Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

My hijack this log please help [RESOLVED]


  • This topic is locked This topic is locked

#1
tiffont

tiffont

    Member

  • Member
  • PipPip
  • 10 posts
Logfile of HijackThis v1.99.1
Scan saved at 2:11:59 AM, on 7/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!(firefox)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
E:\Lavasoft\Ad-aware 6\Ad-watch.exe
c:\windows\system32\szfchjp.exe
E:\Mozilla\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem301.dll
O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\system32\bridge.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\system32\bridge.dll",Load
O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
O4 - HKLM\..\Run: [Ad-watch] E:\Lavasoft\Ad-aware 6\Ad-watch.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [iausxubi] C:\WINDOWS\system32\iubdby.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
  • 0

Advertisements


#2
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Welcome to GTG.

First things first. You need to uninstall the Ad-aware you have there and install the newest version. Check for updates and run a new scan. Remove the items it finds.

Please print out the instructions here (or save it in Notepad) so that you can follow along more easily.

Download Ewido Security Suite at http://www.ewido.net/en/download/ and install it. Update to the newest definitions. If you have trouble updating, you may do it manually at http://www.ewido.net...wnload/updates/ Do NOT run the Ewido scan yet.

Please download Nailfix at http://www.noidea.us...050515010747824 Double click on it and install it on the desktop but do NOT run the files extracted yet.

Download FxIstbar, but don't run it yet.

Boot into Safe Mode by restarting and then hitting the F8 key repeatedly until a menu shows up (choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

Once in Safe Mode, please double-click on nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Next run a full scan in Ewido. Save the log from the Ewido scan so that you can post it later.

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem301.dll
O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\system32\bridge.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\system32\bridge.dll",Load
O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [iausxubi] C:\WINDOWS\system32\iubdby.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe


Close all open windows except for HijackThis and click Fix Checked.

Uninstall these from the Add/Remove panel if listed:

Ebates_MoeMoneyMaker
ISTsvc


Delete these if found:

c:\windows\system32\szfchjp.exe
C:\WINDOWS\Nail.exe
C:\WINDOWS\systb.dll
C:\WINDOWS\2_0_1browserhelper2.dll
C:\WINDOWS\wsem301.dll
C:\WINDOWS\system32\bridge.dll
C:\WINDOWS\system32\msbe.dll
C:\WINDOWS\conscorr.exe
C:\WINDOWS\wupdt.exe
C:\Program Files\Ebates_MoeMoneyMaker\
C:\Program Files\ISTsvc\
C:\WINDOWS\system32\iubdby.exe
C:\WINDOWS\svcproc.exe


Run FxIstbar.exe now.

Restart your computer.

Download FindIt's.zip http://forums.net-in...=post&id=142443 to your desktop.

1. Unzip/extract the files inside to a folder on your desktop.
2. Open the folder. Double click on FindIt's.bat and wait for Notepad to open a text file. It will take a while so please be patient... Note: If you are having problems using FindIt's.bat (16 bit error), copy autoexec.nt from the C:\WINDOWS\repair folder to C:\WINDOWS\system32 folder. Now try running FindIt's.bat.
3. Then post the results here along with the new HijackThis log. Also post the Ewido scan results here.
  • 0

#3
tiffont

tiffont

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Ok i did eveything that you said and these are the logs that you asked for:

Logfile of HijackThis v1.99.1
Scan saved at 12:13:39 AM, on 7/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
e:\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Java\jre1.5.0_02\bin\jucheck.exe
C:\WINDOWS\system32\NOTEPAD.EXE
e:\ewido\security suite\ewidoguard.exe
E:\Mozilla\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\TIFFON~1\LOCALS~1\Temp\Rar$EX00.416\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [kdjcvq] c:\windows\system32\yzotifh.exe r
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - e:\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 8:36:31 PM, 7/23/2005
+ Report-Checksum: A2837451

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.BottomFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.LeftFrame\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupBrowser\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\IMIToolbar.PopupWindow\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Spyware.WebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CLSID -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Classes\Wbho.Band\CurVer -> Spyware.IEPlugin : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\intexp -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000010-6F7D-442C-93E3-4A4827C2E4C8} -> Spyware.InternetOptimizer : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000049-8F91-4D9C-9573-F016E7626484} -> Spyware.BetterInternet : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00320615-B6C2-40A6-8F99-F1C52D674FAD} -> Spyware.Transponder : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -> Spyware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83DE62E0-5805-11D8-9B25-00E04C60FAF2} -> Spyware.BlazeFind : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87766247-311C-43B4-8499-3D5FEC94A183} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8952A998-1E7E-4716-B23D-3DBE03910972} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} -> Spyware.MoneyTree : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9C691A33-7DDA-4C2F-BE4C-C176083F35CF} -> Spyware.WinFavorites : Cleaned with backup
HKU\S-1-5-21-1214440339-1708537768-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F4E04583-354E-4076-BE7D-ED6A80FD66DA} -> Spyware.BargainBuddy : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.59:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.60:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.76:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.77:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.78:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.80:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.81:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.82:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.86:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.140:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.141:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.156:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.157:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.158:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.159:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.160:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.161:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.162:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.163:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.164:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.165:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.210:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.211:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.212:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.213:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.214:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.215:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.216:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.217:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.219:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.220:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.221:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.222:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.223:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.224:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.225:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.226:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.227:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.228:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.229:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.230:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.231:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.232:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.233:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.234:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.235:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.236:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.237:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.238:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.239:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.240:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.241:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.242:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.243:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.244:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.245:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.246:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.247:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.248:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.249:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.250:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.251:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.252:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.253:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.254:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.255:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.256:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.257:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.258:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.259:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.260:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.277:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.278:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.279:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.280:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.281:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.294:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
:mozilla.323:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.326:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.333:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.334:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.337:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.338:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.346:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.347:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.348:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.349:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.350:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.351:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.352:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.353:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.354:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.355:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.356:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.357:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.358:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.359:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.360:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.361:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.362:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.363:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.364:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.365:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.366:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.373:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.374:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.375:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.379:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.380:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.402:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.403:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.404:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.405:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.406:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.407:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.408:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.409:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.410:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.419:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.446:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.447:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.466:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Addynamix : Cleaned with backup
:mozilla.535:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.536:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.537:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.538:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.539:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.540:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.541:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.542:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.543:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.545:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.550:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.559:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.560:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.561:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.562:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.563:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.564:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.565:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.566:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.569:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.570:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.571:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.622:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.623:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.624:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.625:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.626:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.627:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.628:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.629:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.630:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.631:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.632:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.640:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.641:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.642:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.654:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.680:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.728:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.729:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.730:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.762:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.763:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.792:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.809:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.867:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.905:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.959:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.965:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.970:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.971:C:\Documents and Settings\Tiffon Turner\Application Data\Mozilla\Firefox\Profiles\ciyxj2wr.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.36:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.45:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.47:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.48:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.57:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.58:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Tiffon Turner\Application Data\Phoenix\Profiles\default\eugsbhqs.slt
  • 0

#4
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Where's the FindIt's log?

I forgot to ask you to do this earlier. Move HijackThis.exe and the backup folder it created OUT of your temp folder now.

Download APT
Open apt and search in the window for the yzotifh.exe.
Open your C:\Windows\system32 folder and search for the bad file (yzotifh.exe). Don't delete it yet, just leave the system32 folder open so you can see the bad file.
In apt again, Select the bad process and Click Kill3

Then immediately delete the bad file from your system32 folder.

Go to Start->Run and type in services.msc and hit OK. Then look for Remote Packet Capture Protocol v.0 (experimental) (rpcapd) and double click on it. Click on the Stop button and under Startup type, choose Disabled.

Run HijackThis. Place a check next to this item and click FIX CHECKED:

O4 - HKLM\..\Run: [kdjcvq] c:\windows\system32\yzotifh.exe r
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)


Rescan with HijackThis and post the new log.
  • 0

#5
tiffont

tiffont

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Findits log

Microsoft Windows XP [Version 5.1.2600]
The current date is: Sun 07/24/2005
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidance
If any doubt back them up first


»»»»» lagitamate file's can/will show in this section.

* UPX! C:\WINDOWS\System32\XBCDSU.DLL
* UPX! C:\WINDOWS\DAEMON.DLL
»»»»»»»»»»»»»»»»»»»»»»»» Buddy file's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

»»»»»»»»»»»»»»»»»»»»»»»» SAHAgent Files found »»»»»»»»»»»»»»»»»»»»»»»»»

»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


»»»»» Check for Windows\SYSTEM32\cache32_rtneg* folder.

Volume in drive C is Windows
Volume Serial Number is A4AC-41D8

Directory of C:\WINDOWS\SYSTEM32

»»»»» Checking for SAHAgent ico files.
Volume in drive C is Windows
Volume Serial Number is A4AC-41D8

Directory of C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»».

plus i dont see the hijackthis.exe or a folder in the temp folder unless i am looking in the wrong place.
  • 0

#6
tiffont

tiffont

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
plus everything else that you told me to look for like the yzotifh.exe wasn't there and the protocol thing was aldready disabled.
  • 0

#7
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
According to your log file, you are running HijackThis at:

C:\DOCUME~1\TIFFON~1\LOCALS~1\Temp\Rar$EX00.416\HijackThis.exe

So just make sure it's running in a more permanent folder like c:\hjt\ instead.

Delete this file if found -> C:\WINDOWS\System32\XBCDSU.DLL

OK, the filename probably changed. I want you to give me a new HijackThis log but do NOT restart or shutdown your computer until we get to run that APT program. Otherwise, the filename may change again. So set up a time that's convenient for you before you run a new HijackThis scan and post the log here.
  • 0

#8
tiffont

tiffont

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
i deleted xbcdsu.dll
i already had HJT in it seperate folder like c:\HJT

Logfile of HijackThis v1.99.1
Scan saved at 1:49:04 AM, on 7/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
e:\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
e:\ewido\security suite\ewidoguard.exe
C:\Program Files\Windows Media Player\wmplayer.exe
E:\Mozilla\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\TIFFON~1\LOCALS~1\Temp\Rar$EX00.457\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [kdjcvq] c:\windows\system32\yzotifh.exe r
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - e:\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
  • 0

#9
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
For some reason the log is saying that HijackThis is not running from c:\hjt\. Are you sure it's not just a shortcut and the actual program is in the temp folder?

OK, delete HijackThis and download a new one. Run that one instead.

Open apt and search in the window for the yzotifh.exe.
Open your C:\Windows\system32 folder and search for the bad file (yzotifh.exe). Don't delete it yet, just leave the system32 folder open so you can see the bad file.
In apt again, Select the bad process and Click Kill3

Then immediately delete the bad file from your system32 folder.

Check and fix these in HijackThis:

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [kdjcvq] c:\windows\system32\yzotifh.exe r
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)


Restart and post a new HijackThis log.
  • 0

#10
tiffont

tiffont

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
ok i deleted HJT downloaded a new one and put the .exe in C:\HJT\ folder and ran it here are the results.

Logfile of HijackThis v1.99.1
Scan saved at 9:57:00 AM, on 7/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
e:\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
e:\ewido\security suite\ewidoguard.exe
E:\Mozilla\firefox.exe
C:\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [kdjcvq] c:\windows\system32\yzotifh.exe r
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - e:\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)

I also ran apt and did a system search for the yzotifh.exe file and nothing came up, i even looked myself and its not there and its not hidden but according to hijackthis its in the system 32 folder. should i skip and do the fix checked process.
  • 0

Advertisements


#11
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Yes, try fixing it in HijackThis first. Then restart and run a new scan. Post it here.

Also do this:

Right click on http://www.silentrun...ent Runners.vbs and choose Save As...Save it to your Desktop. Make sure you have disabled any programs that may block/disable scripts (ex: Ad-Watch, TeaTimer, Norton, etc.). Double click on 'Silent Runners' to run it. This will take a few minutes. It will create a file called 'Startup Programs' followed by your computer name and current date. Open up that file and post all the contents here in your next post.
  • 0

#12
tiffont

tiffont

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Logfile of HijackThis v1.99.1
Scan saved at 6:36:34 PM, on 7/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
e:\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
E:\Mozilla\firefox.exe
e:\ewido\security suite\securitysuite.exe
C:\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - e:\PartyPoker\PartyPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - e:\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)




"Silent Runners.vbs", revision 39, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"STYLEXP" = "C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide" [empty string]
"Steam" = (empty string)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"DAEMON Tools-1033" = ""E:\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"KernelFaultCheck" = "%systemroot%\system32\dumprep 0 -k" [MS]
"UserFaultCheck" = "%systemroot%\system32\dumprep 0 -u" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "E:\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "E:\Microsoft Office\Office10\msohev.dll" [MS]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{4EC26602-4807-40FE-A40F-1A41E4D40C78}" = "Dell DJ Explorer"
-> {CLSID}\InProcServer32\(Default) = "E:\Dell DJ Explorer\CTOJBNS.DLL" ["Creative Technology Ltd"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
-> {CLSID}\InProcServer32\(Default) = "e:\ewido\security suite\shellhook.dll" ["TODO: <Firmenname>"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {CLSID}\InProcServer32\(Default) = "e:\ewido\security suite\context.dll" ["ewido networks"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {CLSID}\InProcServer32\(Default) = "e:\ewido\security suite\context.dll" ["ewido networks"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Tiffon Turner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"


Startup items in "Tiffon Turner" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"Microsoft Office" -> shortcut to: "E:\Microsoft Office\Office10\OSA.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{E2BF1BF3-1FDB-4C93-8874-0B09E71C594C}\ = "LeftFrame Class"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\WINDOWS\systb.dll" [file not found]

HKLM\Software\Classes\CLSID\{F3155057-4C2C-4078-8576-50486693FD49}\ = "BottomFrame Class"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\WINDOWS\systb.dll" [file not found]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."]

{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\
"ButtonText" = "AOL Instant Messenger ™"
"Exec" = "C:\PROGRA~1\AIM95\aim.exe" [file not found]

{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\
"ButtonText" = "PartyPoker.com"
"MenuText" = "PartyPoker.com"
"Exec" = "e:\PartyPoker\PartyPoker.exe" ["iGlobalMedia.com"]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
ewido security suite control, ewido security suite control, "e:\ewido\security suite\ewidoctrl.exe" ["ewido networks"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 163 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 20 seconds.
---------- (total run time: 214 seconds)

Edited by tiffont, 27 July 2005 - 04:44 PM.

  • 0

#13
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. While in the Registry Editor, navigate to:

HKLM\Software\Classes\CLSID\ and delete {F3155057-4C2C-4078-8576-50486693FD49}

HKLM\Software\Classes\CLSID\ and delete {E2BF1BF3-1FDB-4C93-8874-0B09E71C594C}


If any of the above registry keys are giving you problems deleting, right click on them and click on Permissions. Then click on the Advanced button. Make sure the first box (Inherit from parent...) is checked. Click OK and OK. Then try deleting the entry again. Once you're done, close the Registry Editor.

Delete if found:

C:\WINDOWS\systb.dll


Restart and post a new log for HijackThis and Silent Runners.
  • 0

#14
tiffont

tiffont

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
in my registry there is no hklm its hkey but i did find the files that you told me to look for in the hkey local machine. should i continue to delete.
  • 0

#15
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Sorry about that. I try to remember changing them, but yes that's it.

HKLM = HKEY_LOCAL_MACHINE
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP