[samipi]

hello! i had a MASSIVE attack/issue a couple days ago, and, based on various webforums and threads on geekstogo, i think i managed to help myself a bit (i ran Ad-w-a-r-e's uninstaller, i deleted/uninstalled TSA and everything related to the wzkk folder and it's files), but i'm a little unclear if i've cleaned everything and how to protect myself on a go forward basis.

1) i ran AdAware's vx2 cleaner and it told me a new variant was found, could not clean.

2) i ran look2medestroyer

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 4/5/2006 10:52:11 PM

Infected! C:\WINDOWS\system32\l04qlah51d4.dll
Infected! C:\WINDOWS\system32\fp4203hoe.dll
Infected! C:\WINDOWS\system32\l04qlah51d4.dll
Infected! C:\WINDOWS\system32\lmcmgr10.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\l04qlah51d4.dll
C:\WINDOWS\system32\l04qlah51d4.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\fp4203hoe.dll
C:\WINDOWS\system32\fp4203hoe.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\l04qlah51d4.dll
C:\WINDOWS\system32\l04qlah51d4.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\lmcmgr10.dll
C:\WINDOWS\system32\lmcmgr10.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Telephony

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{69D5836D-03C2-40B3-8F8A-A9F226D0ACBA}"
HKCR\Clsid\{69D5836D-03C2-40B3-8F8A-A9F226D0ACBA}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded

3) i ran AdAware in SafeMode. there was one *.dll it couldn't delete, so i chose the "delete on reboot option"

4) rebooted

5) i ran AdAware in Normal Mode. everything seemed to go all right. i ran the vx2 plug-in again and i got a "system clean" report.

6) i ran HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 11:22:21 PM, on 4/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\blvygmjA.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\blvygmj.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.library.ubc.ca:8000
R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O4 - HKLM\..\Run: [blvygmjA] C:\WINDOWS\blvygmjA.exe
O4 - HKLM\..\RunServices: [Msn Messenger] msnmsg.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PowerPanel.lnk = ?
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: Yahoo! Dots - http://download.game...ts/y/dtt1_x.cab
O16 - DPF: Yahoo! Fleet - http://download.game...s/y/fltt3_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.game...ts/y/grt5_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt3_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt1_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postb...l/sesam/CAX.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} - http://www.miniclip....ro64_loader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...llInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B4C8B699-2587-443D-9364-8CF33778071D} (Component Class) - http://login.hanbito.../com/LSnSSO.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\blvygmj.exe

7) my problem right now is that my computer is a little buggy acting. the popups seem to have stopped (or at least slowed)... but i find that my scroll button is not working and my cursor seems to jump around a lot. also my display is a little off... the icons are really raggedy around the edges (like a poorly saved invisible *.gif)? i'm not sure if these issues are relevant or if this is just my computer getting old.

8) and, as stated before, I know there is more that needs to be done to do a second run through and to protect my computer futher.

Thank you in advance to anyone who can help me out! ^_^

[Advertisements]

Hi samipi, and welcome to Geeks to Go.

I'm currently analyzing your log, and will post instructions to start with the clean up soon .

[Antartic-Boy]

Hi samipi, and welcome to Geeks to Go.

I'm currently analyzing your log, and will post instructions to start with the clean up soon .

[Antartic-Boy]

-----------------------1

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O4 - HKLM\..\Run: [blvygmjA] C:\WINDOWS\blvygmjA.exe
O4 - HKLM\..\RunServices: [Msn Messenger] msnmsg.exe
O4 - Global Startup: PowerPanel.lnk = ?
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\blvygmj.exe

Now close all windows and browsers other than HiJackThis, then click Fix Checked.
Close HijackThis.

-----------------------2

Please follow the instructions provided, you may want to print out these instructions and use them as a reference.

Please download ewido anti-malware it is a free version of the program.

• Install ewido anti-malware
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display ("Update successful")

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Let it update and then close ewido anti-malware.

-----------------------3

Now please save these instructions in notepad for use in Safe Mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Now please unhide hidden files and folders:

1.Click Start.
2.Open My Computer.
3.Select the Tools menu and click Folder Options.
4.Select the View Tab.
5.Under the Hidden files and folders heading select Show hidden files and folders.
6.Uncheck the Hide protected operating system files (recommended) option.
7.Click Yes to confirm.
8.Click OK.

Now please delete these files & folders using Microsoft explorer (if present):
To run Microsoft explorer please go to Start -> Run -> type in explorer -> click on OK button

C:\WINDOWS\blvygmjA.exe
C:\Program Files\AWS\WeatherBug\
C:\Program Files\Network Monitor\
C:\WINDOWS\blvygmj.exe

Now hide hidden files and folders:

1.Click Start.
2.Open My Computer.
3.Select the Tools menu and click Folder Options.
4.Select the View Tab.
5.Under the Hidden files and folders heading select Show hidden files and folders.
6.Check the Hide protected operating system files (recommended) option.
7.Click Yes to confirm.
8.Click OK.

Now do the following:

• Run Ewido
• Click on scanner
• Click on Complete System Scan and the scan will begin.
• You will be prompted to clean the first infection.
• Select "Perform action on all infections", then proceed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

Restart in normal mode..

-----------------------4

Go to right click on desktop -> Properties -> select the Desktop tab -> click Customize Desktop... -> select the Web tab -> uncheck all checkboxes.

Now go to Start -> Control Panel -> System -> Advanced Tab -> Click on Performance's Settings button -> In Visual Effects find and check the checkbox next to Use drop shadows for icon labels on the desktop -> OK -> OK.


Go to right click on Desktop -> Properties -> Settings -> under Color quality choose 32 bit mode -> Ok.

-----------------------5

Now please post me the Ewido Log along with the Hjt Log and tell me how is the computer running now,,

[samipi]

hi antartic-boy!

thanks for the fabulously clear instructions!

here is my ewido log:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 7:06:13 AM, 4/6/2006
+ Report-Checksum: 95196A2B

+ Scan result:

HKU\S-1-5-21-1906211764-2690133624-1694720459-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6001CDF7-6F45-471B-A203-0225615E35A7} -> Adware.Generic : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@-1shz2prbmdj6wvny-1sez2pra2dj6wjkyegdzehoq-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@-1shz2prbmdj6wvny-1sez2pra2dj6wjnyeidjagow-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@-1shz2prbmdj6wvny-1sez2pra2dj6wjnygiczifqq-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@a-1shz2prbmdj6wvny-1sez2pra2dj6wjk4kkdzclqq-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@a-1shz2prbmdj6wvny-1sez2pra2dj6wjkogldjgkqa-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@a-1shz2prbmdj6wvny-1sez2pra2dj6wjl4endjohpw-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@a-1shz2prbmdj6wvny-1sez2pra2dj6wjlygocjmeqq-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@a-1shz2prbmdj6wvny-1sez2pra2dj6wjnyeidjagow-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@a-1shz2prbmdj6wvny-1sez2pra2dj6wjnygiczifqq-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Adocean : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Clickhype : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@adorigin[2].txt -> TrackingCookie.Adorigin : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Adorigin : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Bpath : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Lop : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Grandonline : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Searchingbooth : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Enhance : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@com[1].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@goldenpalace[1].txt -> TrackingCookie.Goldenpalace : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@grandonline[1].txt -> TrackingCookie.Grandonline : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Masterstats : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@kmpads[2].txt -> TrackingCookie.Kmpads : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Top-banners : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@paypopup[2].txt -> TrackingCookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Popularix : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@revenue[2].txt -> TrackingCookie.Revenue : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Reliablestats : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][1].txt -> TrackingCookie.Realcastmedia : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha [email protected][2].txt -> TrackingCookie.Web-stat : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wfk4klcpslqqidj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wfk4slczoapwydj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wfkiagcpsgpg2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wfkialczceoaudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wfkisgczweqaidj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wfkokocpchoqudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wfkyooajgcqqydj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wfkyqmczcdpwqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wfkywmazsapqydj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjk4anajohoqidj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjk4epc5gdowudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjk4qmajceogudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjk4skcpigoqidj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjk4uid5seqq2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjk4wkajmbpwidj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjk4wmcpcfpaidj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkocgc5oeqq6dj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkoeocpkfoa6dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkogkcjmdowwdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkookdjwdoaqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkoondpehpasdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkosjazcepgqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkoujczcdqasdj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkoumdzglqqudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkoundpefogsdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkyanaziaoqqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkygnazckoqidj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkyoncpcgowqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjkywoczwkpgwdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjl4snczolqa6dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlianajocqaudj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlianc5egqq2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlienczafoqudj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlieocjocpqydj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjliqndpofowydj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjliwnc5sfoqudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjloepdzwhogudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlokhd5eaqqwdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjloulc5mhpqudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlyagcpseoa2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlycoazahpq6dj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlyondzecqqidj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlyqmdjihpwydj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlyspcjkkoqsdj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlyulczidow2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjlywmdpigqqudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmikmd5ogowqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmiwkajidowsdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmyglajwdpqudj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmygndjwkowqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmykkdjmcpa6dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmyojcpwhpg6dj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmyoodjihpw6dj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmyqld5gdpq6dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmyuhajilow2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmyuicpsgpgqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyaid5ohoawdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyeicjmcpqwdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyelazgaoaqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyemc5adqa2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnygldpwbpqidj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyomdzmeqaydj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyqjdpekoqydj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnysid5sdoa6dj6x9ny-1seq-2-2.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnysmc5igqqqdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyuoazidoa2dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnywocpcboa6dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Cookies\samantha mak@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\!update.exe -> Downloader.PurityScan.w : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha [email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha [email protected][1].txt -> TrackingCookie.Searchingbooth : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha mak@bestoffersnetworks[2].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha mak@cliks[2].txt -> TrackingCookie.Cliks : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha mak@com[1].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha mak@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha [email protected][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha mak@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha [email protected][1].txt -> TrackingCookie.Top-banners : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Cookies\samantha [email protected][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\i25.tmp -> Adware.SurfSide : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Temporary Internet Files\Content.IE5\72O3JP41\send_ocx_sof[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Temporary Internet Files\Content.IE5\EH1AVM54\send_ocx_sof[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\Temporary Internet Files\Content.IE5\L7BF5LWE\send_car_int[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\u30.tmp -> Adware.SurfSide : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temp\u33.tmp -> Adware.SurfSide : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temporary Internet Files\Content.IE5\1BR3X9CE\!update-3620[1].0000 -> Downloader.PurityScan.w : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temporary Internet Files\Content.IE5\1BR3X9CE\drsmartload[1].exe -> Downloader.VB.ut : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temporary Internet Files\Content.IE5\1BR3X9CE\send_ocx_sof[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temporary Internet Files\Content.IE5\1BR3X9CE\visfx500[1].exe -> Dropper.Agent.aie : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temporary Internet Files\Content.IE5\4TYRO1Q3\AppWrap[1].exe -> Adware.AdURL : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temporary Internet Files\Content.IE5\70W829IU\send_car_int[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temporary Internet Files\Content.IE5\JB3NV8CJ\keyboard8[1].exe -> Downloader.VB.aaa : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temporary Internet Files\Content.IE5\KFJRM8LD\newname8[1].exe -> Downloader.Adload.ae : Cleaned with backup
C:\Documents and Settings\Samantha Mak\Local Settings\Temporary Internet Files\Content.IE5\KFJRM8LD\send_ocx_sof[2].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
C:\RECYCLER\S-1-5-21-1906211764-2690133624-1694720459-1005\Dc4.exe -> Hijacker.VB.ij : Cleaned with backup
C:\RECYCLER\S-1-5-21-1906211764-2690133624-1694720459-1005\Dc5.exe -> Hijacker.VB.ij : Cleaned with backup
C:\WINDOWS\DH.dll -> Hijacker.Small.jf : Cleaned with backup
C:\WINDOWS\icont.exe -> Adware.AdURL : Cleaned with backup
C:\WINDOWS\keyboard8.exe -> Downloader.VB.aaa : Cleaned with backup
C:\WINDOWS\mousepad8.exe -> Trojan.VB.ali : Cleaned with backup
C:\WINDOWS\newname8.exe -> Downloader.Adload.ae : Cleaned with backup
C:\WINDOWS\SYSC00.exe -> Trojan.VB.tg : Cleaned with backup
C:\WINDOWS\system32\ad.html -> Hijacker.Agent.e : Cleaned with backup
C:\WINDOWS\system32\axuninstall.exe -> Adware.BlazeFind : Cleaned with backup
C:\WINDOWS\Temp\bw2.com -> Adware.AdURL : Cleaned with backup
C:\WINDOWS\Temp\Cookies\samantha [email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\WINDOWS\Temp\Cookies\samantha mak@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\WINDOWS\Temp\Cookies\samantha mak@kmpads[2].txt -> TrackingCookie.Kmpads : Cleaned with backup
C:\WINDOWS\Temp\Cookies\samantha [email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\WINDOWS\Temp\Cookies\samantha [email protected][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\WEJFZTNG\send_ocx_sof[2].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
C:\WINDOWS\unin101.exe -> Trojan.VB.tg : Cleaned with backup
C:\WINDOWS\uni_eh.exe -> Trojan.VB.tg : Cleaned with backup


::Report End

here is my HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 10:41:42 PM, on 4/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Ewido\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk...html?world=0262
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.library.ubc.ca:8000
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: Yahoo! Dots - http://download.game...ts/y/dtt1_x.cab
O16 - DPF: Yahoo! Fleet - http://download.game...s/y/fltt3_x.cab
O16 - DPF: Yahoo! Graffiti - http://download.game...ts/y/grt5_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt3_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt1_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postb...l/sesam/CAX.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} - http://www.miniclip....ro64_loader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...llInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B4C8B699-2587-443D-9364-8CF33778071D} (Component Class) - http://login.hanbito.../com/LSnSSO.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Ewido\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe

please let me know if everything looks clear! but things seem to be running fine. startup and shutdown times seem better than ever before! my scroll button is still not working, but i suspect that i may have accidentally deleted the driver or something related to it when i was trying to fix things myself.

[Antartic-Boy]

-----------------------1

Download and install CleanUp!
NOTE: Do NOT run this program if you have XP Professional 64 bit edition.

To find out which operating system your computer is running, first click Start, and then click Run. In the box that appears, type winver, and then click OK. The window that appears will show you which version of Windows your computer is using. If you see 64-Bit Edition in the product name along with Windows XP go to -----------------------2, if not proceed with the instructions of -----------------------1 and then go to -----------------------3...



Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files (if present)
• Cleanup! All Users

Click OK
Press the CleanUp! button to start the program.

It may ask you to log-off/reboot at the end, if it does please do so.

-----------------------2

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

-----------------------3

Please post me new Ewido Log (from normal mode) along with a fresh Hjt Log..

[samipi]

hello! here is my new ewido log after running CleanUp.

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 2:59:26 AM, 4/8/2006
+ Report-Checksum: BBAD459E

+ Scan result:

No infected objects found.


::Report End

and here is the new HJT.

Logfile of HijackThis v1.99.1
Scan saved at 3:00:54 AM, on 4/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec

Shared\ccEvtMgr.exe
C:\Program Files\Ewido\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\Common Files\Symantec

Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://www.bbc.co.uk...html?world=0262
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Internet Connection

Wizard,ShellNext = http://www.sony.com/vaiopeople
R1 -

HKCU\Software\Microsoft\Windows\CurrentVersion\Int

ernet Settings,ProxyServer =

proxy.library.ubc.ca:8000
F2 - REG:system.ini: UserInit=c:\windows\system32

\userinit.exe
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-

4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton

AntiVirus\NavShExt.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-

8A56-BBB695989046} - C:\Program

Files\ICQToolbar\toolbaru.dll
O4 - Global Startup: Adobe Gamma Loader.exe.lnk =

C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk

= C:\Program Files\adobe\Acrobat 7.0

\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk =

C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search

- res://C:\Program

Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D

-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f

-A54D-A2CD196348E9} - C:\Program

Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A

-26C3-4e1f-A54D-A2CD196348E9} - C:\Program

Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-

11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF:

START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: Yahoo! Dots -

http://download.game...es/clients/y/dt

t1_x.cab
O16 - DPF: Yahoo! Fleet -

http://download.game...es/clients/y/fl

tt3_x.cab
O16 - DPF: Yahoo! Graffiti -

http://download.game...es/clients/y/gr

t5_x.cab
O16 - DPF: Yahoo! Literati -

http://download.game...es/clients/y/tt

3_x.cab
O16 - DPF: Yahoo! Poker -

http://download.game...es/clients/y/pt

1_x.cab
O16 - DPF: Yahoo! Pool 2 -

http://download.game...es/clients/y/po

te_x.cab
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183}

(CryptoRSA Control) -

https://www.p3.postb...l/sesam/CAX.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}

(Checkers Class) -

http://messenger.zon...y/msgrchkr.cab3

1267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC}

(MessengerStatsClient Class) -

http://messenger.zon...y/MessengerStat

sPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}

(Windows Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?

linkid=36467&clcid=0x409
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98}

-

http://www.miniclip..../retro64_loader

.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B}

(Minesweeper Flags Class) -

http://messenger.zon...y/MineSweeper.c

ab31267.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C}

-

http://a1540.g.akama.../20041101/qtins

tall.info.apple.com/pthalo/us/win/QuickTimeFullIns

taller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537}

(MSN Photo Upload Tool) -

http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE}

(Housecall ActiveX 6.5) -

http://housecall65.t...ousecall/applet

/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zon...y/MessengerStat

sClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}

(MsnMessengerSetupDownloadControl Class) -

http://messenger.msn...snMessengerSetu

pDownloader.cab
O16 - DPF: {B4C8B699-2587-443D-9364-8CF33778071D}

(Component Class) -

http://login.hanbito.../com/LSnSSO.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592}

(ZoneIntro Class) -

http://messenger.zon...y/ZIntro.cab328

46.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF}

(Solitaire Showdown Class) -

http://messenger.zon...y/SolitaireShow

down.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-

8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll"

(file missing)
O20 - Winlogon Notify: igfxcui -

C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) -

Symantec Corporation - C:\Program Files\Common

Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation

Service (ccPwdSvc) - Symantec Corporation -

C:\Program Files\Common Files\Symantec

Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control -

ewido networks - C:\Program

Files\Ewido\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple

Computer, Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect

Service (navapsvc) - Symantec Corporation -

C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Retrospect Launcher (RetroLauncher)

- Dantz Development Corporation - C:\Program

Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc)

- Dantz Development Corporation - C:\PROGRA~1

\Dantz\RETROS~1\wdsvc.exe
O23 - Service: ScriptBlocking Service (SBService)

- Symantec Corporation - C:\PROGRA~1\COMMON~1

\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony

Corporation - C:\Program Files\Common Files\Sony

Shared\AVLib\SPTISRV.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec

Corporation - C:\Program Files\Common

Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TabletService - Wacom Technology,

Corp. - C:\WINDOWS\System32\Tablet.exe

Thank you again!

[Antartic-Boy]

----------------------->

Great job it appears your logfile is clean.

The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

• Spybot Search & Destroy - Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.
  
• AdAware - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.
• SpywareBlaster - Great prevention tool to keep nasties from installing on your system.
  
• SpywareGuard - Works as a Spyware "Shield" to protect your computer from getting malware in the first place.
  
• IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
• CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
• Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
• Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.
• Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

[Antartic-Boy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.