton scan which quarantined several trojans and viruses, then Spybot (though not in safe mode) which cleared several items.
After these events is when I ran Kaspersky and Hijackthis with the logs posted below.
Please help!!
Citywomanpg
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:26:07 PM, on 1/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\tp4serv.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\AEIWLSTA.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\citywomanpg.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.continental.att.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: CCHelper Class - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Program Files\Panicware\Pop-Up Stopper\CCHelper.dll
O2 - BHO: (no name) - {1357DF32-2919-4940-829C-8351F3FC9E71} - (no file)
O2 - BHO: (no name) - {29bff808-ea66-4271-8cc8-e88ec578a3c0} - (no file)
O2 - BHO: (no name) - {36C3C907-6601-4D81-9941-18536FF6F333} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - (no file)
O2 - BHO: (no name) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O2 - BHO: (no name) - {902D12F5-5C38-4FF4-B502-046BF76F964F} - (no file)
O2 - BHO: (no name) - {98EC3C07-82E6-AE41-BB29-F88A36F17FC2} - (no file)
O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)
O2 - BHO: (no name) - {DFF0EC50-5078-48C0-B1C6-B59FFB79F878} - (no file)
O2 - BHO: (no name) - {E695B13B-F73F-43BE-8AD6-3538A6B7C13E} - (no file)
O2 - BHO: (no name) - {FC740BEF-E8CB-4723-A61E-55156285E421} - (no file)
O3 - Toolbar: Pa&nicware Pop-Up Stopper - {7E82235C-F31E-46CB-AF9F-1ADD94C585FF} - C:\Program Files\Panicware\Pop-Up Stopper\pstopper.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\StorageGuard\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [AEIWLSTA.EXE] AEIWLSTA.EXE START
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk.disabled
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Update ThinkPad Software - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {8FD68625-2346-418A-8899-67CB36B1917F} -
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} -
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) -
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://akonix.webex.com/client/T23L/webex/ieatgpc.cab
O16 - DPF: {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} (acpRunner Class) - https://www-307.ibm.com/pc/support/access/aslibmain/content/AcpControl.cab
O16 - DPF: {E6EB803E-DD89-11D3-80C4-0050DA2E09D0} -
O16 - DPF: {F545C0D0-4327-48FF-B27F-2AFE254E4FF2} (ActiveFrame Object) - http://icu.riverstyx.net/icumediacontrol.cab?
O16 - DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} (AMI DicomDir TreeView Control 2.1) - file://D:\CDVIEWER\CdViewer.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: hggghhg - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
--
End of file - 9887 bytes
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, January 28, 2008 8:07:10 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 28/01/2008
Kaspersky Anti-Virus database records: 534402
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
E:\
Scan Statistics:
Total number of scanned objects: 103831
Number of viruses found: 9
Number of infected objects: 12
Number of suspicious objects: 0
Duration of the scan process: 02:37:07
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\09E40000.VBN Infected: not-a-virus:AdWare.Win32.Insider.a skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\09E40004.VBN Infected: Trojan-Downloader.Win32.Agent.fjn skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\09E40006.VBN Infected: Trojan.Win32.Agent.cmn skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\09E40008.VBN Infected: Trojan-Downloader.Win32.Agent.emo skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\09E4000C.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.agh skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\09E40010.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.agh skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\cert8.db Object is locked skipped
C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\history.dat Object is locked skipped
C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\key3.db Object is locked skipped
C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\parent.lock Object is locked skipped
C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\search.sqlite Object is locked skipped
C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\user\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\user\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Temp\hsperfdata_user\3440 Object is locked skipped
C:\Documents and Settings\user\Local Settings\Temp\WCESCOMM.LOG Object is locked skipped
C:\Documents and Settings\user\Local Settings\Temp\~DFF4C3.tmp Object is locked skipped
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\user\ntuser.dat Object is locked skipped
C:\Documents and Settings\user\ntuser.dat.LOG Object is locked skipped
C:\qoobox\Quarantine\C\Documents and Settings\user\Application Data\FNTS~1\nοpdb.exe.vir Infected: not-a-virus:AdWare.Win32.PurityScan.gj skipped
C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir NSIS: infected - 3 skipped
C:\qoobox\Quarantine\C\WINDOWS\b122.exe.vir Infected: Trojan-Downloader.Win32.Agent.erf skipped
C:\System Volume Information\_restore{79AAA868-417C-43DB-A56F-64DCD4ED93E8}\RP35\change.log Object is locked skipped
C:\WINDOWS\$_hpcst$.hpc Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\pfirewall.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{0B6A668C-2267-41C6-A04D-C36414723E5B}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_960.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
Hello and welcome to the forums
My name is Katana and I will be helping you to remove any infection(s) that you may have.
Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)
If you can do those three things, everything should go smoothly :D
Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.
Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed.
There is no active malware showing in your log, are you having any problems other than the security warings ?
Disable Teatimer
First step: Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
If you have Version 1.4, Click on Exit Spybot S&D Resident Second step, For Either Version : Open Spybot S&D
Click Mode, choose Advanced Mode
Go To the bottom of the Vertical Panel on the Left, Click Tools
then, also in left panel, click Resident shows a red/white shield.
If your firewall raises a question, say OK
In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.
Fix With HJT
Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.continental.att.net
O2 - BHO: (no name) - {1357DF32-2919-4940-829C-8351F3FC9E71} - (no file)
O2 - BHO: (no name) - {29bff808-ea66-4271-8cc8-e88ec578a3c0} - (no file)
O2 - BHO: (no name) - {36C3C907-6601-4D81-9941-18536FF6F333} - (no file)
O2 - BHO: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - (no file)
O2 - BHO: (no name) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O2 - BHO: (no name) - {902D12F5-5C38-4FF4-B502-046BF76F964F} - (no file)
O2 - BHO: (no name) - {98EC3C07-82E6-AE41-BB29-F88A36F17FC2} - (no file)
O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)
O2 - BHO: (no name) - {DFF0EC50-5078-48C0-B1C6-B59FFB79F878} - (no file)
O2 - BHO: (no name) - {E695B13B-F73F-43BE-8AD6-3538A6B7C13E} - (no file)
O2 - BHO: (no name) - {FC740BEF-E8CB-4723-A61E-55156285E421} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {8FD68625-2346-418A-8899-67CB36B1917F} -
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} -
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) -
O16 - DPF: {E6EB803E-DD89-11D3-80C4-0050DA2E09D0} -
O20 - Winlogon Notify: hggghhg - C:\WINDOWS\
- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis
Installed Programs
Please could you give me a list of the programs that are installed.
Start HijackThis
Click on the Config button
Click on the Misc Tools button
Click on the Open Uninstall Manager button.
You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.
Please post the installed programs list with a fresh HJT log in your reply.
citywomanpg
2008-01-30, 22:46
Hello Katana,
Thank you for assisting me. Ever since I got the warnings, I've become afraid to use my computer because of how badly I was infected the last time (Shaba helped me clear the malware that time in Nov, 2007). It took over a week to clear everything out, with the time difference in communicating, etc.!
That time I'd downloaded a program from a fileshare site (I know, not a good idea). I learned my lesson and have gone only to legitimate websites/ businesses. The only difference is that I attached and accessed some files on an external hard drive I have. Could I have gotten infected by something on that drive? I forgot to include it in the original Kaspersky scan. Should I scan that using Kaspersky and post that also?
Citywoman.
--------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:28:23 PM, on 1/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\tp4serv.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\system32\AEIWLSTA.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: CCHelper Class - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Program Files\Panicware\Pop-Up Stopper\CCHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper - {7E82235C-F31E-46CB-AF9F-1ADD94C585FF} - C:\Program Files\Panicware\Pop-Up Stopper\pstopper.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\StorageGuard\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [AEIWLSTA.EXE] AEIWLSTA.EXE START
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk.disabled
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Update ThinkPad Software - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://akonix.webex.com/client/T23L/webex/ieatgpc.cab
O16 - DPF: {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} (acpRunner Class) - https://www-307.ibm.com/pc/support/access/aslibmain/content/AcpControl.cab
O16 - DPF: {F545C0D0-4327-48FF-B27F-2AFE254E4FF2} (ActiveFrame Object) - http://icu.riverstyx.net/icumediacontrol.cab?
O16 - DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} (AMI DicomDir TreeView Control 2.1) - file://D:\CDVIEWER\CdViewer.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
--
End of file - 7739 bytes
List of Installed programs
Access ThinkPad
Adobe Common File Installer
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Help Center 1.0
Adobe Image Viewer Plugin 4.0
Adobe Photoshop CS2
Adobe Reader 8.1.1
Adobe Shockwave Player
Adobe Stock Photos 1.0
Agere Systems AC'97 Modem
ArcSoft Camera Suite 1.3
ATI Control Panel
ATI Display Driver
Better Homes and Gardens Home Designer Suite 6.0
BlueSoleil
C:\PROGRA~1\LEXMAR~1
Canon Camera Support Core Library
Canon Camera Window for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon Utilities ZoomBrowser EX
COMODO Firewall Pro
DivX
DivX Player
FinePixViewer Ver.4.0
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB926239)
HP Customer Participation Program 7.0
HP Imaging Device Functions 7.0
hp instant support
HP Officejet Pro All-In-One Series
HP Photo Printing Software
HP Photosmart Essential
hp psc 900 series
HP Share-to-Web
HP Solution Center 7.0
HP Update
IBM Access Connections
IBM DLA
IBM High Rate Wireless LAN MiniPCI Combo Card
IBM RecordNow
IBM ThinkPad Access Support
IBM ThinkPad Battery MaxiMiser and Power Management Features
IBM ThinkPad Configuration
IBM ThinkPad EasyEject Utility
IBM ThinkPad Keyboard Customizer Utility
IBM ThinkPad Power Management Driver
IBM ThinkPad Presentation Director
IBM TrackPoint Accessibility Features
IBM TrackPoint Support
IBM Update Connector
ImageMixer VCD for FinePix
Intel(R) PRO Ethernet Adapter and Software
InterVideo WinDVD
J2SE Runtime Environment 5.0 Update 1
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) SE Runtime Environment 6 Update 1
Kaspersky Online Scanner
LiveUpdate 1.80 (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft ActiveSync 3.5
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Office Live Meeting 2005 Replay Wrapper
Microsoft Office XP Professional
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (2.0.0.11)
MPM
MSN Music Assistant
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
OCR Software by I.R.I.S 7.0
Panicware Pop-Up Stopper
PCmover
PrimoPDF
QuickBooks Product Listing Service
QuickBooks Simple Start Free Starter Edition
QuickTime
RealPlayer
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926247)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB944653)
Series 7
Skype 3.0
Skype Plugin Manager
SoundMAX
Spybot - Search & Destroy 1.3
Support.com Software
SupportSoft Assisted Service
Symantec AntiVirus Client
TaxCut Premium 2006
ThinkPad FullScreen Magnifier
ThinkPad Software Installer
Uninstall PC-Doctor
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
VERITAS StorageGuard
WavePad Uninstall
WebEx
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Support Tools
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinRAR archiver
WinZip
Yahoo! Messenger
It is possible that the external drive was infected, connect it and then do the following
Spybot has been updated, so you need to install the latest version when we are finished
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
Updating Java:
Download the latest version of Java Runtime Environment (JRE) 6u4
http://java.sun.com/javase/downloads/index.jsp
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check for any item with Java Runtime Environment (JRE or J2SE) in the name.
J2SE Runtime Environment 5.0 Update 1
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) SE Runtime Environment 6 Update 1
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.
Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
TotalScan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
Please go to this site Link >> TotalScan (http://www.nanoscan.com/as/v1/?) << LINK
Under Scan Now click the Full Scan button
Follow the prompts to install the Active X if necessary
Go and make a cup of tea/coffee/beverage of your choice and watch some TV :)
When the scan is finished, a report will be generated
Next to Scan Details click the small Save button and save the report to your desktop.
Please post the report in your reply.
Please post both logs in reply
citywomanpg
2008-01-31, 13:50
Hi Katana,
That total scan allowed for a lot more time than for a cup of tea! :)
I'll have to post the logs you requested in multiple postings, as they're too long to put in one post....
Citywoman
ComboFix 08-01-31.1 - user 2008-01-30 20:14:01.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.446 [GMT -5:00]
Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\user\g2mdlhlpx.exe
C:\WINDOWS\system32\ddpfvhji.ini
C:\WINDOWS\system32\gevqbofp.ini
C:\WINDOWS\system32\kyyshman.ini
C:\WINDOWS\system32\mcrh.tmp
.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-31 )))))))))))))))))))))))))))))))
.
2008-01-30 20:13 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-01-30 20:13 . 2007-11-07 10:19 212 --a------ C:\Boot.bak
2008-01-30 19:10 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-30 19:09 . 2008-01-30 19:10 <DIR> d-------- C:\Program Files\Java
2008-01-30 19:08 . 2008-01-30 19:08 <DIR> d-------- C:\Program Files\Common Files\Java
2007-12-04 11:03 . 2007-12-04 11:03 <DIR> d-------- C:\Program Files\Citrix
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 23:59 --------- d-----w C:\Program Files\PC-Doctor for Windows
2008-01-28 15:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-28 15:32 --------- d-----w C:\Documents and Settings\user\Application Data\Lavasoft
2008-01-09 21:49 --------- d-----w C:\Documents and Settings\user\Application Data\Skype
2008-01-04 19:42 --------- d-----w C:\Documents and Settings\user\Application Data\RecordNow
2007-12-24 14:33 --------- d-----w C:\Program Files\Common Files\AnswerWorks 4.0
2007-12-08 18:24 --------- d-----w C:\Program Files\TechSmith
2007-12-06 16:31 --------- d-----w C:\Documents and Settings\user\Application Data\Image Zone Express
2007-11-07 13:36 83,208 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-10-30 22:40 28,672 ----a-w C:\Documents and Settings\user\update.exe
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 03:53 147,456 ----a-w C:\WINDOWS\system32\vbzip10.dll
2007-10-27 22:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-11 06:13 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-04-14 12:28 38,968 ----a-w C:\Documents and Settings\user\Application Data\GDIPFONTCACHEV1.DAT
2001-08-18 13:00 94,784 -csh--w C:\WINDOWS\twain.dll
2004-08-04 07:56 50,688 --sh--w C:\WINDOWS\twain_32.dll
2004-08-04 07:56 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2004-08-04 07:56 54,784 --sh--w C:\WINDOWS\system32\msvcirt.dll
2004-08-04 07:56 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-04 07:56 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2007-05-17 11:28 549,376 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-04 07:56 83,456 --sh--w C:\WINDOWS\system32\olepro32.dll
2004-08-04 07:56 11,776 --sh--w C:\WINDOWS\system32\regsvr32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2001-06-25 21:23 401493]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-06-12 16:03 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"TrackPointSrv"="tp4serv.exe" [2004-10-28 03:50 94208 C:\WINDOWS\system32\tp4serv.exe]
"TPHOTKEY"="C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2004-11-17 00:48 94208]
"UC_SMB"="" []
"StorageGuard"="C:\Program Files\VERITAS Software\StorageGuard\sgtray.exe" [2002-02-28 04:00 155648]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2002-03-14 06:25 102455]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-01 21:10 335872]
"AGRSMMSG"="AGRSMMSG.exe" [2003-06-27 08:53 88363 C:\WINDOWS\AGRSMMSG.exe]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11 57344]
"BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2004-08-25 01:37 110592]
"BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [2004-08-25 01:37 20480]
"BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2004-08-25 01:37 395776]
"QCWLICON"="C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2005-02-01 03:07 86016]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2004-11-24 02:10 212992]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2004-02-04 18:39 897024]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2002-06-27 02:47 36864]
"AEIWLSTA.EXE"="AEIWLSTA.exe" [2002-05-13 14:17 214016 C:\WINDOWS\system32\AEIWLSTA.exe]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 15:24 54840]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"TP4EX"="tp4ex.exe" [2004-11-12 01:07 40960 C:\WINDOWS\system32\TP4EX.exe]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-05-21 00:21 90112]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-11-07 10:19 1115728]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk.disabled [2007-07-19 14:33:21 1593]
Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [2007-04-18 13:54:43 200704]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2007-11-09 17:13:18 972064]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
QConGina.dll 2005-02-01 03:07 262144 C:\WINDOWS\system32\QConGina.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2004-08-12 20:11 24576 C:\WINDOWS\system32\tphklock.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"tgcmd"=C:\Program Files\Support.com\bin\tgcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Lexmark X83 Button Monitor"=C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
"Tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe /server"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"Host Process"=C:\WINDOWS\Fonts\svchost.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"Lexmark X83 Button Manager"=C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-02-01 03:07]
R1 DSMBATT;DSMBATT;C:\WINDOWS\system32\drivers\DSMBATT.SYS [2002-04-04 16:00]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\drivers\IBMBLDID.SYS [2005-02-01 03:07]
R1 TPPWR;TPPWR;C:\WINDOWS\system32\drivers\Tppwr.sys [2004-08-25 01:37]
R3 AEIWL;IBM High Rate Wireless LAN MiniPCI Combo Card Driver;C:\WINDOWS\system32\DRIVERS\AEIWLNDS.sys [2002-05-13 14:09]
R3 Tp4Track;IBM PS/2 TrackPoint Driver;C:\WINDOWS\system32\DRIVERS\tp4track.sys [2004-10-28 03:50]
S3 AR5523;NETGEAR WG111T USB2.0 Wireless Card Service;C:\WINDOWS\system32\DRIVERS\wg11tnd5.sys []
S3 ATHFMWDL;NETGEAR WG111T Bootloader driver;C:\WINDOWS\system32\Drivers\ATHFMWDL.sys []
S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 15:32]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\DNINDIS5.SYS [2003-07-24 12:10]
S3 QCNDISIF;QCNDISIF;C:\WINDOWS\system32\drivers\qcndisif.SYS [2005-02-01 03:07]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
"2008-01-31 00:30:12 C:\WINDOWS\Tasks\BMMTask.job"
- C:\PROGRA~1\ThinkPad\UTILIT~1\BMMTASK.EXE
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-30 20:17:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tphklock.dll
-> C:\WINDOWS\system32\NavLogon.dll
.
Completion time: 2008-01-30 20:18:34
ComboFix-quarantined-files.txt 2008-01-31 01:17:55
ComboFix2.txt 2007-11-06 16:45:04
ComboFix3.txt 2007-11-06 15:43:49
.
2007-12-27 06:00:01 --- E O F ---
------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:38:35 PM, on 1/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\tp4serv.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\AEIWLSTA.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Comodo\Firewall\cpf.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: CCHelper Class - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Program Files\Panicware\Pop-Up Stopper\CCHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper - {7E82235C-F31E-46CB-AF9F-1ADD94C585FF} - C:\Program Files\Panicware\Pop-Up Stopper\pstopper.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\StorageGuard\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [AEIWLSTA.EXE] AEIWLSTA.EXE START
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk.disabled
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Update ThinkPad Software - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://akonix.webex.com/client/T23L/webex/ieatgpc.cab
O16 - DPF: {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} (acpRunner Class) - https://www-307.ibm.com/pc/support/access/aslibmain/content/AcpControl.cab
O16 - DPF: {F545C0D0-4327-48FF-B27F-2AFE254E4FF2} (ActiveFrame Object) - http://icu.riverstyx.net/icumediacontrol.cab?
O16 - DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} (AMI DicomDir TreeView Control 2.1) - file://D:\CDVIEWER\CdViewer.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
--
End of file - 8299 bytes
citywomanpg
2008-01-31, 13:56
Katana,
I'll have to post the TotalScan results in 4 posts, as the file is around 69k characters. This is post 1 of 4....
On another note, did you want me to re-enable the TeaTimer in Spybot yet?
Citywoman
;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-01-31 06:37:58
PROTECTIONS: 2
MALWARE: 80
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Symantec Antivirus Corporate Edition 8.0 No Yes
Norton Antivirus Edition 7.5 No No
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00020942 adware/exact.bargainbuddy Adware No 0 Yes No c:\windows\launcher.exe
00029258 application/altnet HackTools No 0 Yes No hkey_classes_root\appid\adm.exe
00029258 application/altnet HackTools No 0 Yes No hkey_local_machine\software\classes\appid\altnet signing module.exe
00029258 application/altnet HackTools No 0 Yes No hkey_local_machine\software\classes\appid\adm.exe
00029258 application/altnet HackTools No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\altnetdm
00029457 adware/toprebates Adware No 0 Yes No c:\program files\websavingsfromebates
00039204 adware/cws Adware No 0 Yes No c:\documents and settings\user\favorites\health
00041446 application/myway HackTools No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}
00041446 application/myway HackTools No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}
00041446 application/myway HackTools No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{66FC8717-EFA7-4546-8C4A-E224F3A80C76}
00041446 application/myway HackTools No 0 Yes No hkey_classes_root\clsid\{66fc8717-efa7-4546-8c4a-e224f3a80c76}
00090908 Exploit/ByteVerify HackTools No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-18f08ee7-6e57549e.zip[Gummy.class]
00090908 Exploit/ByteVerify HackTools No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-18f08ee7-6e57549e.zip[Gummy.class]
00096188 spyware/searchcentrix Spyware No 1 Yes No hkey_current_user\software\dynamic toolbar
00103551 adware/windowenhancer Adware No 0 Yes No c:\windows\system32\sbutils
00116361 Spyware/Support Spyware No 0 Yes No C:\System Volume Information\_restore{79AAA868-417C-43DB-A56F-64DCD4ED93E8}\RP46\A0003343.exe
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@trafficmp[1].txt
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.casalemedia.com/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@doubleclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.doubleclick.net/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.doubleclick.net/]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.atdmt.com/]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.atdmt.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@247realmedia[1].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\f8gk1wu7.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\f8gk1wu7.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@247realmedia[2].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\f8gk1wu7.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.247realmedia.com/]
00145433 Cookie/Mammamediasolutions TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.targetnet.com/]
00145433 Cookie/Mammamediasolutions TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.targetnet.com/]
00145453 Cookie/Bfast TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bfast.com/]
00145453 Cookie/Bfast TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bfast.com/]
00145453 Cookie/Bfast TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bfast.com/]
00145453 Cookie/Bfast TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bfast.com/]
00145453 Cookie/Bfast TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bfast.com/]
00145453 Cookie/Bfast TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bfast.com/]
00145453 Cookie/Bfast TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bfast.com/]
00145453 Cookie/Bfast TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bfast.com/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
citywomanpg
2008-01-31, 13:59
This is post 2 of 4 for the TotalScan...
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.fastclick.net/]
00145466 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[servedby.advertising.com/]
00145466 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[servedby.advertising.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.tribalfusion.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[2].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@tribalfusion[2].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.tribalfusion.com/]
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.mediaplex.com/]
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.mediaplex.com/]
00145770 Cookie/CentrPort TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.centrport.net/]
00145770 Cookie/CentrPort TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.centrport.net/]
00145770 Cookie/CentrPort TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@centrport[1].txt
00145770 Cookie/CentrPort TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.centrport.net/]
00145770 Cookie/CentrPort TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.centrport.net/]
00145770 Cookie/CentrPort TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@centrport[2].txt
00146967 Cookie/PayCounter TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@paycounter[1].txt
00147805 Cookie/Abcsearch TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.abcsearch.com/]
00147805 Cookie/Abcsearch TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.abcsearch.com/]
00147805 Cookie/Abcsearch TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.abcsearch.com/]
00147805 Cookie/Abcsearch TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.abcsearch.com/]
00147805 Cookie/Abcsearch TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@abcsearch[1].txt
00149064 Cookie/Maxserving TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.maxserving.com/]
00149064 Cookie/Maxserving TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.maxserving.com/]
00149064 Cookie/Maxserving TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.maxserving.com/]
00149064 Cookie/Maxserving TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.maxserving.com/]
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@ccbill[2].txt
00152401 Cookie/Belnk TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@belnk[1].txt
00152401 Cookie/Belnk TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.belnk.com/]
00152401 Cookie/Belnk TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.belnk.com/]
00159564 Cookie/WUpd TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.revenue.net/]
00159564 Cookie/WUpd TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.revenue.net/]
00159564 Cookie/WUpd TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@revenue[2].txt
00162730 Cookie/Belnk TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@dist.belnk[2].txt
00162900 Cookie/MediaTickets TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@kinghost[2].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@com[1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.com.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.com.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@com[2].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.com.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.com.com/]
00167659 Cookie/TeensForCash TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@teensforcash[1].txt
00167672 Cookie/DomainSponsor TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[landing.domainsponsor.com/]
00167672 Cookie/DomainSponsor TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@landing.domainsponsor[1].txt
00167672 Cookie/DomainSponsor TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[landing.domainsponsor.com/]
00167677 Cookie/WebPower TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@webpower[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@xiti[1].txt
00167733 Cookie/Adserver TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.z1.adserver.com/]
00167733 Cookie/Adserver TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.z1.adserver.com/]
00167733 Cookie/Adserver TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@z1.adserver[1].txt
00167733 Cookie/Adserver TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.z1.adserver.com/]
00167733 Cookie/Adserver TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.z1.adserver.com/]
00167749 Cookie/Toplist TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@toplist[1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.statcounter.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.statcounter.com/]
00167767 Cookie/WegCash TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@programs.wegcash[2].txt
00168048 Cookie/Overture TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.perf.overture.com/]
00168048 Cookie/Overture TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@perf.overture[1].txt
00168048 Cookie/Overture TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@perf.overture[1].txt
00168048 Cookie/Overture TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.perf.overture.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@ad.yieldmanager[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[ad.yieldmanager.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.apmebf.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.apmebf.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.apmebf.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.apmebf.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
citywomanpg
2008-01-31, 14:00
This is post 3 of 4 of the TotalScan....
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.serving-sys.com/]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bs.serving-sys.com/]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bs.serving-sys.com/]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[bs.serving-sys.com/]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[bs.serving-sys.com/]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@bs.serving-sys[1].txt
00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@www.burstbeacon[1].txt
00168101 Cookie/Falkag TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.as-us.falkag.net/]
00168101 Cookie/Falkag TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.as-us.falkag.net/]
00168101 Cookie/Falkag TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@as-us.falkag[2].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.adtech.de/]
00168109 Cookie/Adtech TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@adtech[2].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.adtech.de/]
00168109 Cookie/Adtech TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.adtech.de/]
00168109 Cookie/Adtech TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.adtech.de/]
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[server.iad.liveperson.net/hc/33645339]
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@server.iad.liveperson[2].txt
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[server.iad.liveperson.net/hc/LPintranets_busdev]
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[server.iad.liveperson.net/hc/70365536]
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[server.iad.liveperson.net/]
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[server.iad.liveperson.net/hc/33645339]
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[server.iad.liveperson.net/]
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[server.iad.liveperson.net/hc/LPintranets_busdev]
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[server.iad.liveperson.net/hc/70365536]
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@stat.onestat[2].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.advertising.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@ads.pointroll[2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\user\Cookies\user@ads.pointroll[1].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@ads.pointroll[1].txt
00170535 Cookie/GoClick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@c.goclick[1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@overture[1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.overture.com/]
00170554 Cookie/Overture TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.overture.com/]
00170554 Cookie/Overture TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.overture.com/]
00170554 Cookie/Overture TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.overture.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@realmedia[2].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@realmedia[1].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.realmedia.com/]
00171718 Cookie/Enhance TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[c.enhance.com/]
00171718 Cookie/Enhance TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[c.enhance.com/]
00171718 Cookie/Enhance TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@c.enhance[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@questionmarket[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.questionmarket.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.zedo.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.zedo.com/]
citywomanpg
2008-01-31, 14:04
This is the last post, 4 of 4, of the TotalScan ...
00172221 Cookie/Zedo TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.zedo.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@zedo[2].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.zedo.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.zedo.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.zedo.com/]
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@bluestreak[2].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bluestreak.com/]
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.bluestreak.com/]
00175950 Cookie/cs.sexcounter TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@cs.sexcounter[2].txt
00179779 Cookie/Errorguard TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.errorguard.com/]
00179779 Cookie/Errorguard TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.errorguard.com/]
00180246 Cookie/XXXCounter TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@xxxcounter[1].txt
00187950 Cookie/bravenetA TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@bravenet[1].txt
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@adultfriendfinder[2].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.go.com/]
00194327 Cookie/Go TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.go.com/]
00199983 Cookie/Valueclick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.valueclick.com/]
00199983 Cookie/Valueclick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.valueclick.com/]
00199983 Cookie/Valueclick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.valueclick.com/]
00199983 Cookie/Valueclick TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.valueclick.com/]
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@searchportal.information[1].txt
00207712 Cookie/360i TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@ct.360i[1].txt
00207862 Cookie/did-it TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.did-it.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.did-it.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.did-it.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.did-it.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@did-it[1].txt
00207862 Cookie/did-it TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.did-it.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@did-it[1].txt
00207862 Cookie/did-it TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.did-it.com/]
00207936 Cookie/Adviva TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.adviva.net/]
00207936 Cookie/Adviva TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.adviva.net/]
00211158 application/bestoffer HackTools No 0 Yes No c:\windows\smdat32m.sys
00250251 Adware/ISearch Adware No 0 No No C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir[MTE3MTk6ODoxNg.exe]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR13\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.atwola.com/]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@atwola[1].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE\DIR14\Mozilla\Firefox\Profiles\yu7j7aao.default\cookies.txt[.atwola.com/]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\user\Application Data\Mozilla\Profiles\default\up5r2t7c.slt\cookies.txt[.atwola.com/]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@atwola[1].txt
00286738 Cookie/Cgi-bin TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@cgi-bin[8].txt
00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@ads.addynamix[1].txt
00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@ads.addynamix[2].txt
00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - deleted recovery\LOSTFILE\DIR6\naggarwal@citi.bridgetrack[1].txt
00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No F:\Documents and Settings\Administrator\Cookies\administrator@citi.bridgetrack[1].txt
00392623 Adware/ActiveSearch Adware No 0 No No C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir[²ÜÇ\Services.dll]
00463502 Generic Trojan Virus/Trojan No 0 Yes No C:\qoobox\Quarantine\C\WINDOWS\b104.exe.vir
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{79AAA868-417C-43DB-A56F-64DCD4ED93E8}\RP48\A0004228.EXE
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{79AAA868-417C-43DB-A56F-64DCD4ED93E8}\RP47\A0004158.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{79AAA868-417C-43DB-A56F-64DCD4ED93E8}\RP48\A0004216.com
01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\user\Desktop\ComboFix.exe[327882R2FWJFW\nircmd.com]
01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\user\Desktop\ComboFix.exe[327882R2FWJFW\nircmd.cfexe]
01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\Cache\6D952C06d01[327882R2FWJFW\nircmd.com]
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{79AAA868-417C-43DB-A56F-64DCD4ED93E8}\RP48\A0004231.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{79AAA868-417C-43DB-A56F-64DCD4ED93E8}\RP48\A0004258.com
01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\e7o1qgck.default\Cache\6D952C06d01[327882R2FWJFW\nircmd.cfexe]
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\WINDOWS\Nircmd.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{79AAA868-417C-43DB-A56F-64DCD4ED93E8}\RP47\A0004183.com
02663232 Adware/PurityScan Adware No 0 Yes No C:\qoobox\Quarantine\C\Documents and Settings\user\Application Data\FNTS~1\nοpdb.exe.vir
02673158 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\qoobox\Quarantine\C\WINDOWS\b122.exe.vir
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================
citywomanpg
2008-01-31, 14:28
Katana,
I forgot to ask about re-enabling my Norton realtime protection also. I assume you'd want me to keep the computer protected, so I've re-enabled Norton, but am waiting for your direction on re-enabling Teatimer in Spybot.
Thanks,
Citywomanpg
I'm just going through that log, I will post some more info shortly.
Norton is fine,
Don't start Teatimer until I tell you, it will only add the bad lines back
That total scan allowed for a lot more time than for a cup
Yeah it does take a while, but it is very good :)
There appear to be some infected items in
F:\Active\Mail\Naveen\Jan 23 recovery\recover Jan23 - advanced recovery\LOSTFILE
It may be easier if you delete the entire folder if you can
Custom CFScript
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
File::
c:\windows\smdat32m.sys
c:\windows\launcher.exe
Folder::
c:\program files\websavingsfromebates
c:\documents and settings\user\favorites\health
c:\windows\system32\sbutils
Driver::
AR5523
ATHFMWDL
Registry::
[-HKEY_classes_root\appid\adm.exe]
[-HKEY_local_machine\software\classes\appid\altnet signing module.exe]
[-HKEY_local_machine\software\classes\appid\adm.exe]
[-HKEY_local_machine\software\microsoft\windows\currentversion\app management\arpcache\altnetdm]
[-HKEY_classes_root\clsid\{66fc8717-efa7-4546-8c4a-e224f3a80c76}]
[-HKEY_current_user\software\dynamic toolbar]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}]
[-HKEY_LOCAL_MACHINE\software\classes\CLSID\{66FC8717-EFA7-4546-8C4A-E224F3A80C76}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UC_SMB"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Host Process"=-
Save this as CFScript.txt and place it on your desktop.
http://i51.photobucket.com/albums/f387/Katana_1970/CFScript.gif
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
How are things now ?
citywomanpg
2008-01-31, 16:17
Hi Katana,
Deleting the folder you suggested may not work, as that's my husband's archived data from a previous job. What would I have to do to delete the specific files - can I do that or do I have to delete the folder?
I've pasted the Combofix log below. On a related note, I need some guidance on 2 points:
1) I get some Comodo prompts for applications that I'm not sure I should allow/ disallow. The Firefox one appeared as I restarted Firefox after ComboFix had finished running. Examples are below (I hope you can see them. I obtained them by doing a printScr of the Comodo prompt, saving that in a Word doc and then copying and pasting the picture in this posting:
file:///C:/DOCUME%7E1/user/LOCALS%7E1/Temp/msohtml1/02/clip_image002.jpg
file:///C:/DOCUME%7E1/user/LOCALS%7E1/Temp/msohtml1/03/clip_image002.jpg
file:///C:/DOCUME%7E1/user/LOCALS%7E1/Temp/msohtml1/04/clip_image002.jpg
2) I've had ComboFix somehow become infected on my machine. I'd downloaded it when I'd been helped by this forum in Nov'07. One of the events that prompted my logging back into this forum for help was the fact that Norton caught a trojan in ComboFix. I'm concerned about how this may have happened and about it happening again in the future! I've pasted the relevant lines from Norton's log below:
1/27/2008 17:25 ComboFix.exe Trojan Horse File Left alone in Quarantine C:\Documents and Settings\user\Desktop\ Infected Quarantine Clean virus from file Leave alone (log only) Defwatch Scan 1/27/2008 16:45 ComboFix.exe Trojan Horse File Quarantined C:\Documents and Settings\user\Desktop\ Infected Quarantine Clean virus from file Quarantine infected file Realtime scan
Here's the latest ComboFix log per your direction.
As always, thank you for your help...
Citywoman
-------------------------
ComboFix 08-01-31.1 - user 2008-01-31 8:26:23.4 - NTFSx86
Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\Desktop\CFScript.txt
* Created a new restore point
FILE
c:\windows\launcher.exe
c:\windows\smdat32m.sys
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\user\favorites\health
c:\documents and settings\user\favorites\health\BeautyCare\Alopecia, baldness and hair loss - some free home-made remedies with essential oils..url
c:\documents and settings\user\favorites\health\BeautyCare\Aromatherapy - Nature's Nutrition Store.url
c:\documents and settings\user\favorites\health\BeautyCare\Easy Home Made Lotion.url
c:\documents and settings\user\favorites\health\BeautyCare\Essential oils by Esoteric Oils (Pty) Ltd..url
c:\documents and settings\user\favorites\health\BeautyCare\Home-made Facial Toners (also known as tonics and astringents)..url
c:\documents and settings\user\favorites\health\BeautyCare\Home made creams and skincare products..url
c:\documents and settings\user\favorites\health\BeautyCare\Murad - Acne Complex® Kit.url
c:\documents and settings\user\favorites\health\BeautyCare\Murad - Brightening Treatment SPF 15.url
c:\documents and settings\user\favorites\health\BeautyCare\NaturesNutrition.com - discount vitamins & nutritional supplements.url
c:\documents and settings\user\favorites\health\BeautyCare\Opossum Sally's Natural Beauty.url
c:\documents and settings\user\favorites\health\Cooking\Angithi - Collection of finest and authentic Indian Recipes.url
c:\documents and settings\user\favorites\health\Cooking\Chef on a Shoestring.url
c:\documents and settings\user\favorites\health\Cooking\Mamta's Kitchen - Glossary.url
c:\documents and settings\user\favorites\health\Dye your hair BLACK naturally, safely, with Indigo and Henna.url
c:\documents and settings\user\favorites\health\Essential oils.url
c:\documents and settings\user\favorites\health\Hair Loss, thinning hair,Hair care, home remedy Beauty Recipes.url
c:\documents and settings\user\favorites\health\Henna Hair Color,Henna Hair Dye,Black Henna,Henna Powder Exporter,Henna Hair Coloring,Natural Black Henna,India.url
c:\documents and settings\user\favorites\health\Henna\Dye your hair BLACK naturally, safely, with Indigo and Henna.url
c:\documents and settings\user\favorites\health\Henna\henna history + recipes + instructions.url
c:\documents and settings\user\favorites\health\Henna\Henna Page - How - Try out free (almost) samples.url
c:\documents and settings\user\favorites\health\Holomedica - Everyday - Home Made.url
c:\documents and settings\user\favorites\health\Natural Hair Color.url
c:\documents and settings\user\favorites\health\NUTRITIVE VALUE CALCULATIONS - Indian.url
c:\documents and settings\user\favorites\health\Nutritive values, Indiadiets Your guide to Health, Nutrition, Diets, fitness, Weight loss, Diet counselling, customized diets.url
c:\documents and settings\user\favorites\health\Web Site of Fred Hui, M.D., Toronto Holistic & Integrative Practitioner » Welcome to Dr. Hui’s Web Site….url
c:\program files\websavingsfromebates
c:\program files\websavingsfromebates\ApplicationData\merchants.dls
c:\program files\websavingsfromebates\ApplicationData\systemdata.dls
c:\program files\websavingsfromebates\ApplicationData\systemdata1.dls
c:\program files\websavingsfromebates\ApplicationData\updates.dls
c:\program files\websavingsfromebates\ApplicationData\user\dataexcludeebateswebsavings0saved.dls
c:\program files\websavingsfromebates\ApplicationData\user\ebateswebsavings0data.dls
c:\program files\websavingsfromebates\Applications\cmpck.dls
c:\program files\websavingsfromebates\Applications\ebatesdatamerchCust.dls
c:\program files\websavingsfromebates\System\MTemp\logfile.txt
c:\program files\websavingsfromebates\System\Temp\dump.txt
c:\program files\websavingsfromebates\System\Temp\ebateswebsavings_confirmredir0.htm
c:\program files\websavingsfromebates\System\Temp\ebateswebsavings_confirmredir0_wo.htm
c:\program files\websavingsfromebates\System\Temp\ebateswebsavings_preferences0.htm
c:\program files\websavingsfromebates\System\Temp\ebateswebsavings_preferences0_wo.htm
c:\program files\websavingsfromebates\System\Temp\ebateswebsavings_script0.htm
c:\program files\websavingsfromebates\System\Temp\ebateswebsavings_script0_wo.htm
c:\program files\websavingsfromebates\WebSavings_README.txt
c:\windows\launcher.exe
c:\windows\smdat32m.sys
c:\windows\system32\sbutils
c:\windows\system32\sbutils\akn.dun
c:\windows\system32\sbutils\ARG.dun
c:\windows\system32\sbutils\BTS.dun
c:\windows\system32\sbutils\CPS.dun
c:\windows\system32\sbutils\DPC.dun
c:\windows\system32\sbutils\DXJ.dun
c:\windows\system32\sbutils\EasyInet.ico
c:\windows\system32\sbutils\EIR.dun
c:\windows\system32\sbutils\EQN.dun
c:\windows\system32\sbutils\EQT.dun
c:\windows\system32\sbutils\FEN.dun
c:\windows\system32\sbutils\FPD.dun
c:\windows\system32\sbutils\FPF.dun
c:\windows\system32\sbutils\FPG.dun
c:\windows\system32\sbutils\FPI.dun
c:\windows\system32\sbutils\FPJ.dun
c:\windows\system32\sbutils\FPN.dun
c:\windows\system32\sbutils\FPS.dun
c:\windows\system32\sbutils\FPU.dun
c:\windows\system32\sbutils\FTE.dun
c:\windows\system32\sbutils\FTT.dun
c:\windows\system32\sbutils\G1F.dun
c:\windows\system32\sbutils\G1S.dun
c:\windows\system32\sbutils\ICW.dun
c:\windows\system32\sbutils\INE.dun
c:\windows\system32\sbutils\inw.dun
c:\windows\system32\sbutils\JIT.dun
c:\windows\system32\sbutils\launch.gif
c:\windows\system32\sbutils\Launch.ico
c:\windows\system32\sbutils\mco.dun
c:\windows\system32\sbutils\MCU.dun
c:\windows\system32\sbutils\NTO.dun
c:\windows\system32\sbutils\Register.ico
c:\windows\system32\sbutils\SBDun.dll
c:\windows\system32\sbutils\SBReg.pbk
c:\windows\system32\sbutils\SBRepo.dll
c:\windows\system32\sbutils\sbwatchdog.ico
c:\windows\system32\sbutils\SBWebCtl.dll
c:\windows\system32\sbutils\SBWebHost.exe
c:\windows\system32\sbutils\SBWebTools.dll
c:\windows\system32\sbutils\SBWinet.dll
c:\windows\system32\sbutils\SEV.dun
c:\windows\system32\sbutils\spn.dun
c:\windows\system32\sbutils\spu.dun
c:\windows\system32\sbutils\sym.dun
c:\windows\system32\sbutils\tns.dun
c:\windows\system32\sbutils\trn.dun
c:\windows\system32\sbutils\ttn.dun
c:\windows\system32\sbutils\UUC.dun
c:\windows\system32\sbutils\uud.dun
c:\windows\system32\sbutils\UUN.dun
c:\windows\system32\sbutils\vnz.dun
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\AR5523
-------\ATHFMWDL
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-31 )))))))))))))))))))))))))))))))
.
2008-01-30 22:40 . 2008-01-30 22:41 <DIR> d-------- C:\Program Files\Panda Security
2008-01-30 20:13 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-01-30 20:13 . 2007-11-07 10:19 212 --a------ C:\Boot.bak
2008-01-30 19:10 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-30 19:09 . 2008-01-30 19:10 <DIR> d-------- C:\Program Files\Java
2008-01-30 19:08 . 2008-01-30 19:08 <DIR> d-------- C:\Program Files\Common Files\Java
2007-12-04 11:03 . 2007-12-04 11:03 <DIR> d-------- C:\Program Files\Citrix
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 23:59 --------- d-----w C:\Program Files\PC-Doctor for Windows
2008-01-28 15:33 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-28 15:32 --------- d-----w C:\Documents and Settings\user\Application Data\Lavasoft
2008-01-09 21:49 --------- d-----w C:\Documents and Settings\user\Application Data\Skype
2008-01-04 19:42 --------- d-----w C:\Documents and Settings\user\Application Data\RecordNow
2007-12-24 14:33 --------- d-----w C:\Program Files\Common Files\AnswerWorks 4.0
2007-12-08 18:24 --------- d-----w C:\Program Files\TechSmith
2007-12-06 16:31 --------- d-----w C:\Documents and Settings\user\Application Data\Image Zone Express
2007-10-30 22:40 28,672 ----a-w C:\Documents and Settings\user\update.exe
2007-04-14 12:28 38,968 ----a-w C:\Documents and Settings\user\Application Data\GDIPFONTCACHEV1.DAT
2001-08-18 13:00 94,784 -csh--w C:\WINDOWS\twain.dll
2004-08-04 07:56 50,688 --sh--w C:\WINDOWS\twain_32.dll
2004-08-04 07:56 1,028,096 --sha-w C:\WINDOWS\system32\mfc42.dll
2004-08-04 07:56 54,784 --sha-w C:\WINDOWS\system32\msvcirt.dll
2004-08-04 07:56 413,696 --sha-w C:\WINDOWS\system32\msvcp60.dll
2004-08-04 07:56 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll
2007-05-17 11:28 549,376 --sha-w C:\WINDOWS\system32\oleaut32.dll
2004-08-04 07:56 83,456 --sha-w C:\WINDOWS\system32\olepro32.dll
2004-08-04 07:56 11,776 --sh--w C:\WINDOWS\system32\regsvr32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2001-06-25 21:23 401493]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-06-12 16:03 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"TrackPointSrv"="tp4serv.exe" [2004-10-28 03:50 94208 C:\WINDOWS\system32\tp4serv.exe]
"TPHOTKEY"="C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2004-11-17 00:48 94208]
"StorageGuard"="C:\Program Files\VERITAS Software\StorageGuard\sgtray.exe" [2002-02-28 04:00 155648]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2002-03-14 06:25 102455]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-01 21:10 335872]
"AGRSMMSG"="AGRSMMSG.exe" [2003-06-27 08:53 88363 C:\WINDOWS\AGRSMMSG.exe]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 09:11 57344]
"BMMGAG"="C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2004-08-25 01:37 110592]
"BMMLREF"="C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE" [2004-08-25 01:37 20480]
"BMMMONWND"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2004-08-25 01:37 395776]
"QCWLICON"="C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2005-02-01 03:07 86016]
"EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2004-11-24 02:10 212992]
"TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2004-02-04 18:39 897024]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2002-06-27 02:47 36864]
"AEIWLSTA.EXE"="AEIWLSTA.exe" [2002-05-13 14:17 214016 C:\WINDOWS\system32\AEIWLSTA.exe]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 15:24 54840]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"TP4EX"="tp4ex.exe" [2004-11-12 01:07 40960 C:\WINDOWS\system32\TP4EX.exe]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-05-21 00:21 90112]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-11-07 10:19 1115728]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk.disabled [2007-07-19 14:33:21 1593]
Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [2007-04-18 13:54:43 200704]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2007-11-09 17:13:18 972064]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
QConGina.dll 2005-02-01 03:07 262144 C:\WINDOWS\system32\QConGina.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2004-08-12 20:11 24576 C:\WINDOWS\system32\tphklock.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"tgcmd"=C:\Program Files\Support.com\bin\tgcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Lexmark X83 Button Monitor"=C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
"Tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe /server"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"Host Process"=C:\WINDOWS\Fonts\svchost.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
"Lexmark X83 Button Manager"=C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2005-02-01 03:07]
R1 DSMBATT;DSMBATT;C:\WINDOWS\system32\drivers\DSMBATT.SYS [2002-04-04 16:00]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\drivers\IBMBLDID.SYS [2005-02-01 03:07]
R1 TPPWR;TPPWR;C:\WINDOWS\system32\drivers\Tppwr.sys [2004-08-25 01:37]
R3 AEIWL;IBM High Rate Wireless LAN MiniPCI Combo Card Driver;C:\WINDOWS\system32\DRIVERS\AEIWLNDS.sys [2002-05-13 14:09]
R3 Tp4Track;IBM PS/2 TrackPoint Driver;C:\WINDOWS\system32\DRIVERS\tp4track.sys [2004-10-28 03:50]
S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 15:32]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\DNINDIS5.SYS [2003-07-24 12:10]
S3 QCNDISIF;QCNDISIF;C:\WINDOWS\system32\drivers\qcndisif.SYS [2005-02-01 03:07]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
"2008-01-31 13:39:47 C:\WINDOWS\Tasks\BMMTask.job"
- C:\PROGRA~1\ThinkPad\UTILIT~1\BMMTASK.EXE
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-31 08:37:11
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tphklock.dll
-> C:\WINDOWS\system32\NavLogon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\tp4serv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\AEIWLSTA.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-01-31 8:42:50 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-31 13:42:44
ComboFix2.txt 2008-01-31 01:18:35
ComboFix3.txt 2007-11-06 16:45:04
ComboFix4.txt 2007-11-06 15:43:49
.
2007-12-27 06:00:01 --- E O F ---
I have attached a file containing the names of all the files that need to be deleted from the F:\ drive.
There are quite a few, that is why I suggested deleting the folder.
If it is just an archive then most of the files are not dangerous a such because it is unlikely that they would be used.
But if you leave them, then they will crop up in future scans.
COMBOFIX IS NOT, NOR EVER HAS BEEN A TROJAN
(that is for Nortons benefit, not yours citywomanpg :D: )
Your copy of ComboFix was not infected ( at least, it is very unlikely )
Norton for some reason known only to themselves have decided to flag it. It is a recent change in the AV definitions.
I will be removing it anyway :bigthumb:
I couldn't see those images, Create a folder and put all the images in it.
Right click the folder and select Send To >> Compressed folder.
Attach the zip/cab file to your next post.
citywomanpg
2008-01-31, 17:57
Katana,
I've attached one of zip files of the firewall prompt screen shots. I'll post a second message with one more screen shot.
What would you like me to do once I've deleted the files in the archived folder (the one you sent me a list of)?
citywoman
citywomanpg
2008-01-31, 17:58
Katana,
I've attached a second file with one more firewall prompt scrn shot...
Citywoman
Those are all fine, you can allow/unblock them.
Now .....
Congratulations your logs look clean
Let's see if I can help you keep it that way
First lets tidy up
Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
http://i189.photobucket.com/albums/z176/EPL47/CF_Cleanup.png
You can also delete any logs we have produced, and empty your Recycle bin.
Enable Teatimer
RIGHT click Link >>> HERE <<< Link (http://downloads.subratam.org/ResetTeaTimer.bat) and select "save as" and save it to your desktop
Double click ResetTeaTimer.bat
Open Spybot S&D
Click Mode, check Advanced Mode
Go To Left Panel, Click Tools, then also in left panel, click Resident
If your firewall raises a question, say OK
check the box labeled Resident Tea-Timer and OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.
You can now delete ResetTeaTimer.bat
The following is some info to help you stay safe and clean.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )
Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.
http://www.nanoscan.com
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html
AntiSpyware
AntiSpyware is not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
All the programs in this list have a free version.
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
Spybot - Search & Destroy (http://www.safer-networking.org/) <<< A must have program It includes host protection and registry protection A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
a-squared Free (http://www.emsisoft.com/en/software/free/) <<< A good "realtime" or "on demand" scanner
AVG Anti-Spyware 7.5 (http://www.ewido.net/en/) <<< A good "realtime" or "on demand" scanner
superantispyware (http://www.superantispyware.com/) <<< A good "realtime" or "on demand" scanner
Prevention
These programs don't detect malware, they help stop it getting on your machine in the first place.
Each does a different job, so you can have more than one
Winpatrol (http://www.winpatrol.com) An excellent startup manager and then some !! Notifies you if programs are added to startup Allows delayed startup A must have addition
SpywareBlaster 3.5.1 (http://www.javacoolsoftware.com/spywareblaster.html) SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2 (http://www.javacoolsoftware.com/spywareguard.html) SpywareGuard provides real-time protection against spyware. Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut (http://www.funkytoad.com/content/view/15/33/) Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS (http://www.mvps.org/winhelp2002/hosts.zip) This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial (http://www.mvps.org/winhelp2002/hosts.htm) by WinHelp2002. Not required if you are using other host file protections
Internet Browsers
Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
Using a different web browser can help stop malware getting on your machine.
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
If you are still using IE6 then either update, or get one of the following.
FireFox (http://www.mozilla.com/en-US/firefox/) With many addons available that make customization easy this is a very popular choice NoScript and AdBlockPlus addons are essential
Opera (http://www.opera.com/) Another popular alternative
Netscape (http://browser.netscape.com/addons) Another popular alternative Also has Addons available
Cleaning Temporary Internet Files and Tracking Cookies
Temporary Internet Files are mainly the files that are downloaded when you open a web page.
Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
It is a good idea to empty the Temporary Internet Files folder on a regular basis.
Tracking Cookies are files that websites use to monitor which sites you visit and how often.
A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords
Both of these can be cleaned manually, but a quicker option is to use a program
ATF Cleaner (http://www.atribune.org/content/view/19/2/) Free and very simple to use
CCleaner (http://www.ccleaner.com/) Free and very flexible, you can chose which cookies to keep
Also PLEASE read this article.......So How Did I Get Infected In The First Place (http://www.malwareremoval.com/forum/viewtopic.php?f=11&t=4959)
The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.
If you follow this advice then (with a bit of luck) you will never have to hear from me again :D
If you could post back one more time to let me know everything is OK, then I can have this thread archived.
Happy surfing K'
citywomanpg
2008-01-31, 18:56
Katana,
I noticed that most of the entries you wanted me to delete were in the cookies.txt files in the recovery folders, so I that task became a lot simpler!
For the following remaining entry, from your list, can I delete the cookies.txt file or do I need to edit the cookies.txt and save it? The cookies the text belongs to my current log in user ID and Firefox browser:
Atwola C \Documents and Settings\user\Application Data\Mozilla\Profiles\default\up5r2t7c.slt\cookies.txt[.atwola.com/]
I will go through the final steps you've posted (for Combofix, teatimer, etc) and do another post.
Should I uninstall HighjackThis as well?
Citywomanpg
If it is your current profile in Firefox, then you can just press
Ctrl+Shift+Delete
OR
click the Tool menu and choose "clear private data"
You can keep or uninstall as HJT as you choose.
It will cause no harm to leave it there
citywomanpg
2008-01-31, 19:42
Katana,
What about reinstalling spybot? You'd mentioned that in one of your first posts? Do you want me to uninstall my current version and download and install the latest version?
Is there a quick way to do that?
Thanks,
Citywoman
If you look at the list of applications that I posted, under
Antispyware
Is the link to obtain the latest version of Spybot.
just download the new version, uninstall the old ( via add/remove programs ) and then install the updated copy :)
citywomanpg
2008-01-31, 19:55
Well, I guess I'm all clean now and it's time to go...this part is always sad as I realize I'm saying goodbye to a helpful guardian... :)
Thank you for all of your time and assistance!!! ...
Regards,
Citywoman
this part is always sad as I realize I'm saying goodbye to a helpful guardian... :)
Not goodbye, just see you later :bigthumb:
We will always be here for you :police:
citywomanpg
2008-01-31, 20:30
ok then...à bientôt! :flowers:
citywomanpg
2008-01-31, 20:46
Sorry, I actually have another related question. Spybot shows several startup entries, some of which I had uncheked. How do I permanently delete those entries? One in particular I'm concerned about is highlighted below in Red.
Thanks,
Citywomanpg
---------------------
Located: HK_LM:Run, Adobe Reader Speed Launcher
command: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
file: C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
size: 39792
MD5: e28d00ec675f5f5a5a0555e7a4523a6e
Located: HK_LM:Run, AEIWLSTA.EXE
command: AEIWLSTA.EXE START
file: C:\WINDOWS\system32\AEIWLSTA.EXE
size: 214016
MD5: 42872b98b8d2fe1ad032730bd0ac3c93
Located: HK_LM:Run, AGRSMMSG
command: AGRSMMSG.exe
file: C:\WINDOWS\AGRSMMSG.exe
size: 88363
MD5: c0041bb27e2e5b0550c179ecf53425cd
Located: HK_LM:Run, ATIModeChange
command: Ati2mdxx.exe
file: C:\WINDOWS\system32\Ati2mdxx.exe
size: 28672
MD5: fae95d6d7651b5629c4e19adbc9a3863
Located: HK_LM:Run, ATIPTA
command: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
file: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
size: 335872
MD5: eed0dc3be7635eafb5abc62b51983ae0
Located: HK_LM:Run, BMMGAG
command: RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
file: C:\WINDOWS\system32\RunDll32.exe
size: 33280
MD5: da285490bbd8a1d0ce6623577d5ba1ff
Located: HK_LM:Run, BMMLREF
command: C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
file: C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
size: 20480
MD5: 99ea2e4a0d244a223829137f1550a2b6
Located: HK_LM:Run, BMMMONWND
command: rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
file: C:\WINDOWS\system32\rundll32.exe
size: 33280
MD5: da285490bbd8a1d0ce6623577d5ba1ff
Located: HK_LM:Run, COMODO Firewall Pro
command: "C:\Program Files\Comodo\Firewall\CPF.exe" /background
file: C:\Program Files\Comodo\Firewall\CPF.exe
size: 1115728
MD5: 1f5882037bad07e9926f47a3a32f0931
Located: HK_LM:Run, dla
command: C:\WINDOWS\system32\dla\tfswctrl.exe
file: C:\WINDOWS\system32\dla\tfswctrl.exe
size: 102455
MD5: 946bab1251f68c29d60162ad45121862
Located: HK_LM:Run, EZEJMNAP
command: C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
file: C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
size: 212992
MD5: ae9c9e685e746c423af90749bf9d442c
Located: HK_LM:Run, HP Software Update
command: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
file: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
size: 54840
MD5: 21293443961a4e2597453ee7a9347f22
Located: HK_LM:Run, PrinTray
command: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
file: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
size: 36864
MD5: 8fa5e9e4da096b932295f2029af06bba
Located: HK_LM:Run, QCWLICON
command: C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
file: C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
size: 86016
MD5: 45c139f26d20537916711ba71d34c4a5
Located: HK_LM:Run, Share-to-Web Namespace Daemon
command: C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
file: C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
size: 57344
MD5: d4f5faa2fd2dc5923c82ee5808beed7c
Located: HK_LM:Run, StorageGuard
command: "C:\Program Files\VERITAS Software\StorageGuard\sgtray.exe" /r
file: C:\Program Files\VERITAS Software\StorageGuard\sgtray.exe
size: 155648
MD5: e971b862b8db690b56baa0c23ac70e86
Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
file: C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
size: 144784
MD5: 9cc69118fdcbf17119f814fc0a65ca06
Located: HK_LM:Run, TP4EX
command: tp4ex.exe
file: C:\WINDOWS\system32\tp4ex.exe
size: 40960
MD5: d8aec88dee12c38404b186d5de2f58ec
Located: HK_LM:Run, TPHOTKEY
command: C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
file: C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
size: 94208
MD5: 2e7c1ae3834d8d53fe76e261baca1dab
Located: HK_LM:Run, TPKMAPHELPER
command: C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
Located: HK_LM:Run, TrackPointSrv
command: tp4serv.exe
file: C:\WINDOWS\system32\tp4serv.exe
size: 94208
MD5: d01994516d0bcfd16e2539a2da5cc4f8
Located: HK_LM:Run, vptray
command: C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
file: C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
size: 90112
MD5: 4b954730657f43b88a308c41fe570331
Located: HK_LM:Run, Host Process (DISABLED)
command: C:\WINDOWS\Fonts\svchost.exe
Located: HK_LM:Run, Lexmark X83 Button Manager (DISABLED)
command: C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
file: C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
size: 53248
MD5: 3a9162141f9a32044fa9bb24fcbf5ad0
Located: HK_LM:Run, Lexmark X83 Button Monitor (DISABLED)
command: C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
file: C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
size: 40960
MD5: 393eff1f04a49ad901ec0ccd878ac7c0
Located: HK_LM:Run, QuickTime Task (DISABLED)
command: "C:\Program Files\QuickTime\qttask.exe" -atboottime
file: C:\Program Files\QuickTime\qttask.exe
size: 98304
MD5: 76a3a30b58405c2c6d833895253a51a9
Located: HK_LM:Run, SunJavaUpdateSched (DISABLED)
command: "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
Located: HK_LM:Run, Tgcmd (DISABLED)
command: "C:\Program Files\Support.com\bin\tgcmd.exe /server"
Located: HK_CU:Run, ctfmon.exe
command: C:\WINDOWS\system32\ctfmon.exe
file: C:\WINDOWS\system32\ctfmon.exe
size: 15360
MD5: 24232996a38c0b0cf151c2140ae29fc8
Located: HK_CU:Run, H/PC Connection Agent
command: "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
file: C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
size: 401493
MD5: dbf976c1966385758fecbc59065f2cca
Located: HK_CU:Run, SpybotSD TeaTimer
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 1038336
MD5: 58f7e6434d285f4c98ad3621e0bd8c8d
Located: HK_CU:Run, tgcmd (DISABLED)
command: C:\Program Files\Support.com\bin\tgcmd.exe
Located: Startup (common), BlueSoleil.lnk (DISABLED)
command: C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
file: C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
size: 1183744
MD5: c2560eb72a613ad762bd518019b9a013
Located: Startup (common), Exif Launcher.lnk
command: C:\Program Files\FinePixViewer\QuickDCF.exe
file: C:\Program Files\FinePixViewer\QuickDCF.exe
size: 200704
MD5: 91e35f8e5c123ca3f1e5bad39fb57697
Located: Startup (common), Microsoft Office.lnk
command: C:\Program Files\Microsoft Office\Office10\OSA.EXE
file: C:\Program Files\Microsoft Office\Office10\OSA.EXE
size: 83360
MD5: 5bc65464354a9fd3beaa28e18839734a
Located: Startup (common), QuickBooks Update Agent.lnk
command: C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
file: C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
size: 972064
MD5: 1a2ec9fb378af13623d3a03cb8ae56e1
Located: Startup (user), Adobe Gamma.lnk
command: C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
file: C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
size: 113664
MD5: c2ff17734176cd15221c10044ef0ba1a
That file is gone, but we can remove them if you want.
What program did you use to disable them ?
citywomanpg
2008-01-31, 22:32
I used the System Startup function in Spybot Tools. That's where I got the list I posted in the previous post.
If you highite the entry in System Startup function in Spybot Tools you should be able to remove using the big red X
citywomanpg
2008-01-31, 22:58
I was a bit scared of doing that, fearing that the delete function would remove all checked entries, i.e. the entries that I need/ want to retain in startup. Spybot's help files do not go into how that functionality works!
So, sorry to be repetitive, but I simply highlight each of the entries I want to remove (irrespective of whether or not it's checked in the checkbox) and click delete?
Exactly right :)
I've just tried it on my machine and it only removes the entry that you click on
citywomanpg
2008-02-01, 17:30
I've deleted the unwanted and suspicious startup entries through Spybot, as you directed.
One parting question, if you're able to guide me...do you know of a website that can guide/ teach me on how to set up a .bat file or script that can automatically run weekly scans on my computer, using some of the products you'd recommended?
This is the only way I know of to ensure ongoing good health for my computer. Otherwise, I'm afraid I do get busy and forget...
Paid programs normally give the option of running a scheduled scan.
If a simple batch file could be used, no one would ever pay for the products.
The best option is to get in the habit of running a scan when you finish using the machine, ie. start a scan running just before you go to bed.
citywomanpg
2008-02-01, 20:59
ok, that's good advice!
Thank you for all of your help and assistance! Have a great weekend...
Citywoman
citywomanpg
2008-02-01, 21:25
I meant for all your help and guidance..