Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

IE6 Browser has been taken over! Help! [RESOLVED]

Started by SilverWingz , Jul 12 2005 11:55 PM

This topic is locked

#46
Rawe

Posted 19 July 2005 - 08:05 AM

Visiting Staff

Member
4,746 posts

Download the following zip file;

Rawe.zip

Unzip it to your desktop, double-click Rawe.bat and post the log from notepad. :tazz:

(Along with the Activescan log)

#47
SilverWingz

Posted 19 July 2005 - 08:46 AM

Member

Topic Starter
Member
53 posts

I can't run it. It tells me that it requires Internet Explorer to run. Panda Active scan that is.

Edited by SilverWingz, 19 July 2005 - 08:47 AM.

#48
Rawe

Posted 19 July 2005 - 08:48 AM

Visiting Staff

Member
4,746 posts

Yea, true. Run it with IE. :tazz:

Unless you have problems with using IE?

#49
SilverWingz

Posted 19 July 2005 - 08:49 AM

Member

Topic Starter
Member
53 posts

And on the Rawe.zip, it tells me that an error has occurred and that some required files are missing. They've either been deleted or moved.

#50
SilverWingz

Posted 19 July 2005 - 08:51 AM

Member

Topic Starter
Member
53 posts

Yes, I can't use IE cuz of this anonymizer on my system. It takes forever to load anything (like 10-15 minutes) because of this thing on my system. And it won't go to the panda website. I'll get a page error and a box from anonymizer asking me to enter the addy to the website I wish to visit and then when I enter that, it still doesn't go, it still gives me a 404 Page error.

#51
SilverWingz

Posted 19 July 2005 - 08:53 AM

Member

Topic Starter
Member
53 posts

All of this trouble with IE is why I came here to begin with! That is the problem we've supposedly been working on to get rid of and free my IE!!

#52
Rawe

Posted 19 July 2005 - 08:54 AM

Visiting Staff

Member
4,746 posts

Ok, ignore that part and get to the zip file :tazz:

#53
SilverWingz

Posted 19 July 2005 - 08:56 AM

Member

Topic Starter
Member
53 posts

I cannot get to your zip file. This is what I get when I click on it.......

The error returned was:

Sorry, some required files are missing, if you intended to view a topic, it's possible that it's been moved or deleted. Please go back and try again.

#54
Rawe

Posted 19 July 2005 - 08:58 AM

Visiting Staff

Member
4,746 posts

One quick question here;
do you have more than one account on your PC?
If so, please provide a HiJackThis log from each account :tazz:

#55
SilverWingz

Posted 19 July 2005 - 09:02 AM

Member

Topic Starter
Member
53 posts

Ok, yes, I do share this computer with my children and my mother and we each have a profile, however, to get the information you want, I'll have to run that and get the log files later today as I must go to work right now. Thanks for helping me with this.

#56
Rawe

Posted 19 July 2005 - 09:05 AM

Visiting Staff

Member
4,746 posts

Yea, k.
Just post the logs from each account when you get back from work. :tazz:

#57
Rawe

Posted 19 July 2005 - 09:19 AM

Visiting Staff

Member
4,746 posts

Ok, now this should work;
Rawe.zip
download the zip file and unzip it to your desktop. Double-click on Rawe.bat.
It should open up a notepad with a log-
Copy & paste all the logs content here along with the HiJackThis logs.

- Rawe :tazz:

#58
SilverWingz

Posted 19 July 2005 - 03:38 PM

Member

Topic Starter
Member
53 posts

From the Rawe.exe log:

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"User Agent"="Mozilla/4.0 (compatible; MSIE 6.0; Win32)"
"IE5_UA_Backup_Flag"="5.0"
"NoNetAutodial"=dword:00000000
"MigrateProxy"=dword:00000001
"EnableNegotiate"=dword:00000001
"ProxyEnable"=dword:00000001
"EmailName"="IEUser@"
"AutoConfigProxy"="wininet.dll"
"MimeExclusionListForCache"="multipart/mixed multipart/x-mixed-replace multipart/x-byteranges "
"WarnOnPost"=hex:00,00,00,00
"UseSchannelDirectly"=hex:01,00,00,00
"EnableHttp1_1"=dword:00000001
"PrivacyAdvanced"=dword:00000000
"ProxyHttp1.1"=dword:00000001
"SyncMode5"=dword:00000000
"GlobalUserOffline"=dword:00000000
"WarnOnZoneCrossing"=dword:00000000
"EnableAutodial"=dword:00000000
"SyncMode"=dword:00000000
"PrivDiscUiShown"=dword:00000001
"DnsCacheEnabled"=dword:00000000
"AllowCookies"=dword:00000001
"UrlEncoding"=dword:00000000
"CertificateRevocation"=dword:00000000
"DisableCachingOfSSLPages"=dword:00000000
"SecureProtocols"=dword:00000028
"WarnonBadCertRecving"=dword:00000001
"WarnOnPostRedirect"=dword:00000001
"WarnAlwaysOnPost"=hex:00,00,00,00
"ProxyServer"="invis.free.anonymizer.com:80"

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0]

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache]
"Signature"="Client UrlCache MMF Ver 5.2"

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"PerUserItem"=dword:00000001
"CachePrefix"=""
"CacheLimit"=dword:00020000

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"PerUserItem"=dword:00000001
"CachePrefix"="Cookie:"
"CacheLimit"=dword:00002000

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache]

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012005071920050720]
"CachePath"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,20,00,53,00,65,00,74,\
00,74,00,69,00,6e,00,67,00,73,00,5c,00,48,00,69,00,73,00,74,00,6f,00,72,00,\
79,00,5c,00,48,00,69,00,73,00,74,00,6f,00,72,00,79,00,2e,00,49,00,45,00,35,\
00,5c,00,4d,00,53,00,48,00,69,00,73,00,74,00,30,00,31,00,32,00,30,00,30,00,\
35,00,30,00,37,00,31,00,39,00,32,00,30,00,30,00,35,00,30,00,37,00,32,00,30,\
00,5c,00,00,00
"CachePrefix"=":2005071920050720: "
"CacheLimit"=dword:00002000
"CacheOptions"=dword:0000000b
"CacheRepair"=dword:00000000

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData]
"CachePath"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,55,00,73,00,65,00,72,00,44,00,61,00,74,00,61,00,00,\
00
"CachePrefix"="UserData"
"CacheLimit"=dword:000003e8
"CacheOptions"=dword:00000008
"CacheRepair"=dword:00000000

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"PerUserItem"=dword:00000001
"CachePrefix"="Visited:"
"CacheLimit"=dword:00002000

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache]
"Persistent"=dword:00000001

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Content]
"CacheLimit"=dword:00020000

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Cookies]
"CacheLimit"=dword:00002000

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\History]
"CacheLimit"=dword:00002000

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings"=hex:3c,00,00,00,ce,6f,00,00,02,00,00,00,1c,00,00,00,69,\
6e,76,69,73,2e,66,72,65,65,2e,61,6e,6f,6e,79,6d,69,7a,65,72,2e,63,6f,6d,3a,\
38,30,00,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,80,47,7a,b3,ea,8b,c4,\
01,01,00,00,00,ac,ab,b8,5c,00,00,00,00,00,00,00,00
"DefaultConnectionSettings"=hex:3c,00,00,00,10,00,00,00,03,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,b0,fa,98,6e,31,33,c4,01,\
01,00,00,00,0a,33,2a,cc,00,00,00,00,00,00,00,00
"Modem dial-up"=hex:3c,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00
"The Internet (1)"=hex:3c,00,00,00,20,00,00,00,02,00,00,00,1c,00,00,00,69,6e,\
76,69,73,2e,66,72,65,65,2e,61,6e,6f,6e,79,6d,69,7a,65,72,2e,63,6f,6d,3a,38,\
30,00,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,80,47,7a,b3,ea,8b,c4,01,\
01,00,00,00,ac,ab,b8,5c,00,00,00,00,00,00,00,00
"America Online"=hex:3c,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones]

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0]
@=""
"DisplayName"="My Computer"
"Description"="Your computer"
"Icon"="explorer.exe#0100"
"CurrentLevel"=dword:00000000
"Flags"=dword:00000021
"1001"=dword:00000000
"1004"=dword:00000003
"1200"=dword:00000003
"1201"=dword:00000003
"1206"=dword:00000000
"1400"=dword:00000001
"1402"=dword:00000000
"1405"=dword:00000000
"1406"=dword:00000000
"1407"=dword:00000000
"1601"=dword:00000000
"1604"=dword:00000000
"1605"=dword:00000000
"1606"=dword:00000000
"1607"=dword:00000000
"1608"=dword:00000000
"1609"=dword:00000001
"1800"=dword:00000000
"1802"=dword:00000000
"1803"=dword:00000000
"1804"=dword:00000000
"1805"=dword:00000000
"1806"=dword:00000000
"1807"=dword:00000000
"1808"=dword:00000000
"1809"=dword:00000003
"1A00"=dword:00000000
"1A02"=dword:00000000
"1A03"=dword:00000000
"1A04"=dword:00000003
"1A05"=dword:00000000
"1A06"=dword:00000000
"1A10"=dword:00000000
"1C00"=dword:00000000
"1E05"=dword:00030000
"2000"=dword:00010000
"2100"=dword:00000003
"2101"=dword:00000003
"2102"=dword:00000003
"2200"=dword:00000003
"2201"=dword:00000003

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1]
@=""
"DisplayName"="Local intranet"
"Description"="This zone contains all Web sites that are on your organization's intranet."
"Icon"="shell32.dll#0018"
"CurrentLevel"=dword:00000000
"Flags"=dword:000000db
"1001"=dword:00000001
"1004"=dword:00000003
"1200"=dword:00000003
"1201"=dword:00000003
"1206"=dword:00000000
"1400"=dword:00000001
"1402"=dword:00000000
"1405"=dword:00000000
"1406"=dword:00000001
"1407"=dword:00000000
"1601"=dword:00000000
"1604"=dword:00000000
"1605"=dword:00000000
"1606"=dword:00000000
"1607"=dword:00000000
"1608"=dword:00000000
"1609"=dword:00000001
"1800"=dword:00000001
"1802"=dword:00000000
"1803"=dword:00000000
"1804"=dword:00000001
"1805"=dword:00000000
"1806"=dword:00000000
"1807"=dword:00000000
"1808"=dword:00000000
"1809"=dword:00000003
"1A00"=dword:00020000
"1A02"=dword:00000000
"1A03"=dword:00000000
"1A04"=dword:00000003
"1A05"=dword:00000000
"1A06"=dword:00000000
"1A10"=dword:00000000
"1C00"=dword:00000000
"1E05"=dword:00030000
"2000"=dword:00010000
"2100"=dword:00000003
"2101"=dword:00000003
"2102"=dword:00000003
"2200"=dword:00000003
"2201"=dword:00000003

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2]
@=""
"DisplayName"="Trusted sites"
"Description"="This zone contains Web sites that you trust not to damage your computer or data."
"Icon"="inetcpl.cpl#00004480"
"CurrentLevel"=dword:00000000
"Flags"=dword:00000021
"1001"=dword:00000000
"1004"=dword:00000003
"1200"=dword:00000003
"1201"=dword:00000003
"1206"=dword:00000000
"1400"=dword:00000001
"1402"=dword:00000000
"1405"=dword:00000000
"1406"=dword:00000000
"1407"=dword:00000000
"1601"=dword:00000000
"1604"=dword:00000000
"1605"=dword:00000000
"1606"=dword:00000000
"1607"=dword:00000000
"1608"=dword:00000000
"1609"=dword:00000001
"1800"=dword:00000000
"1802"=dword:00000000
"1803"=dword:00000000
"1804"=dword:00000000
"1805"=dword:00000000
"1806"=dword:00000000
"1807"=dword:00000000
"1808"=dword:00000000
"1809"=dword:00000003
"1A00"=dword:00000000
"1A02"=dword:00000000
"1A03"=dword:00000000
"1A04"=dword:00000003
"1A05"=dword:00000000
"1A06"=dword:00000000
"1A10"=dword:00000000
"1C00"=dword:00000000
"1E05"=dword:00030000
"2000"=dword:00010000
"2100"=dword:00000003
"2101"=dword:00000003
"2102"=dword:00000003
"2200"=dword:00000003
"2201"=dword:00000003

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3]
@=""
"DisplayName"="Internet"
"Description"="This zone contains all Web sites you haven't placed in other zones"
"Icon"="inetcpl.cpl#001313"
"CurrentLevel"=dword:00000000
"Flags"=dword:00000021
"1001"=dword:00000001
"1004"=dword:00000003
"1200"=dword:00000003
"1201"=dword:00000003
"1206"=dword:00000003
"1400"=dword:00000001
"1402"=dword:00000000
"1405"=dword:00000000
"1406"=dword:00000003
"1407"=dword:00000000
"1601"=dword:00000001
"1604"=dword:00000000
"1605"=dword:00000000
"1606"=dword:00000000
"1607"=dword:00000000
"1608"=dword:00000000
"1609"=dword:00000001
"1800"=dword:00000001
"1802"=dword:00000000
"1803"=dword:00000000
"1804"=dword:00000001
"1805"=dword:00000001
"1806"=dword:00000001
"1807"=dword:00000001
"1808"=dword:00000000
"1809"=dword:00000000
"1A00"=dword:00020000
"1A02"=dword:00000000
"1A03"=dword:00000000
"1A04"=dword:00000003
"1A05"=dword:00000001
"1A06"=dword:00000000
"1A10"=dword:00000001
"1C00"=dword:00000000
"1E05"=dword:00030000
"2000"=dword:00010000
"2100"=dword:00000003
"2101"=dword:00000003
"2102"=dword:00000003
"2200"=dword:00000003
"2201"=dword:00000003

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4]
@=""
"DisplayName"="Restricted sites"
"Description"="This zone contains Web sites that could potentially damage your computer or data."
"Icon"="inetcpl.cpl#00004481"
"CurrentLevel"=dword:00000000
"Flags"=dword:00000021
"1001"=dword:00000003
"1004"=dword:00000003
"1200"=dword:00000003
"1201"=dword:00000003
"1206"=dword:00000003
"1400"=dword:00000003
"1402"=dword:00000003
"1405"=dword:00000003
"1406"=dword:00000003
"1407"=dword:00000003
"1601"=dword:00000001
"1604"=dword:00000001
"1605"=dword:00000000
"1606"=dword:00000003
"1607"=dword:00000003
"1608"=dword:00000003
"1609"=dword:00000001
"1800"=dword:00000003
"1802"=dword:00000001
"1803"=dword:00000003
"1804"=dword:00000003
"1805"=dword:00000001
"1806"=dword:00000003
"1807"=dword:00000001
"1808"=dword:00000000
"1809"=dword:00000000
"1A00"=dword:00010000
"1A02"=dword:00000003
"1A03"=dword:00000003
"1A04"=dword:00000003
"1A05"=dword:00000003
"1A06"=dword:00000003
"1A10"=dword:00000003
"1C00"=dword:00000000
"1E05"=dword:00030000
"2000"=dword:00000003
"2100"=dword:00000003
"2101"=dword:00000003
"2102"=dword:00000003
"2200"=dword:00000003
"2201"=dword:00000003

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\100hot.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\247media.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\247realmedia.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\2o7.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\7adpower.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\7search.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\8ad.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\911promotion.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ad-flow.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ad-logics.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ad08.focalink.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adbureau.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adbutler.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adbutler.de]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adbutler.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\addynamix.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adforce.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\admonitor.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\admonitor.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adorigin.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ads.enliven.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ads360.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ads360.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adserver.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adservingcentral.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adtech.de]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adtrak.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adviva.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\adviva.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\atdmt.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\Aureate.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\BankAds.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bannerbank.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bfast.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bluemountain.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bluestreak.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bpath.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\bridgetrack.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\brilliantdigital.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\centrport.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\centrport.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cj.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\click2net.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\clickagents.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\clickfinders.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\comclick.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cometcursor.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cometcursor.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cometcursors.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cometcursors.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commission-junction.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\commissionpartner.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\coremetrics.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\coremetrics.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\Counted.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dbbsrv.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\delphiforums.com]
@=dword:00000001

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\doubleclick.co.uk]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\doubleclick.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\doubleclick.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\e-plus.cc]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ebch.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ebdv.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ebdw.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ebjp.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ebkn.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ebky.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\eblv.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ebvr.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ecwz.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ecyb.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\eduy.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\eeev.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\engage.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\enigmasoftwaregroup.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\epilot.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\euniverseads.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\excite.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ezhits4u.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\falkag.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\falkag.de]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\falkag.org]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastadvert.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fastclick.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\fickenisgeil.de]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\findwhat.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\flycast.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\Flyswat.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\focalink.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\freshgirls.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\gator.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\gatoradvertisinginformationnetwork.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\hightrafficads.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\hitbox.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\hitboxcentral.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\hitslink.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\hotlog.ru]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\hotnaughtywives.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\HyperBanner.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ibmx.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\icwb.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\icwo.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\icwp.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\iddh.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\idhh.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ifiz.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\iguu.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\infinite-ads.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\InternetFuel.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\link4ads.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linkbuddies.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\linksynergy.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\lop.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\mainentrypoint.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\mainentrypoint.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\marketscore.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\marketscore.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\matchcraft.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\mediaplex.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\NarrowCastMedia.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\offshoreclicks.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\opentracker.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\opentracker.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\overture.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\oxcash.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\partnercash.de]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\paycounter.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\paypopup.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\pointroll.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\popupsponsor.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\popuptraffic.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\porntrack.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\porntracker.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\Preferences.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\pstats.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\qksrv.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\questionmarket.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\Radiate.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\rccl.bridgetrack]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\realmedia.fr]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\realtracker.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\realtracker.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\redv.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\res99.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\roispy.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ru4.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\S005-01-4-11-234545-68181.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\samz.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\saoe.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sbjr.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sbnl.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sbnt.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sbvr.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\scbm.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sckr.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\scrk.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sdry.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\seld.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedfor.valuead.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sex-in-www.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sexlist.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sextracker.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sfux.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sheat.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\shopathomeselect.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\sipo.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\site.chatpoint.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\smartadserver.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\smartclicks.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\smartclicks.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\smds.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\specificclick.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\specificpop.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\spermatrix.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\spylog.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\srib.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\srox.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\srsf.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ssaw.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ssby.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\surj.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\targetnet.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\targetnet.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tbvg.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tdak.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tdko.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tefs.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tfil.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\thko.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\torc.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\track-star.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tradedoubler.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\trafficmarketplace.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\trafficmp.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\trafficsupport.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\trafficvenue.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\trakkerd.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\travelocity.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\tribalfusion.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\UtopiAd.com ]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\valuead.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\valueclick.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\valueclick.ne.jp]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\valueclick.net]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-2465002684-2005487890-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\wbkb.com]
@=dword:00000005

[HKEY_USERS\S-1-5-21-3012164751-

#59
SilverWingz

Posted 19 July 2005 - 03:40 PM

Member

Topic Starter
Member
53 posts

Logfile of HijackThis v1.99.1
Scan saved at 4:18:25 PM, on 7/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\lexpps.exe
C:\PROGRA~1\COMMON~1\AOL\110114~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\COMMON~1\AOL\110114~1\EE\AOLServiceHost.exe
C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe
C:\Program Files\America Online 9.0c\waol.exe
C:\PROGRA~1\BARBAR~1\Webshots\webshots.scr
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\America Online 9.0c\shellmon.exe
C:\Documents and Settings\Markie Cooper\Desktop\Spyware tools\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1101148709\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOLCC] "C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe" /startup
O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.exe" -turbo -NOREBOOT -silent -checkonly
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0c\AOL.EXE" -b
O4 - Startup: Webshots.lnk = C:\Program Files\Barbara's downloads\Webshots\Launcher.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31932A5C-9234-4377-A920-72E7DD340DB4} (Snapfish File Upload ActiveX Control) - http://www.mysticcol...ysticUpload.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol....oach_core_1.cab
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/...pandaonline.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/...bGameLoader.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.a...83/mcinsctl.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.co...clean_micro.exe
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8B6193F1-837F-11D4-89E6-0050DA666184} (Sol2axctl Class) - http://download.soli...d/solitaire.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.del...t/TLIEFlash.CAB
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - https://objects.aol....,20/McGDMgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...ta/SymAData.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/...fault/shapo.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/...WebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aol133.pogo.c...aploader_v5.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.s.../ActiveData.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

#60
SilverWingz

Posted 19 July 2005 - 03:41 PM

Member

Topic Starter
Member
53 posts

Logfile of HijackThis v1.99.1
Scan saved at 4:23:18 PM, on 7/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\lexpps.exe
C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe
C:\PROGRA~1\COMMON~1\AOL\110114~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\COMMON~1\AOL\110114~1\EE\AOLServiceHost.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Documents and Settings\Markie Cooper\Desktop\Spyware tools\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.vivisimo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://in.boobies.co...E/3.3/2129751:P
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1101148709\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [AOLCC] "C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe" /startup
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31932A5C-9234-4377-A920-72E7DD340DB4} (Snapfish File Upload ActiveX Control) - http://www.mysticcol...ysticUpload.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol....oach_core_1.cab
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/...pandaonline.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/...bGameLoader.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.a...83/mcinsctl.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.co...clean_micro.exe
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8B6193F1-837F-11D4-89E6-0050DA666184} (Sol2axctl Class) - http://download.soli...d/solitaire.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.del...t/TLIEFlash.CAB
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - https://objects.aol....,20/McGDMgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...ta/SymAData.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/...fault/shapo.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/...WebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aol133.pogo.c...aploader_v5.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.s.../ActiveData.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe