Pop-ups, random processes, and all the other stuff your mother warned you about!

M

Mistermonkus

New member
Hey guys,

I followed tashi's guide to desktops hijacks, but I'm still having problems. There's a bunch of processes that I have no idea about.

Here's the rapport.txt log:

SmitFraudFix v2.121

Scan done at 16:23:48.28, Wed 11/15/2006
Run from C:\Documents and Settings\Christopher Vincent\Desktop\SmitFraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}"="archenteric"

[HKEY_CLASSES_ROOT\CLSID\{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}\InProcServer32]
@="C:\WINDOWS\System32\impgsje.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d7bdd42a-7e69-4bb8-aac3-d76ff65a3aa3}\InProcServer32]
@="C:\WINDOWS\System32\impgsje.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ff170564-36c8-43f7-9100-559e166405cf}"="cussers"

[HKEY_CLASSES_ROOT\CLSID\{ff170564-36c8-43f7-9100-559e166405cf}\InProcServer32]
@="C:\WINDOWS\System32\cfltygd.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ff170564-36c8-43f7-9100-559e166405cf}\InProcServer32]
@="C:\WINDOWS\System32\cfltygd.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

C:\WINDOWS\System32\impgsje.dll -> Hoax.Win32.Renos.gen.i
C:\WINDOWS\System32\impgsje.dll -> Deleted

C:\WINDOWS\System32\cfltygd.dll -> Hoax.Win32.Renos.gen.i
C:\WINDOWS\System32\cfltygd.dll -> Deleted


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\a.exe Deleted
C:\WINDOWS\system32\ishost.exe Deleted
C:\WINDOWS\system32\ismini.exe Deleted
C:\WINDOWS\system32\issearch.exe Deleted
C:\WINDOWS\system32\ixt?.dll Deleted
C:\WINDOWS\system32\migicons.exe Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\ts.ico Deleted
C:\WINDOWS\system32\drvkup.dll Deleted
C:\WINDOWS\system32\components\flx?.dll Deleted
C:\DOCUME~1\CHRIST~1\FAVORI~1\Antivirus Test Online.url Deleted
C:\DOCUME~1\CHRIST~1\STARTM~1\VirusBursters 6.2.lnk Deleted
C:\DOCUME~1\CHRIST~1\STARTM~1\PROGRAMS\VirusBursters Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted
C:\Program Files\Safety Bar\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End
 
and the AVG Spyware log:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 5:22:24 PM 11/15/2006

+ Scan result:



C:\Program Files\VSAdd-in\VSAdd-in.dll -> Adware.Agent : Cleaned.
C:\System Volume Information\_restore{17194F60-D217-45F1-9997-C55DE6B55C2B}\RP894\A0184438.dll -> Adware.PurityScan : Cleaned.
C:\WINDOWS\SYSTEM32\bvqojb.dll -> Adware.PurityScan : Cleaned.
C:\Program Files\Common Files\{2D2714DA-0718-1033-0812-020812200001}\Update.exe -> Adware.Softomate : Cleaned.
C:\Program Files\Common Files\{2D2714DA-0718-1033-0812-020812200001}\services.dll -> Adware.Softomate : Cleaned.
C:\Program Files\Common Files\{3D2714DA-0718-1033-0812-020812200001}\MyToolBar.dll -> Adware.Softomate : Cleaned.
C:\WINDOWS\SYSTEM32\ljjgghe.dll -> Adware.Virtumonde : Cleaned.
C:\WINDOWS\SYSTEM32\ljjighe.dll -> Adware.Virtumonde : Cleaned.
C:\System Volume Information\_restore{17194F60-D217-45F1-9997-C55DE6B55C2B}\RP894\A0185626.exe -> Adware.VirusBursters : Cleaned.
C:\Program Files\Common Files\Yazzle1162OinAdmin.exe -> Downloader.PurityScan.dc : Cleaned with backup (quarantined).
C:\WINDOWS\ѕеcurity\dvdplay.exe -> Downloader.PurityScan.dt : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe -> Dropper.Small : Cleaned with backup (quarantined).
C:\cleol23oad.exe -> Hijacker.Small.ma : Cleaned with backup (quarantined).
C:\medsload.exe -> Hijacker.Small.ma : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{17194F60-D217-45F1-9997-C55DE6B55C2B}\RP894\A0185710.exe -> Hijacker.VB.lb : Cleaned with backup (quarantined).
:mozilla.17:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.17:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.247realmedia : Cleaned.
:mozilla.17:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.247realmedia : Cleaned.
:mozilla.17:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.247realmedia : Cleaned.
:mozilla.6:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.247realmedia : Cleaned.
:mozilla.9:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.247realmedia : Cleaned.
:mozilla.10:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.10:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.11:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.11:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.12:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.12:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.13:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.13:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.14:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.14:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.15:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.15:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.168:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.169:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.16:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.16:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.178:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.178:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.178:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.178:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.17:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.17:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.18:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.19:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.19:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.19:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.19:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.19:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.20:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.20:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.20:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.20:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.20:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.21:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.21:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.21:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.21:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.22:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.22:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.22:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.22:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.23:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.23:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.23:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.23:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.24:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.24:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.24:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.24:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.25:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.25:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.25:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.25:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.26:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.26:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.26:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.26:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.27:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.27:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.27:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.27:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.28:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.28:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.28:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.28:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.29:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.29:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.29:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.29:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.7:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.8:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
:mozilla.9:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@bodybuildingcom.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@chumtv.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@msnportal.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@msnportal.112.2o7[3].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.24:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Adbrite : Cleaned.
:mozilla.27:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Adbrite : Cleaned.
:mozilla.36:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.36:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Adbrite : Cleaned.
:mozilla.36:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Adbrite : Cleaned.
:mozilla.36:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@rotator.adjuggler[3].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@www.burstbeacon[3].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.52:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Burstnet : Cleaned.
:mozilla.55:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Burstnet : Cleaned.
:mozilla.64:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.64:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Burstnet : Cleaned.
:mozilla.64:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Burstnet : Cleaned.
:mozilla.64:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.57:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Centrport : Cleaned.
:mozilla.60:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Centrport : Cleaned.
:mozilla.69:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.69:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Centrport : Cleaned.
:mozilla.69:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Centrport : Cleaned.
:mozilla.69:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Centrport : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@ad1.clickhype[2].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@ad1.clickhype[3].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@ad1.clickhype[2].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@cz3.clickzs[2].txt ->
 
TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@cz4.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@cz8.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.63:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Com : Cleaned.
:mozilla.64:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Com : Cleaned.
:mozilla.66:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Com : Cleaned.
:mozilla.67:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Com : Cleaned.
:mozilla.75:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.75:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Com : Cleaned.
:mozilla.75:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Com : Cleaned.
:mozilla.75:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Com : Cleaned.
:mozilla.76:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.76:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Com : Cleaned.
:mozilla.76:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Com : Cleaned.
:mozilla.76:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@com[3].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@com[4].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@com[5].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@www.vodkawatermelon.com.0.fb.dbbsrv[2].txt -> TrackingCookie.Dbbsrv : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@c.enhance[2].txt -> TrackingCookie.Enhance : Cleaned.
:mozilla.100:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.100:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.100:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.100:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.101:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.101:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.101:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.101:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.102:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.102:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.102:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.102:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.103:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.103:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.103:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.103:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.104:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.104:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.104:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.104:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.105:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.105:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.105:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.105:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.106:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.106:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.106:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.106:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.78:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.79:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.80:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.81:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.81:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.82:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.82:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.83:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.83:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.84:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.84:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.85:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.85:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.86:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.86:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.87:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.87:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.88:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.88:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.89:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.89:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.90:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.90:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.90:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.90:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.90:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.90:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.91:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.91:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.91:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.91:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.91:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.91:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.92:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.92:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.92:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.92:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.92:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.92:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.93:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.93:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.93:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.93:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.93:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.93:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.94:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.94:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.94:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.94:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.94:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.94:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.95:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.95:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.95:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.95:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.95:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.96:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.96:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.96:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.96:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.96:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.97:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.97:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.97:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.97:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.97:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.98:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.98:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.98:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.98:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.99:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.99:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.99:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Esomniture : Cleaned.
:mozilla.99:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wfkiwkdjggp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wfkokpcpkkq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wfkyaocjekp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wfkyqpczeeo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wfligmazwgp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wflokpdpgbp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wfloqlcpsep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wfmiaidzsco.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wgkiskczwgp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wgkiulc5mlp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wglicmajabp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wgmyugczeap.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6whk4gndzgbo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wjk4spd5gap.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wjkogidpalo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wjkowgd5mlp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wjkykmdzoaq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wjl4eid5khq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wjliemazwlo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wjlowpd5wco.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@e-2dj6wjnycncjocp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@e-2dj6wflowmczifp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@e-2dj6wglicmajabp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@e-2dj6wjlogodzcao.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@adopt.euroclick[3].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@c.goclick[1].txt -> TrackingCookie.Goclick : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
:mozilla.243:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.244:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.244:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.245:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.253:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.253:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.253:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.253:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.254:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
 
:mozilla.254:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.254:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.254:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Onestat : Cleaned.
:mozilla.187:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Overture : Cleaned.
:mozilla.188:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Overture : Cleaned.
:mozilla.197:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.197:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Overture : Cleaned.
:mozilla.197:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Overture : Cleaned.
:mozilla.197:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@data4.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
:mozilla.184:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Paycounter : Cleaned.
:mozilla.185:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Paycounter : Cleaned.
:mozilla.194:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned.
:mozilla.194:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Paycounter : Cleaned.
:mozilla.194:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Paycounter : Cleaned.
:mozilla.194:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Paycounter : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned.
:mozilla.28:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.29:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.30:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.31:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.31:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.32:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.33:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.34:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.40:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.40:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.40:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.40:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.41:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.41:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.41:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.41:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.42:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.42:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.42:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.42:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.43:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.43:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.43:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Pointroll : Cleaned.
:mozilla.43:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@ads.realcastmedia[1].txt -> TrackingCookie.Realcastmedia : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@ads.realcastmedia[1].txt -> TrackingCookie.Realcastmedia : Cleaned.
:mozilla.270:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Realtracker : Cleaned.
:mozilla.271:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Realtracker : Cleaned.
:mozilla.280:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Realtracker : Cleaned.
:mozilla.280:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Realtracker : Cleaned.
:mozilla.280:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Realtracker : Cleaned.
:mozilla.280:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Realtracker : Cleaned.
:mozilla.10:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.10:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.10:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.10:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.12:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.12:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.12:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.6:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.7:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.7:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.7:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.7:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.8:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.8:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.8:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.9:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.210:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Revenue : Cleaned.
:mozilla.211:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Revenue : Cleaned.
:mozilla.220:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.220:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Revenue : Cleaned.
:mozilla.220:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Revenue : Cleaned.
:mozilla.220:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@ads1.revenue[1].txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.108:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Ru4 : Cleaned.
:mozilla.111:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Ru4 : Cleaned.
:mozilla.120:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.120:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Ru4 : Cleaned.
:mozilla.120:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Ru4 : Cleaned.
:mozilla.120:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Ru4 : Cleaned.
:mozilla.232:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.233:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.233:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.234:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.234:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.235:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.235:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.236:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.236:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.237:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.242:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.242:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.242:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.242:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.243:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.243:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.243:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.243:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.244:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.244:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.244:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.244:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.245:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.245:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.245:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.245:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.246:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.246:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.246:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.246:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.51:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.54:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.63:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.63:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.63:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.63:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.68:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.69:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.71:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.72:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.80:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.80:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.80:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.80:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.81:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.81:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.81:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.81:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Sexcounter : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@h.starware[1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@starware[2].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@try.starware[1].txt -> TrackingCookie.Starware : Cleaned.
:mozilla.247:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Tacoda : Cleaned.
:mozilla.248:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Tacoda : Cleaned.
:mozilla.248:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Tacoda : Cleaned.
:mozilla.249:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Tacoda : Cleaned.
:mozilla.257:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.257:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Tacoda : Cleaned.
:mozilla.257:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Tacoda : Cleaned.
:mozilla.257:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Tacoda : Cleaned.
:mozilla.258:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.258:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Tacoda : Cleaned.
:mozilla.258:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Tacoda : Cleaned.
:mozilla.258:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@tacoda[3].txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.257:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.258:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.267:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.267:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.267:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.267:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.258:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.259:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.268:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.268:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.268:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.268:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@webstat[2].txt -> TrackingCookie.Web-stat : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.
 
:mozilla.310:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.311:C:\RECYCLED\NPROTECT\00014908.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.311:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.312:C:\RECYCLED\NPROTECT\00014916.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.320:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.320:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.320:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.320:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.321:C:\Documents and Settings\Christopher Vincent\Application Data\Mozilla\Firefox\Profiles\6b0897id.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.321:C:\RECYCLED\NPROTECT\00014919.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.321:C:\RECYCLED\NPROTECT\00014924.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.321:C:\RECYCLED\NPROTECT\00015196.MOZ -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@ad.yieldmanager[3].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Christopher Vincent\Cookies\christopher vincent@ad.yieldmanager[4].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@ad.yieldmanager[4].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Christopher Vincent\Local Settings\Temp\Cookies\christopher vincent@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\WINDOWS\SYSTEM32\winaqr32.dll -> Trojan.Agent.vg : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\xyjbkpgl.dll -> Trojan.BHO.g : Cleaned with backup (quarantined).
C:\win10B.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\win10C.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\win10D.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\win10E.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\win10F.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\win115.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\win11D.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\win23.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\win88.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).
C:\winF1.tmp.exe -> Trojan.Dialer.qs : Cleaned with backup (quarantined).


::Report end
 
And finally, the HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:45:20 PM, on 11/15/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Program Files\MSN Webcam Recorder\ml20gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {D99D21B8-9809-BE8C-780D-C3896D58669F} - C:\WINDOWS\System32\bvqojb.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [enuzwsl.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\enuzwsl.dll,pvpkemc
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [bntcogh.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\bntcogh.dll,uiyblgb
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSN Webcam Recorder] "C:\Program Files\MSN Webcam Recorder\ml20gui.exe" -silent
O4 - HKCU\..\Run: [Tjmhrk] ????\w?wexec.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://mistermonkus.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/gold/default/gf.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
 
Hi Mistermonkus and welcome to Safer Networking Forums :)

You got infections there...

Before we can start the cleaning I need you to do something important.

Please download and install Windows XP Service Pack 1A -> Windows XP SP1a
NOTE! Do NOT install Service Pack 2 yet. We'll have to get you cleaned first

When you're ready with that:

Please rename HijackThis.exe to Scanner.exe

The post a fresh HijackThis (scanner.exe) log to here

:bigthumb:
 
Haven't had a chance to get at my comp for a bit. But here's the log (finally!)


Logfile of HijackThis v1.99.1
Scan saved at 12:03:13 PM, on 11/27/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Webcam Recorder\ml20gui.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\Scanner.exe

R3 - URLSearchHook: (no name) - {D99D21B8-9809-BE8C-780D-C3896D58669F} - C:\WINDOWS\System32\bvqojb.dll (file missing)
O2 - BHO: (no name) - {013A653B-49A6-4f76-8B68-E4875EA6BA54} - C:\WINDOWS\System32\pjawmodn.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0730636A-ED8F-1700-7F6E-07A5A9CF17AB} - C:\WINDOWS\System32\byvmdy.dll
O2 - BHO: (no name) - {18D0F46D-1A11-DE44-9286-08B0E25FF968} - C:\WINDOWS\System32\mspgcsj.dll
O2 - BHO: (no name) - {1F9F5A63-6EF5-41F8-A401-AD21A9D05912} - C:\WINDOWS\System32\awvvu.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O2 - BHO: (no name) - {CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030} - C:\WINDOWS\System32\ljjgghe.dll (file missing)
O2 - BHO: (no name) - {D99D21B8-9809-BE8C-780D-C3896D58669F} - C:\WINDOWS\System32\bvqojb.dll (file missing)
O2 - BHO: (no name) - {DE9C22BC-9C09-EF8A-780D-C3896D5866CA} - C:\WINDOWS\System32\ldmjvpe.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [enuzwsl.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\enuzwsl.dll,pvpkemc
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [bntcogh.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\bntcogh.dll,uiyblgb
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSN Webcam Recorder] "C:\Program Files\MSN Webcam Recorder\ml20gui.exe" -silent
O4 - HKCU\..\Run: [Tjmhrk] ????\w?wexec.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://mistermonkus.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164595525342
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/gold/default/gf.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: awvvu - C:\WINDOWS\System32\awvvu.dll
O20 - Winlogon Notify: ljjgghe - ljjgghe.dll (file missing)
O20 - Winlogon Notify: winaqr32 - winaqr32.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
 
Hi again :)

OK good work, let's begin the cleaning...

Disable AVG Anti-Spyware guard.
  • Open AVG Anti-Spyware
  • Click Shield
  • Click under "resident shield is"
  • Change it to inactive
  • Close the program
Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
 
I'm now getting an error message when Windows starts that reads:
"Error loading C:\WINDOWS\SYSTEM32|bntcogh.dll"

Not too sure what it means, but here are the vundofix.txt, and HJT log.

VundoFix V6.2.13

Checking Java version...

Scan started at 12:03:26 PM 11/28/2006

Listing files found while scanning....

C:\WINDOWS\SYSTEM32\bntcogh.dll
C:\WINDOWS\SYSTEM32\mspgcsj.dll
C:\WINDOWS\SYSTEM32\awvvu.dll
C:\WINDOWS\SYSTEM32\uvvwa.ini
C:\WINDOWS\SYSTEM32\uvvwa.bak1
C:\WINDOWS\SYSTEM32\uvvwa.bak2
C:\WINDOWS\System32\awvvu.dll
C:\WINDOWS\SYSTEM32\uvvwa.ini
C:\WINDOWS\SYSTEM32\uvvwa.bak1
C:\WINDOWS\SYSTEM32\uvvwa.bak2
C:\WINDOWS\System32\uvvwa.ini
C:\WINDOWS\System32\uvvwa.bak1
C:\WINDOWS\System32\uvvwa.bak2

Beginning removal...

Attempting to delete C:\WINDOWS\SYSTEM32\bntcogh.dll
C:\WINDOWS\SYSTEM32\bntcogh.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\mspgcsj.dll
C:\WINDOWS\SYSTEM32\mspgcsj.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\awvvu.dll
C:\WINDOWS\SYSTEM32\awvvu.dll Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\uvvwa.ini
C:\WINDOWS\SYSTEM32\uvvwa.ini Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\uvvwa.bak1
C:\WINDOWS\SYSTEM32\uvvwa.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\SYSTEM32\uvvwa.bak2
C:\WINDOWS\SYSTEM32\uvvwa.bak2 Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.2.13

Checking Java version...

Scan started at 1:16:52 PM 11/28/2006

Listing files found while scanning....

No infected files were found.








And the HJT log:










Logfile of HijackThis v1.99.1
Scan saved at 1:35:20 PM, on 11/29/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Program Files\MSN Webcam Recorder\ml20gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\Scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {D99D21B8-9809-BE8C-780D-C3896D58669F} - C:\WINDOWS\System32\bvqojb.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0730636A-ED8F-1700-7F6E-07A5A9CF17AB} - C:\WINDOWS\System32\byvmdy.dll
O2 - BHO: (no name) - {1742C71A-212D-4722-AED0-536116A52863} - C:\WINDOWS\System32\awvvu.dll (file missing)
O2 - BHO: (no name) - {18D0F46D-1A11-DE44-9286-08B0E25FF968} - C:\WINDOWS\System32\mspgcsj.dll (file missing)
O2 - BHO: (no name) - {35F7813A-AF74-4474-B1DC-7EE6FB6C43C6} - C:\WINDOWS\System32\iamwnixk.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O2 - BHO: (no name) - {CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030} - C:\WINDOWS\System32\ljjgghe.dll (file missing)
O2 - BHO: (no name) - {D99D21B8-9809-BE8C-780D-C3896D58669F} - C:\WINDOWS\System32\bvqojb.dll (file missing)
O2 - BHO: (no name) - {DE9C22BC-9C09-EF8A-780D-C3896D5866CA} - C:\WINDOWS\System32\ldmjvpe.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [enuzwsl.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\enuzwsl.dll,pvpkemc
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [bntcogh.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\bntcogh.dll,uiyblgb
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSN Webcam Recorder] "C:\Program Files\MSN Webcam Recorder\ml20gui.exe" -silent
O4 - HKCU\..\Run: [Tjmhrk] ????\w?wexec.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://mistermonkus.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164595525342
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/gold/default/gf.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: ljjgghe - ljjgghe.dll (file missing)
O20 - Winlogon Notify: winaqr32 - winaqr32.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
 
Hi again, we'll continue :)

You should print these instructions or save these to a text file. Follow these instructions carefully.

Open AVG Anti-Spyware:
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

Download ATF Cleaner by Atribune to your desktop.
Do NOT run yet.

You got some infections there.

Make your hidden files visible:
  • Go to My Computer
  • Select the Tools menu and click Folder Options
  • Click the View tab.
  • Checkmark the "Display the contents of system folders"
  • Under the Hidden files and folders select "Show hidden files and folders"
  • Uncheck "Hide protected operating system files"
  • Click Apply and then the OK and close My Computer.

==================

Open Control Panel -> Add/Remove programs -> Remove all the of the following or similar entries if found:
Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
or anything similar with Oin or Outerinfo in it.
Zolero
Tizzletalk
MediaTickets
Cowabanga
VSAdd-in
VS Toolbar

and any other programs you didn't install or don't recognize - if your not sure please ask first

Download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

Tutorial for the uninstaller if needed

Run HijackThis, click Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press Fix checked. If something isn't there, please continue with the next entry in the list.

R3 - URLSearchHook: (no name) - {D99D21B8-9809-BE8C-780D-C3896D58669F} - C:\WINDOWS\System32\bvqojb.dll (file missing)
O2 - BHO: (no name) - {0730636A-ED8F-1700-7F6E-07A5A9CF17AB} - C:\WINDOWS\System32\byvmdy.dll
O2 - BHO: (no name) - {1742C71A-212D-4722-AED0-536116A52863} - C:\WINDOWS\System32\awvvu.dll (file missing)
O2 - BHO: (no name) - {18D0F46D-1A11-DE44-9286-08B0E25FF968} - C:\WINDOWS\System32\mspgcsj.dll (file missing)
O2 - BHO: (no name) - {35F7813A-AF74-4474-B1DC-7EE6FB6C43C6} - C:\WINDOWS\System32\iamwnixk.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O2 - BHO: (no name) - {CFE9E8A8-38C0-4EF8-AEC2-5035EFE81030} - C:\WINDOWS\System32\ljjgghe.dll (file missing)
O2 - BHO: (no name) - {D99D21B8-9809-BE8C-780D-C3896D58669F} - C:\WINDOWS\System32\bvqojb.dll (file missing)
O2 - BHO: (no name) - {DE9C22BC-9C09-EF8A-780D-C3896D5866CA} - C:\WINDOWS\System32\ldmjvpe.dll (file missing)
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O4 - HKLM\..\Run: [enuzwsl.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\enuzwsl.dll,pvpkemc
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [bntcogh.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\bntcogh.dll,uiyblgb
O4 - HKCU\..\Run: [Tjmhrk] ????\w?wexec.exe
O20 - Winlogon Notify: ljjgghe - ljjgghe.dll (file missing)
O20 - Winlogon Notify: winaqr32 - winaqr32.dll (file missing)

Restart your computer to the safe mode:
  • Restart your computer
  • Start tapping the F8 key when the computer restarts.
  • When the start menu opens, choose Safe mode
  • Press Enter. The computer then begins to start in Safe mode.

Go to the My Computer and delete the following files (if present):
C:\WINDOWS\System32\byvmdy.dll
C:\WINDOWS\System32\iamwnixk.dll
C:\WINDOWS\System32\enuzwsl.dll
C:\WINDOWS\System32\bntcogh.dll

Go to the My Computer and delete the following folders (if present):
C:\Program Files\ipwins
C:\Program Files\VSAdd-in

Run ATF Cleaner
  • Under Main choose: Select All
    Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      scanavgjk2.jpg
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.

================

When you're ready, please post the following logs to here:
- AVG's report
- a fresh HijackThis log
 
Here's the AVG log:


---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 1:26:43 PM 12/3/2006

+ Scan result:



C:\Documents and Settings\Christopher Vincent\Desktop\OiUninstaller.exe -> Adware.MediaTickets : Cleaned with backup (quarantined).
C:\mstFF.tmp -> Not-A-Virus.Hoax.Win32.Renos.fw : Cleaned with backup (quarantined).
:mozilla.18:C:\RECYCLED\NPROTECT\00055094.MOZ -> TrackingCookie.Atdmt : Cleaned.
:mozilla.18:C:\RECYCLED\NPROTECT\00055095.MOZ -> TrackingCookie.Atdmt : Cleaned.
:mozilla.18:C:\RECYCLED\NPROTECT\00055098.MOZ -> TrackingCookie.Atdmt : Cleaned.
:mozilla.24:C:\RECYCLED\NPROTECT\00055099.MOZ -> TrackingCookie.Atdmt : Cleaned.
:mozilla.6:C:\RECYCLED\NPROTECT\00055091.MOZ -> TrackingCookie.Atdmt : Cleaned.
:mozilla.10:C:\RECYCLED\NPROTECT\00055099.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.11:C:\RECYCLED\NPROTECT\00055099.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.17:C:\RECYCLED\NPROTECT\00055089.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.18:C:\RECYCLED\NPROTECT\00055089.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.18:C:\RECYCLED\NPROTECT\00055090.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.19:C:\RECYCLED\NPROTECT\00055089.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.19:C:\RECYCLED\NPROTECT\00055090.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.20:C:\RECYCLED\NPROTECT\00055090.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.20:C:\RECYCLED\NPROTECT\00055094.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.21:C:\RECYCLED\NPROTECT\00055091.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.21:C:\RECYCLED\NPROTECT\00055094.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.22:C:\RECYCLED\NPROTECT\00055091.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.22:C:\RECYCLED\NPROTECT\00055094.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.22:C:\RECYCLED\NPROTECT\00055095.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.23:C:\RECYCLED\NPROTECT\00055091.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.23:C:\RECYCLED\NPROTECT\00055095.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.24:C:\RECYCLED\NPROTECT\00055095.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.25:C:\RECYCLED\NPROTECT\00055098.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.26:C:\RECYCLED\NPROTECT\00055098.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.27:C:\RECYCLED\NPROTECT\00055098.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.7:C:\RECYCLED\NPROTECT\00055099.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.8:C:\RECYCLED\NPROTECT\00055099.MOZ -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.9:C:\RECYCLED\NPROTECT\00055099.MOZ -> TrackingCookie.Casalemedia : Cleaned.
C:\RECYCLED\NPROTECT\00055976.exe -> Trojan.Small : Cleaned with backup (quarantined).


::Report end




And the HJT log:




Logfile of HijackThis v1.99.1
Scan saved at 1:33:53 PM, on 12/3/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Program Files\MSN Webcam Recorder\ml20gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\Scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSN Webcam Recorder] "C:\Program Files\MSN Webcam Recorder\ml20gui.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://mistermonkus.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164595525342
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/gold/default/gf.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
 
Hi again, it is looking clean now :)
The computer is running fine ?

Now you can clean AVG's Quarantine:
  • Open AVG Anti-Spyware
  • Click Infections
  • Click Quarantine tab
  • Click Select all
  • Click Remove finally
  • Close the program
You can remove the tools we used.

Then the first priority is to visit Windows Update and get your system updated
-> At first, install Win XP Service Pack 2 Update
-> Reboot and get back to the Windows Update
-> Install all remaining important updates
(NOTE: You'll propably have to reboot and get back to the update several times before all of them are installed)

You should empty Norton protected recycle bin -> Instructions
Then you should update your Java to the latest version (5.0 update 10)
  • [*]Start
    [*]Control Panel
    [*]Add/Remove Programs
  • Delete the old Java, J2SE Runtime Environment 5.0 Update 1
  • Download the latest version of Java Runtime Environment (JRE) 5.0 Update 10.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement."
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Install it
Now you can make your hidden files hidden again.
  • Go to My Computer
  • Select the Tools menu and click Folder Options
  • Click the View tab.
  • Checkmark the "Display the contents of system folders"
  • Under the Hidden files and folders select "Show hidden files and folders"
  • Check "Hide protected operating system files"
  • Click Apply and then the OK and close My Computer.

=============

Now that you seem to be clean, please follow these simple steps in order to keep your computer clean and secure:
  • Clear your system restore
    This will clear the system restore folders from possible malware that was left behind during the cleaning process.
  • Use ATF Cleaner
    Download and install ATF Cleaner. Clean your temporary files & folders with it regularly.
  • Use Ad-Aware
    Download and install Ad-Aware. Update it and scan your computer regularly with it.
  • Use AVG Anti-Spyware
    Update it and scan your computer regularly with it.
  • Use Spybot S&D
    Download and install Spybot S&D. Update it and scan your computer regularly with it.
  • Install SpywareBlaster
    SpywareBlaster will prevent spyware from being installed.
  • Install MVPS Hosts file
    This prevents your computer from connecting to harmful sites.
  • Use Firefox browser
    Firefox is faster, safer and better browser than Internet Explorer.
  • Keep your systen up-to-date
    Visit Windows Update regularly.
  • Keep your antivirus and firewall up-to-date
    Scan your computer regularly with your antivirus.
  • Read this article by TonyKlein
    So how did I get infected in the first place?
  • Stand Up and Be Counted !
    The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Stay clean and be safe ;)
 
As the problem appears to be resolved this topic has been archived.

If you need it re-opened please send a private message (pm) to a forum staff member and provide a link to the thread; this applies only to the original topic starter.

Glad we could help :2thumb:
 
You must log in or register to reply here.
Back
Top