well, im not sure how, but i've been infected with some viruses, the symptoms have been: random flash pop-ups,websites popping up after every page,my default page changed,and some things on my task manager and in my C:\ Drive im not allowed to touch, even with unlocker. I got a hijack this file. Logfile of HijackThis v1.99.1 Scan saved at 7:15:13 PM, on 3/5/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv2.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InfoMyCa.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\MediaGateway\MediaGateway.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Nikon\NkView6\NkvMon.exe C:\WINDOWS\system32\WTablet\TabUserW.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Grisoft\AVG Free\avgwb.dat C:\Documents and Settings\Brian\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R3 - Default URLSearchHook is missing O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [WUSB54Gv2] C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [gimmygames] C:\windows\gimmygames11.exe O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe O4 - HKLM\..\Run: [keyboard] C:\\keyboard.exe O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s O4 - HKLM\..\Run: [{0B-BD-D1-13-ZN}] c:\windows\system32\qodsregl.exe CORN001 O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun O4 - HKLM\..\Run: [BrowserUpdateSched] C:\WINDOWS\system32\lwinprag.exe CORN001 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe" O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O4 - Startup: PowerReg Scheduler V3.exe O4 - Startup: Zeno.lnk = C:\WINDOWS\system32\lwinprag.exe O4 - Startup: Z_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU) O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU) O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: Hints - C:\WINDOWS\system32\hrp0057me.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe O23 - Service: WUSB54Gv2SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv2.exe (file missing) some help would be greatly appreciated, thanks.
Uninstall via add/remove programs (control panel) New.net or New.net Domains or NewDotNet WhenUSave The Search Accelerator MediaGateway Reboot and a post a fresh HjT log. I'll give you further instructions then
alright, i've uninstalled them. Logfile of HijackThis v1.99.1 Scan saved at 9:55:31 AM, on 3/7/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv2.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InfoMyCa.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\AIM\aim.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Nikon\NkView6\NkvMon.exe C:\WINDOWS\system32\WTablet\TabUserW.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Brian\Desktop\HijackThis.exe O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\bxxs5.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [WUSB54Gv2] C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [gimmygames] C:\windows\gimmygames11.exe O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe O4 - HKLM\..\Run: [{0B-BD-D1-13-ZN}] C:\windows\system32\qodsregl.exe CORN001 O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun O4 - HKLM\..\Run: [BrowserUpdateSched] C:\WINDOWS\system32\lwinprag.exe CORN001 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O4 - Startup: PowerReg Scheduler V3.exe O4 - Startup: Zeno.lnk = C:\WINDOWS\system32\lwinprag.exe O4 - Startup: Z_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU) O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\dnpo0173e.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe O23 - Service: WUSB54Gv2SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv2.exe (file missing) thanks again for the help
You're not clean yet Fix with HjT (do a system scan only, checkmark these and press fix checked): O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\bxxs5.dll O4 - HKLM\..\Run: [gimmygames] C:\windows\gimmygames11.exe O4 - HKLM\..\Run: [{0B-BD-D1-13-ZN}] C:\windows\system32\qodsregl.exe CORN001 O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun O4 - HKLM\..\Run: [BrowserUpdateSched] C:\WINDOWS\system32\lwinprag.exe CORN001 O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O4 - Startup: PowerReg Scheduler V3.exe O4 - Startup: Zeno.lnk = C:\WINDOWS\system32\lwinprag.exe O4 - Startup: Z_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\dnpo0173e.dll Update ewido, don't scan yet. Please download Look2Me-Destroyer.exe -> http://www.atribune.org/ccount/click.php?id=7 to your desktop. * Close all windows before continuing. * Double-click Look2Me-Destroyer.exe to run it. * Put a check next to Run this program as a task. * You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK * When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal. * Once it's done scanning, click the Remove L2M button. * You will receive a Done Scanning message, click OK. * When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK. * Your computer will then shutdown. * Turn your computer back on. If you receive a message from your firewall about this program accessing the internet please allow it. If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory. http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX After that, boot in safe mode(tap F8 while booting). Delete these, if found: C:\Program Files\TheSearchAccelerator C:\Program Files\Save C:\Program Files\MediaGateway C:\PROGRA~1\NEWDOT~1 C:\WINDOWS\bxxs5.dll C:\windows\gimmygames11.exe C:\windows\system32\qodsregl.exe C:\WINDOWS\system32\lwinprag.exe C:\Program Files\Common Files\VCClient C:\WINDOWS\system32\dwdsregt.exe Scan with ewido and save report. Reboot, post a fresh HjT log, ewido report and the contents of C:\Look2Me-Destroyer.txt
ok, I followed all your instructions. HJT log Logfile of HijackThis v1.99.1 Scan saved at 9:07:41 AM, on 3/8/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv2.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InfoMyCa.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\AIM\aim.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Nikon\NkView6\NkvMon.exe C:\WINDOWS\system32\WTablet\TabUserW.exe C:\Documents and Settings\Brian\Desktop\HijackThis.exe O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [WUSB54Gv2] C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU) O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\PROGRA~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe O23 - Service: WUSB54Gv2SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv2.exe (file missing) ------------------------ --------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 9:07:19 AM, 3/8/2006 + Report-Checksum: DAAE2EF0 + Scan result: HKLM\SOFTWARE\Bookedspace -> Adware.BookedSpace : Cleaned with backup HKLM\SOFTWARE\Bookedspace\adware -> Adware.BookedSpace : Cleaned with backup HKLM\SOFTWARE\Classes\AppID\BookedSpace.DLL -> Adware.BookedSpace : Cleaned with backup HKLM\SOFTWARE\Classes\BookedSpace.Extension -> Adware.BookedSpace : Cleaned with backup HKLM\SOFTWARE\Classes\BookedSpace.Extension\CLSID -> Adware.BookedSpace : Cleaned with backup HKLM\SOFTWARE\Classes\BookedSpace.Extension\CurVer -> Adware.BookedSpace : Cleaned with backup HKLM\SOFTWARE\Classes\BookedSpace.Extension.5 -> Adware.BookedSpace : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7} -> Adware.Generic : Cleaned with backup HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : Cleaned with backup HKU\S-1-5-21-861567501-1592454029-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{06E9293B-0874-4C97-3FF4-7898452B2624} -> Adware.CoolWebSearch : Cleaned with backup HKU\S-1-5-21-861567501-1592454029-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1AF18045-4D83-E152-D7A2-959F8F68F521} -> Adware.CoolWebSearch : Cleaned with backup HKU\S-1-5-21-861567501-1592454029-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} -> Adware.ZangoSearch : Cleaned with backup HKU\S-1-5-21-861567501-1592454029-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2CD07202-010F-F43B-5FF3-91C29B34AAF2} -> Adware.CoolWebSearch : Cleaned with backup HKU\S-1-5-21-861567501-1592454029-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{56F1D444-11BF-4879-A12B-79CF0177F038} -> Adware.180Solutions : Cleaned with backup HKU\S-1-5-21-861567501-1592454029-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6001CDF7-6F45-471B-A203-0225615E35A7} -> Adware.Generic : Cleaned with backup HKU\S-1-5-21-861567501-1592454029-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D5622A73-BE5E-84D8-3B85-F319536A4696} -> Adware.CoolWebSearch : Cleaned with backup HKU\S-1-5-21-861567501-1592454029-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EA0D26BD-9029-431A-86E0-83152D67828A} -> Adware.180Solutions : Cleaned with backup HKU\S-1-5-21-861567501-1592454029-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBFF6A4-6C0F-E57F-4DCD-3DECF316CA20} -> Adware.CoolWebSearch : Cleaned with backup :mozilla.8:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.9:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.10:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.31:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.32:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup :mozilla.43:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.44:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.45:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup :mozilla.46:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup :mozilla.47:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.48:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.49:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.50:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup :mozilla.51:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup :mozilla.52:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup :mozilla.54:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.55:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.56:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.57:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.58:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.59:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup :mozilla.69:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.70:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.71:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.72:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup :mozilla.73:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.74:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.75:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup :mozilla.76:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup :mozilla.77:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup :mozilla.78:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup :mozilla.79:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup :mozilla.86:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup :mozilla.87:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup :mozilla.88:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.89:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup :mozilla.94:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup :mozilla.95:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup :mozilla.147:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.148:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.149:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup :mozilla.173:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.174:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.175:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.176:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.177:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.178:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.179:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.180:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup :mozilla.344:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.345:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.346:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.347:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.348:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.349:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.350:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.351:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.352:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.353:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup :mozilla.376:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Starware : Cleaned with backup :mozilla.379:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Starware : Cleaned with backup :mozilla.542:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup :mozilla.543:C:\Documents and Settings\Brian\Application Data\Mozilla\Firefox\Profiles\i222h3im.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@abcsearch[1].txt -> TrackingCookie.Abcsearch : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@adrevolver[5].txt -> TrackingCookie.Adrevolver : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ads.realcastmedia[1].txt -> TrackingCookie.Realcastmedia : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ads1.revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@as-eu.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@as-us.falkag[2].txt -> TrackingCookie.Falkag : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@as1.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@bfast[1].txt -> TrackingCookie.Bfast : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@c.goclick[2].txt -> TrackingCookie.Goclick : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@cartoonnetwork.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@clickbank[2].txt -> TrackingCookie.Clickbank : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@com[2].txt -> TrackingCookie.Com : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@counter13.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@counter4.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@counter5.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@counter6.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ehg-adteractive.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ehg-cafepress.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ehg-darksideprod.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ehg-maniatv.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ehg-newegg.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ehg-slideinc.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ehg-upperdeck.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@ehg-wacomtechnology.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@esads.valuead[1].txt -> TrackingCookie.Valuead : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@h.starware[1].txt -> TrackingCookie.Starware : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@hg1.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@hotlog[2].txt -> TrackingCookie.Hotlog : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@kmpads[2].txt -> TrackingCookie.Kmpads : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@komtrack[2].txt -> TrackingCookie.Komtrack : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@linksynergy[2].txt -> TrackingCookie.Linksynergy : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@overture[1].txt -> TrackingCookie.Overture : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@prizeamerica.aavalue[2].txt -> TrackingCookie.Aavalue : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@qksrv[1].txt -> TrackingCookie.Qksrv : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@reduxads.valuead[1].txt -> TrackingCookie.Valuead : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@revenue[2].txt -> TrackingCookie.Revenue : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@sel.as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@server3.web-stat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@sexlist[2].txt -> TrackingCookie.Sexlist : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@spylog[2].txt -> TrackingCookie.Spylog : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@starware[2].txt -> TrackingCookie.Starware : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@stat.onestat[1].txt -> TrackingCookie.Onestat : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@stats.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@targetnet[1].txt -> TrackingCookie.Targetnet : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@valuead[2].txt -> TrackingCookie.Valuead : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@www.myaffiliateprogram[2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@www.starware[1].txt -> TrackingCookie.Starware : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@yadro[2].txt -> TrackingCookie.Yadro : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned with backup C:\Documents and Settings\Brian\Cookies\brian@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup C:\Documents and Settings\Brian\Desktop\huo\RobotArena2-dm.exe -> Adware.Trymedia : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@ads.realcastmedia[1].txt -> TrackingCookie.Realcastmedia : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@as-eu.falkag[2].txt -> TrackingCookie.Falkag : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@c5.zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@com[2].txt -> TrackingCookie.Com : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@counter9.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@media.fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@overture[1].txt -> TrackingCookie.Overture : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@paycounter[1].txt -> TrackingCookie.Paycounter : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@prizeamerica.aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@sel.as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@sexlist[2].txt -> TrackingCookie.Sexlist : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@sextracker[2].txt -> TrackingCookie.Sextracker : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@stats.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@targetnet[1].txt -> TrackingCookie.Targetnet : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@webstat[1].txt -> TrackingCookie.Web-stat : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@www.directnetadvertising[1].txt -> TrackingCookie.Directnetadvertising : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@xads.zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temp\Cookies\brian@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temporary Internet Files\Content.IE5\11C6BUV2\ucmoreiex[1].exe/UCMTSAIE.DLL -> Adware.Ucmore : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temporary Internet Files\Content.IE5\11C6BUV2\ucmoreiex[1].exe/IUCMORE.DLL -> Adware.Ucmore : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temporary Internet Files\Content.IE5\C1QZYHW9\Installer[1].exe -> Adware.Look2Me : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temporary Internet Files\Content.IE5\MG9RVI5Z\ZICORN001[1].exe -> Adware.ZenoSearch : Cleaned with backup C:\Documents and Settings\Brian\Local Settings\Temporary Internet Files\Content.IE5\UVG5OTU3\NNSCAA638[1].EXE -> Adware.NewDotNet : Cleaned with backup C:\Downloads\RobotArena2-dm[1].exe -> Adware.Trymedia : Cleaned with backup C:\Downloads\Worms3DSetup-dm[1].exe -> Adware.Trymedia : Cleaned with backup C:\drsmartload1.exe -> Downloader.Adload.u : Cleaned with backup C:\Installer.exe -> Adware.Look2Me : Cleaned with backup C:\RECYCLER\S-1-5-21-861567501-1592454029-682003330-1003\Dc1.exe/UCMTSAIE.DLL -> Adware.Ucmore : Cleaned with backup C:\RECYCLER\S-1-5-21-861567501-1592454029-682003330-1003\Dc1.exe/IUCMORE.DLL -> Adware.Ucmore : Cleaned with backup C:\RECYCLER\S-1-5-21-861567501-1592454029-682003330-1003\Dc11.dll -> Adware.BookedSpace : Cleaned with backup C:\RECYCLER\S-1-5-21-861567501-1592454029-682003330-1003\Dc13.exe -> Downloader.Adload.u : Cleaned with backup C:\RECYCLER\S-1-5-21-861567501-1592454029-682003330-1003\Dc14.exe -> Adware.ZenoSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-861567501-1592454029-682003330-1003\Dc17.exe -> Adware.ZenoSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-861567501-1592454029-682003330-1003\Dc3.exe -> Adware.ZenoSearch : Cleaned with backup C:\RECYCLER\S-1-5-21-861567501-1592454029-682003330-1003\Dc5.EXE -> Adware.NewDotNet : Cleaned with backup C:\WINDOWS\bsx32 -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI2.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3ABSPLAT.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3ACCUQ.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3AMERS.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3ASKNOW2.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3CARQ.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3CARQ2.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3CCB.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3CHOCPBMM.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3CHRISMORT.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3CREDITCARD.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3DIRTYH.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3ENDOMET.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3FREECS.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3FREEIPOD.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3FREEIPOD2.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3FREEXBOX.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3HAIRLOSS.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3HYDRO.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3KAN1.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3KAN10.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3KAN11.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3KAN12.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3KAN2.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3KAN6.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3KAN7.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3LEXREPAIR.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3LMORON.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3LOWRATE.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3MYDISH.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3MYINKS.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3NETFLIX2.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3ODYSSEY.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3PARTYPOKER.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3PASSION.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3PCHSWEEPS.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3POP.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3SPORTSINT.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3SUPERIOR.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI3WEIGHTL.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASI5AFF.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASICLRE.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASIEPRE.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASIPP.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASIRCPRE.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASISS2RE.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\ASISSRE.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\EECH1.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\MYGEEK.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\SPECAUTO.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\SPECENTER.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\SPZ3.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPC.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPD.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPE.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPF.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPFAM.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPFI.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPFIN.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPG.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPH.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPHL.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPJ.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPM.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPMTV.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPN.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPR.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPS.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPSHOP.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPSP.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\bsx32\TMPW.bsx -> Adware.BookedSpace : Cleaned with backup C:\WINDOWS\NDNuninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup C:\WINDOWS\NDNuninstall7_22.exe -> Adware.NewDotNet : Cleaned with backup ::Report End --------------------- Look2Me-Destroyer V1.0.7 Scanning for infected files..... Scan started at 3/7/2006 11:41:02 PM Infected! C:\WINDOWS\system32\dnpo0173e.dll Infected! C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP284\A0041302.dll Infected! C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP288\A0041626.dll Infected! C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP289\A0041806.dll Infected! C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP289\A0041816.dll Infected! C:\WINDOWS\system32\dnpo0173e.dll Infected! C:\WINDOWS\system32\i2lo0c33ef.dll Infected! C:\WINDOWS\system32\guard.tmp Attempting to delete infected files... Attempting to delete: C:\WINDOWS\system32\dnpo0173e.dll C:\WINDOWS\system32\dnpo0173e.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP284\A0041302.dll C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP284\A0041302.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP288\A0041626.dll C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP288\A0041626.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP289\A0041806.dll C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP289\A0041806.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP289\A0041816.dll C:\System Volume Information\_restore{B9B2D4C3-00DA-4673-A2FB-408ABD337D19}\RP289\A0041816.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\dnpo0173e.dll C:\WINDOWS\system32\dnpo0173e.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\i2lo0c33ef.dll C:\WINDOWS\system32\i2lo0c33ef.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\guard.tmp C:\WINDOWS\system32\guard.tmp Deleted successfully! Making registry repairs. Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellServiceObjectDelayLoad Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{DD16A29C-746E-4977-AC0C-9AC966DBB6A1}" HKCR\Clsid\{DD16A29C-746E-4977-AC0C-9AC966DBB6A1} Restoring Windows certificates. Replaced hosts file with default windows hosts file Restoring SeDebugPrivilege for Administrators - Succeeded everything seems to be fine, no more pop-ups(that aren't the regular kind) except the text is still very small....
ir's alright, im so grateful that I could have this much help, and no more pop-ups, can you tell me where I can learn these sort of things, so I don't have to depend on other people, and can help others?
There are some "HjT schools" you can sign in, see: http://forum.malwareremoval.com/viewtopic.php?t=233 http://forums.spywareinfo.com/index.php?showtopic=34 http://forums.tomcoyote.org/index.php?showtopic=1421 http://www.geekstogo.com/forum/index.php?showtopic=4817 http://www.bleepingcomputer.com/forums/Help-Wanted-t4970.html
