PCTech Forums

A friendly computer support place
https://pctechforums.com/

Can't get rid of this

https://pctechforums.com/viewtopic.php?f=22&t=6718

Page 1 of 2

Can't get rid of this

PostPosted: Sun Oct 15, 2006 4:06 am
by Quickshot55
I've got some spyware or trojans that I can't get rid of myself. I was hoping you guys could take a look at my log file and see if it looks ok...

Logfile of HijackThis v1.99.1
Scan saved at 10:02:36 PM, on 10/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\ismini.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\{D4A8FC34-08A3-1033-0320-060317060001}\Update.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Catman\Desktop\Stuff\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{34A8FC34-08A3-1033-0320-060317060001}\MyToolBar.dll
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [raoaohk.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\raoaohk.dll,ilpzbgc
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 7002905328
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

PostPosted: Sun Oct 15, 2006 11:16 am
by Gecko
Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Please download extract the contents to your Desktop.
Do not run SmitfraudFix yet.

You should not have any open windows when you are following the procedures below.

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following:
(They may or may not be there)
ishost.exe
issearch.exe
ismini.exe

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{34A8FC34-08A3-1033-0320-060317060001}\MyToolBar.dll
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll (file missing)
O4 - HKLM\..\Run: [raoaohk.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\raoaohk.dll,ilpzbgc

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:
MyToolBar

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.
Delete the following Files/Folders if they exist:
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\ismini.exe
C:\WINDOWS\system32\raoaohk.dll

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Warning : running option #2 on a non infected computer will remove your Desktop background.

Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin,
reboot and post a new HiJackThis log and the SmitfraudFix report.

PostPosted: Sun Oct 15, 2006 6:19 pm
by Quickshot55
I couldn't get rid of the ishost and ismini files because i couldn't get rid of them from the task manager, so i deleted them in safe mode if that is ok...

Logfile of HijackThis v1.99.1
Scan saved at 12:16:04 PM, on 10/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\{D4A8FC34-08A3-1033-0320-060317060001}\Update.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\Catman\Desktop\Stuff\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{34A8FC34-08A3-1033-0320-060317060001}\MyToolBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 7002905328
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe



SmitFraudFix v2.109

Scan done at 12:14:47.75, Sun 10/15/2006
Run from C:\Documents and Settings\Catman\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ixt?.dll FOUND !
C:\WINDOWS\system32\ixt??.dll FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\ts.ico FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Catman


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Catman\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Catman\FAVORI~1

C:\DOCUME~1\Catman\FAVORI~1\Antivirus Test Online.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End[/b]

PostPosted: Sun Oct 15, 2006 9:08 pm
by Gecko
Please reboot your computer into Safe Mode

Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected.
You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool will need to restart your computer to finish the cleaning process; if it doesn't, please restart manually into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

After the reboot post the contents of the C:\rapport.txt and a new hijackthis log

PostPosted: Sun Oct 15, 2006 10:55 pm
by Quickshot55
SmitFraudFix v2.109

Scan done at 16:51:46.42, Sun 10/15/2006
Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\ixt?.dll Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\ts.ico Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

i'm still getting crappy pop-ups telling me i have a virus and to download there virus programs

PostPosted: Mon Oct 16, 2006 12:02 am
by Gecko

PostPosted: Mon Oct 16, 2006 12:19 am
by Quickshot55
Here is is

Logfile of HijackThis v1.99.1
Scan saved at 6:19:05 PM, on 10/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\{D4A8FC34-08A3-1033-0320-060317060001}\Update.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Catman\Desktop\Stuff\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{34A8FC34-08A3-1033-0320-060317060001}\MyToolBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 7002905328
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

PostPosted: Mon Oct 16, 2006 1:20 am
by Gecko

PostPosted: Mon Oct 16, 2006 3:21 am
by Quickshot55
When I ran the remove.bat file, i got a message saying something (I forgot what it said)
When I ran hijackthis the object you wanted me to fix was already gone, and the folder you wanted me to delete wasn't there either... so i'm guessing the remove.bat did something?

Logfile of HijackThis v1.99.1
Scan saved at 9:17:47 PM, on 10/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\{D4A8FC34-08A3-1033-0320-060317060001}\Update.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Catman\Desktop\Stuff\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 7002905328
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

PostPosted: Mon Oct 16, 2006 11:35 am
by Gecko
Your log is clean :)

How is it running now?

The message box probably said "MyToolBar.dll unregistered successfully"
And yes the remove.bat deleted the MyToolBar.dll file and the registry entry.
I put in the hijackthis step just incase it didn't remove the registry entry because sometimes it won't.

PostPosted: Tue Oct 17, 2006 3:12 am
by Quickshot55
I'm still getting those popups whenever i open firefox. Another tab opens up saying and i get a message saying i have a virus, and to download their virus program

PostPosted: Tue Oct 17, 2006 1:29 pm
by Gecko
Please download install it update reboot into safe mode and run a full scan.
Quarantine everything Ewido/AVG anit-spyware finds, make sure you save the report.
Reboot in to normal and post the saved report contents.

PostPosted: Tue Oct 17, 2006 11:42 pm
by Quickshot55
wow... i had 70

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 5:33:37 PM 10/17/2006

+ Scan result:



HKLM\SOFTWARE\Classes\CLSID\{a43385f0-7113-496d-96d7-b9b550e3fcca} -> Adware.Isearch : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a43385f0-7113-496d-96d7-b9b550e3fcca} -> Adware.Isearch : No action taken.
HKU\S-1-5-21-1417001333-1409082233-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A43385F0-7113-496D-96D7-B9B550E3FCCA} -> Adware.Isearch : No action taken.
C:\Program Files\Common Files\{D4A8FC34-08A3-1033-0320-060317060001}\Update.exe -> Adware.Softomate : No action taken.
C:\Program Files\Common Files\{D4A8FC34-08A3-1033-0320-060317060001}\services.dll -> Adware.Softomate : No action taken.
C:\WINDOWS\system32\tuvwtqp.dll -> Adware.Virtumonde : No action taken.
:mozilla.140:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.78:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.80:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.194:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.195:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.43:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.44:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.108:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.109:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.110:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.111:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\Catman\Cookies\catman@advertising[1].txt -> TrackingCookie.Advertising : No action taken.
:mozilla.97:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Catman\Cookies\catman@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.162:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.163:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.164:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.193:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Clickhype : No action taken.
:mozilla.196:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Clickhype : No action taken.
:mozilla.58:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.160:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.161:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.133:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.134:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.135:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.136:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.59:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.144:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.98:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.99:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.15:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.16:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.17:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.18:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.19:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.20:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.21:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.22:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : No action taken.
:mozilla.199:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Revenue : No action taken.
:mozilla.93:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.94:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.95:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.96:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.166:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.167:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.168:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.169:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.170:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.171:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.172:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.173:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : No action taken.
:mozilla.54:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.55:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.56:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.57:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.60:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.62:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Valueclick : No action taken.
:mozilla.68:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.69:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.70:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.71:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.72:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.188:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.190:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Zedo : No action taken.


::Report end

PostPosted: Wed Oct 18, 2006 12:01 am
by Gecko
They all say "No action taken" :(

You will need to run it again you need to Quarantine everything but the cookies those you can delete.
Once the scan is complete you need to select the action you want AVG to take set it to Default.
That should Quarantine everything but the cookies will be deleted

PostPosted: Wed Oct 18, 2006 1:27 am
by Quickshot55
I did... i set it to quarentine all, and 3 of them were quarentined and the rest it said delete
*edit*
but i'm an idiot and didnt' see the big "apply all actions" button

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 7:39:13 PM 10/17/2006

+ Scan result:



HKLM\SOFTWARE\Classes\CLSID\{a43385f0-7113-496d-96d7-b9b550e3fcca} -> Adware.Isearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a43385f0-7113-496d-96d7-b9b550e3fcca} -> Adware.Isearch : Cleaned with backup (quarantined).
HKU\S-1-5-21-1417001333-1409082233-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A43385F0-7113-496D-96D7-B9B550E3FCCA} -> Adware.Isearch : Cleaned with backup (quarantined).
C:\Program Files\Common Files\{D4A8FC34-08A3-1033-0320-060317060001}\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\Program Files\Common Files\{D4A8FC34-08A3-1033-0320-060317060001}\services.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\WINDOWS\system32\tuvwtqp.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
:mozilla.142:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.80:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.82:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.196:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.197:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.51:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.52:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.110:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.111:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.112:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.113:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Catman\Cookies\catman@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.99:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Catman\Cookies\catman@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.164:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.165:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.166:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.195:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.198:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.
:mozilla.64:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.162:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.163:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.15:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.135:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.136:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.137:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.138:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.25:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.146:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.100:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.101:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.30:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.31:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.32:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.33:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.34:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.35:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.36:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.37:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.201:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.95:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.96:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.97:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.98:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.168:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.169:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.170:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.171:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.172:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.173:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.174:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.175:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.61:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.62:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.63:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.65:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.67:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.73:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.74:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.190:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.192:C:\Documents and Settings\Catman\Application Data\Mozilla\Firefox\Profiles\jq6y3c08.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.


::Report end