Options

Blood Red Screen and symbol with horns. Computer kidnapped!

Unknown
edited October 2007 in Spyware & Virus Removal
Ok... ready for this?

Last night about 9pm our laptop went blood red and a symbol with horns appeared on our desktop. We are no longer the administrator even though our account is the ONLY account on the computer.

Pop up boxes say:
  • "Windows has detected an Internet attack attempt. Somebodys trying to infect your PC with soyware or harmful viruses".
  • "Security Warning! Trojan.W32.Lookskt" detected on your machine. This virus is distrubuted via the Internet through e-mail and Active-X objects. The worm has its own SMTP engine which means it gathers e-mails from your local computer and dre-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and other personal data".
  • "Your computer is making unauthorized copies of your system and Internet files".
New programs unable to delete appearing on our desktop are:
  • Error Cleaner (shield with a magnifying glass)
  • Privacy Protector (shield with a sword)
  • Spyware & Protection (shield with a broom)
There's also a little red stop sign in the bottom right hand corner with a red X in it that says "System Alert, System detected virus activities. These may impact the performance of your computer. Please, use recomended antispyware software to protect your system from parasite programs".

ANY spelling mistakes in quotes is exactly what is appearing on the screen.

Although we have system restore dates, it is NOT allowing any system restores.

With each popup, if you click no, it tries to open a website, and then ten million more on top of that. Ctrl+alt+delete allows you to end the explorers.

I've ran McAfee (nothing came back), AVG (13 trojans came back), and TrendMicro. However, after removing them, they continue to return.

Confused? Yeah... I am... Any help would be GREATLY appreciated!

PS: I cannot access the internet from the infected laptop!

Comments

  • TroganTrogan London, UK
    edited October 2007
    Hi AllPawsHere, and welcome to Icrontic.

    Sounds like your computer is infected. Lets get it cleaned up.

    I'll need a few logs from your computer...

    1. Download HJTInstall.exe to your Desktop.
    • Doubleclick HJTInstall.exe to install it.
    • By default it will install to C:\Program Files\Trend Micro\HijackThis .
    • Click on Install.
    • It will create a HijackThis icon on the desktop.
    • Once installed, it will launch Hijackthis.
    • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
    • Save the log to a convenient location as you'll need to post it soon.
    • Don't use the Analyse This button, its findings are dangerous if misinterpreted.
    • Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
    2. Download SmitfraudFix (by S!Ri) to your Desktop.
    http://siri.urz.free.fr/Fix/SmitfraudFix.zip
    Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

    Open the SmitfraudFix folder and double-click smitfraudfix.cmd
    Select option #1 - Search by typing 1 and press Enter
    This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

    IMPORTANT: Do NOT run any other options until you are asked to do so!

    3. Please post the SmitfraudFix report, along with the HijackThis log.
  • AllPawsHere
    edited October 2007
    Trojan-

    I cannot access the internet from the laptop, so give me a few minutes to burn it onto a thumb drive and install... Then save to word and recopy here.
  • TroganTrogan London, UK
    edited October 2007
    Save them to Notepad please. The output would be easier to read.

    Make sure Word Wrap is unchecked under the Format tab.
  • AllPawsHere
    edited October 2007
    Ok here we go:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:14:13 PM, on 10/7/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\userinit.exe
    C:\WINDOWS\Explorer.exe
    C:\WINDOWS\system32\WinAvXX.exe
    C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    C:\PROGRA~1\mcafee.com\agent\McAgent.exe
    C:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4061128
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4061128
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/campaign.asp?cid=16313
    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: MSVPS System - {3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A} - C:\WINDOWS\bndsrdkq.dll
    O2 - BHO: IEHlprObj Class - {ABCDECF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\vtr.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: The netadv - {ABF529BE-6245-465A-BBD4-238C4EAB0F0A} - C:\WINDOWS\netadv.dll
    O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
    O4 - HKUS\S-1-5-21-3308182640-4278076361-2879258875-1007\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - S-1-5-21-3308182640-4278076361-2879258875-1007 Startup: system.exe (User '?')
    O4 - Startup: system.exe
    O4 - Global Startup: autorun.exe
    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?4dd3b610f2e540f599dd743c2415721c
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?4dd3b610f2e540f599dd743c2415721c
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O20 - AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat
    O21 - SSODL: msvb - {5C7E4F70-FD9F-417F-B374-2DDF185B0163} - C:\WINDOWS\msvb.dll
    O21 - SSODL: sysdx - {CD7CEB67-886C-4860-9170-10FCF89659D8} - C:\WINDOWS\sysdx.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    --
    End of file - 6322 bytes


    SmitFraudFix v2.239
    Scan done at 17:16:12.71, Sun 10/07/2007
    Run from C:\Documents and Settings\Nora Cheryl Finks\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode
    »»»»»»»»»»»»»»»»»»»»»»»» Process

    »»»»»»»»»»»»»»»»»»»»»»»» hosts
    hosts file corrupted !
    192.168.200.3 download.microsoft.com
    192.168.200.3 downloads.microsoft.com
    192.168.200.3 go.microsoft.com
    192.168.200.3 microsoft.com
    192.168.200.3 msdn.microsoft.com
    192.168.200.3 office.microsoft.com
    192.168.200.3 support.microsoft.com
    192.168.200.3 windowsupdate.microsoft.com
    192.168.200.3 www.microsoft.com
    192.168.200.3 pandasoftware.com
    192.168.200.3 www.pandasoftware.com
    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
    C:\WINDOWS\msvb.dll FOUND !
    C:\WINDOWS\netadv.dll FOUND !
    C:\WINDOWS\sysdx.dll FOUND !
    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
    C:\WINDOWS\system32\printer.exe FOUND !
    C:\WINDOWS\system32\vtr???.dll FOUND !
    C:\WINDOWS\system32\WinAvXX.exe FOUND !
    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nora Cheryl Finks

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nora Cheryl Finks\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu
    C:\DOCUME~1\NORACH~1\STARTM~1\Programs\Startup\system.exe FOUND !
    C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\autorun.exe FOUND !
    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\NORACH~1\FAVORI~1
    C:\DOCUME~1\NORACH~1\FAVORI~1\Error Cleaner.url FOUND !
    C:\DOCUME~1\NORACH~1\FAVORI~1\Privacy Protector.url FOUND !
    »»»»»»»»»»»»»»»»»»»»»»»» Desktop
    C:\DOCUME~1\NORACH~1\Desktop\Error Cleaner.url FOUND !
    C:\DOCUME~1\NORACH~1\Desktop\Privacy Protector.url FOUND !
    C:\DOCUME~1\NORACH~1\Desktop\Spyware?Malware Protection.url FOUND !
    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="about:Home"
    "SubscribedURL"="about:Home"
    "FriendlyName"="My Current Home Page"

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!
    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"="C:\\WINDOWS\\system32\\sulimo.dat"

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Rustock

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

    »»»»»»»»»»»»»»»»»»»»»»»» End
  • TroganTrogan London, UK
    edited October 2007
    Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

    Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
    http://www.ewido.net/en/download/
    • Install AVG Anti-Spyware by double clicking the installer.
    • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
    • On the main screen under Your Computer's security.
      • Click on Change state next to Resident shield. It should now change to inactive.
      • Click on Change state next to Automatic updates. It should now change to inactive.
      • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
      • Wait until you see the Update succesfull message.
    • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    If you are having problems with the updater, you can use this link to manually update ewido.
    AVG Anti-Spyware manual updates.
    Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
    ______________________________

    Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.
    ______________________________

    Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
    Select option #2 - Clean by typing 2 and press Enter.
    Wait for the tool to complete and disk cleanup to finish.
    You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
    The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

    A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

    The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
    ______________________________

    Navigate to C:\Windows\Temp
    Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

    Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp
    Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

    Clean out your Temporary Internet files. Proceed like this:
    • Quit Internet Explorer and quit any instances of Windows Explorer.
    • Click Start, click Control Panel, and then double-click Internet Options.
    • On the General tab, click Delete Files under Temporary Internet Files.
    • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
    • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
    • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
    • Click OK.
    Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

    Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
    ______________________________

    Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
    • Click on Scanner on the toolbar.
    • Click on the Settings tab.
      • Under How to act?
        • Click on Recommended Action and choose Quarantine from the popup menu.
      • Under How to scan?
        • All checkboxes should be ticked.
      • Under Possibly unwanted software:
        • All checkboxes should be ticked.
      • Under Reports:
        • Select Do not automatically generate reports.
      • Under What to scan?
        • Select Scan every file.
    • Click on the Scan tab.
    • Click on Complete System Scan to start the scan process.
    • Let the program scan the machine.
    • When the scan has finished, follow the instructions below.
      IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
      • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
      • At the bottom of the window click on the Apply all Actions button. (3)
        scanavgjk2.jpg
    • When done, click the Save Scan Report button. (4)
      • Click the Save Report as button.
      • Save the report to your Desktop.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    Reboot in Normal Mode.
    ______________________________

    Open the SmitfraudFix folder and double-click smitfraudfix.cmd
    Select option #3 - Delete Trusted zone by typing 3 and press Enter.
    Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.

    Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
    ______________________________

    Please post:
    1. c:\rapport.txt
    2. AVG Anti-Spyware log
    3. A new HijackThis log
    You may need several replies to post the requested logs, otherwise they might get cut off.
  • AllPawsHere
    edited October 2007
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:33:09 PM, on 10/7/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.exe
    C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    C:\PROGRA~1\mcafee.com\agent\McAgent.exe
    C:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4061128
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/campaign.asp?cid=16313
    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: IEHlprObj Class - {ABCDECF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\vtr.dll (file missing)
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: The netadv - {ABF529BE-6245-465A-BBD4-238C4EAB0F0A} - C:\WINDOWS\netadv.dll (file missing)
    O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
    O4 - HKUS\S-1-5-21-3308182640-4278076361-2879258875-1007\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?4dd3b610f2e540f599dd743c2415721c
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?4dd3b610f2e540f599dd743c2415721c
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O20 - AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat
    O21 - SSODL: msvb - {5C7E4F70-FD9F-417F-B374-2DDF185B0163} - (no file)
    O21 - SSODL: sysdx - {CD7CEB67-886C-4860-9170-10FCF89659D8} - (no file)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    --
    End of file - 5885 bytes

    AVG Anti-Spyware - Scan Report
    + Created at: 6:31:54 PM 10/7/2007
    + Scan result:

    HKLM\SOFTWARE\AVSystemCare -> Adware.AvSystemcare : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\AVSystemCare\Settings -> Adware.AvSystemcare : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\uga6pcw -> Adware.AvSystemcare : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3308182640-4278076361-2879258875-1007\Software\AVSystemCare -> Adware.AvSystemcare : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3308182640-4278076361-2879258875-1007\Software\AVSystemCare\Settings -> Adware.AvSystemcare : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} -> Adware.Generic : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91} -> Adware.RogueSuspect : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226} -> Adware.RogueSuspect : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\McAfee.com\Agent\Update\ResultLog\\Log#095 -> Adware.RogueSuspect : Cleaned with backup (quarantined).
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@247realmedia"]finks@247realmedia[/EMAIL][1].txt -> TrackingCookie.247realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@2o7"]finks@2o7[/EMAIL][1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@2o7"]finks@2o7[/EMAIL][2].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@2o7"]finks@2o7[/EMAIL][3].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@2o7"]finks@2o7[/EMAIL][4].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@2o7"]finks@2o7[/EMAIL][5].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@2o7"]finks@2o7[/EMAIL][6].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@2o7"]finks@2o7[/EMAIL][7].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@cbs.112.2o7"]finks@cbs.112.2o7[/EMAIL][1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@microsoftconsumermarketing.112.2o7"]finks@microsoftconsumermarketing.112.2o7[/EMAIL][1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@msnaccountservices.112.2o7"]finks@msnaccountservices.112.2o7[/EMAIL][1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@msnportal.112.2o7"]finks@msnportal.112.2o7[/EMAIL][1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@msnportal.112.2o7"]finks@msnportal.112.2o7[/EMAIL][2].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@partygaming.122.2o7"]finks@partygaming.122.2o7[/EMAIL][1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@reunioncom.112.2o7"]finks@reunioncom.112.2o7[/EMAIL][1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@3.adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@adbrite"]finks@adbrite[/EMAIL][2].txt -> TrackingCookie.Adbrite : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.addynamix[3].txt -> TrackingCookie.Addynamix : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@adrevolver"]finks@adrevolver[/EMAIL][3].txt -> TrackingCookie.Adrevolver : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@adrevolver"]finks@adrevolver[/EMAIL][4].txt -> TrackingCookie.Adrevolver : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@adrevolver"]finks@adrevolver[/EMAIL][8].txt -> TrackingCookie.Adrevolver : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@advertising"]finks@advertising[/EMAIL][1].txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@advertising"]finks@advertising[/EMAIL][2].txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@advertising"]finks@advertising[/EMAIL][3].txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@advertising"]finks@advertising[/EMAIL][4].txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@advertising"]finks@advertising[/EMAIL][5].txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@advertising"]finks@advertising[/EMAIL][7].txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@advertising"]finks@advertising[/EMAIL][8].txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@atdmt"]finks@atdmt[/EMAIL][2].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@atdmt"]finks@atdmt[/EMAIL][3].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@atdmt"]finks@atdmt[/EMAIL][4].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@bfast"]finks@bfast[/EMAIL][2].txt -> TrackingCookie.Bfast : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@bluestreak"]finks@bluestreak[/EMAIL][1].txt -> TrackingCookie.Bluestreak : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@bluestreak"]finks@bluestreak[/EMAIL][2].txt -> TrackingCookie.Bluestreak : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@bluestreak"]finks@bluestreak[/EMAIL][3].txt -> TrackingCookie.Bluestreak : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@bluestreak"]finks@bluestreak[/EMAIL][4].txt -> TrackingCookie.Bluestreak : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@bluestreak"]finks@bluestreak[/EMAIL][5].txt -> TrackingCookie.Bluestreak : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@bluestreak"]finks@bluestreak[/EMAIL][6].txt -> TrackingCookie.Bluestreak : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@bluestreak"]finks@bluestreak[/EMAIL][8].txt -> TrackingCookie.Bluestreak : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.cnn[1].txt -> TrackingCookie.Cnn : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@com"]finks@com[/EMAIL][1].txt -> TrackingCookie.Com : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@com"]finks@com[/EMAIL][2].txt -> TrackingCookie.Com : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@test.coremetrics[1].txt -> TrackingCookie.Coremetrics : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@test.coremetrics[2].txt -> TrackingCookie.Coremetrics : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@e-2dj6wgmiwnc5ggo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@adopt.euroclick[3].txt -> TrackingCookie.Euroclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@adopt.euroclick[4].txt -> TrackingCookie.Euroclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@adopt.euroclick[5].txt -> TrackingCookie.Euroclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@fastclick"]finks@fastclick[/EMAIL][1].txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@fastclick"]finks@fastclick[/EMAIL][2].txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@fastclick"]finks@fastclick[/EMAIL][3].txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@fastclick"]finks@fastclick[/EMAIL][4].txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@fastclick"]finks@fastclick[/EMAIL][6].txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@fastclick"]finks@fastclick[/EMAIL][7].txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-hollywood.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-hollywoodmedia.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-maximhealthcare.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-paloaltosoftwareinc.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-researchinmotion.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-verizonwireless.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-vzw.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-wachovia.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-wachovia.hitbox[3].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-wachovia.hitbox[4].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ehg-wachovia.hitbox[5].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@hitbox"]finks@hitbox[/EMAIL][1].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@hitbox"]finks@hitbox[/EMAIL][2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@hitbox"]finks@hitbox[/EMAIL][3].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@hitbox"]finks@hitbox[/EMAIL][5].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@counter.hitslink[1].txt -> TrackingCookie.Hitslink : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@search.live[1].txt -> TrackingCookie.Live : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@search.live[2].txt -> TrackingCookie.Live : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@search.live[3].txt -> TrackingCookie.Live : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@search.live[4].txt -> TrackingCookie.Live : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@search.live[5].txt -> TrackingCookie.Live : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@search.live[6].txt -> TrackingCookie.Live : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@sales.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@sales.liveperson[3].txt -> TrackingCookie.Liveperson : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@server.iad.liveperson[3].txt -> TrackingCookie.Liveperson : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@mediaplex"]finks@mediaplex[/EMAIL][1].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@mediaplex"]finks@mediaplex[/EMAIL][2].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@mediaplex"]finks@mediaplex[/EMAIL][3].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@mediaplex"]finks@mediaplex[/EMAIL][4].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@mediaplex"]finks@mediaplex[/EMAIL][5].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@mediaplex"]finks@mediaplex[/EMAIL][6].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@mediaplex"]finks@mediaplex[/EMAIL][7].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@mediaplex"]finks@mediaplex[/EMAIL][8].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@auto.search.msn[1].txt -> TrackingCookie.Msn : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@auto.search.msn[2].txt -> TrackingCookie.Msn : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@search.msn[2].txt -> TrackingCookie.Msn : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@overture"]finks@overture[/EMAIL][1].txt -> TrackingCookie.Overture : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@overture"]finks@overture[/EMAIL][2].txt -> TrackingCookie.Overture : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@overture"]finks@overture[/EMAIL][3].txt -> TrackingCookie.Overture : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@overture"]finks@overture[/EMAIL][4].txt -> TrackingCookie.Overture : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@overture"]finks@overture[/EMAIL][5].txt -> TrackingCookie.Overture : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@www.paypal[1].txt -> TrackingCookie.Paypal : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.pointroll[3].txt -> TrackingCookie.Pointroll : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.pointroll[4].txt -> TrackingCookie.Pointroll : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.pointroll[5].txt -> TrackingCookie.Pointroll : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ads.pointroll[6].txt -> TrackingCookie.Pointroll : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@pro-market"]finks@pro-market[/EMAIL][1].txt -> TrackingCookie.Pro-market : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@questionmarket"]finks@questionmarket[/EMAIL][1].txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@questionmarket"]finks@questionmarket[/EMAIL][2].txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@questionmarket"]finks@questionmarket[/EMAIL][3].txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@questionmarket"]finks@questionmarket[/EMAIL][4].txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@questionmarket"]finks@questionmarket[/EMAIL][5].txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@questionmarket"]finks@questionmarket[/EMAIL][6].txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@questionmarket"]finks@questionmarket[/EMAIL][7].txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@questionmarket"]finks@questionmarket[/EMAIL][8].txt -> TrackingCookie.Questionmarket : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@real"]finks@real[/EMAIL][2].txt -> TrackingCookie.Real : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][10].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][1].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][2].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][3].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][4].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][5].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][6].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][7].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][8].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@realmedia"]finks@realmedia[/EMAIL][9].txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@web4.realtracker[1].txt -> TrackingCookie.Realtracker : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@revsci"]finks@revsci[/EMAIL][1].txt -> TrackingCookie.Revsci : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@revsci"]finks@revsci[/EMAIL][2].txt -> TrackingCookie.Revsci : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@revsci"]finks@revsci[/EMAIL][3].txt -> TrackingCookie.Revsci : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@revsci"]finks@revsci[/EMAIL][5].txt -> TrackingCookie.Revsci : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@revsci"]finks@revsci[/EMAIL][6].txt -> TrackingCookie.Revsci : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@revsci"]finks@revsci[/EMAIL][7].txt -> TrackingCookie.Revsci : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@edge.ru4[3].txt -> TrackingCookie.Ru4 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@edge.ru4[4].txt -> TrackingCookie.Ru4 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@edge.ru4[6].txt -> TrackingCookie.Ru4 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@edge.ru4[7].txt -> TrackingCookie.Ru4 : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@bs.serving-sys[4].txt -> TrackingCookie.Serving-sys : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@adopt.specificclick[3].txt -> TrackingCookie.Specificclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@specificclick"]finks@specificclick[/EMAIL][1].txt -> TrackingCookie.Specificclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@specificclick"]finks@specificclick[/EMAIL][2].txt -> TrackingCookie.Specificclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@specificclick"]finks@specificclick[/EMAIL][3].txt -> TrackingCookie.Specificclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@specificclick"]finks@specificclick[/EMAIL][4].txt -> TrackingCookie.Specificclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@specificclick"]finks@specificclick[/EMAIL][5].txt -> TrackingCookie.Specificclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@specificclick"]finks@specificclick[/EMAIL][7].txt -> TrackingCookie.Specificclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@specificclick"]finks@specificclick[/EMAIL][8].txt -> TrackingCookie.Specificclick : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@statcounter"]finks@statcounter[/EMAIL][1].txt -> TrackingCookie.Statcounter : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@statcounter"]finks@statcounter[/EMAIL][2].txt -> TrackingCookie.Statcounter : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@statcounter"]finks@statcounter[/EMAIL][4].txt -> TrackingCookie.Statcounter : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@anad.tacoda[3].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@anat.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tacoda"]finks@tacoda[/EMAIL][1].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tacoda"]finks@tacoda[/EMAIL][2].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tacoda"]finks@tacoda[/EMAIL][3].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tacoda"]finks@tacoda[/EMAIL][4].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tacoda"]finks@tacoda[/EMAIL][5].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@trafficmp"]finks@trafficmp[/EMAIL][1].txt -> TrackingCookie.Trafficmp : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@trafficmp"]finks@trafficmp[/EMAIL][2].txt -> TrackingCookie.Trafficmp : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@trafficmp"]finks@trafficmp[/EMAIL][3].txt -> TrackingCookie.Trafficmp : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@trafficmp"]finks@trafficmp[/EMAIL][4].txt -> TrackingCookie.Trafficmp : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@trafficmp"]finks@trafficmp[/EMAIL][5].txt -> TrackingCookie.Trafficmp : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@trafficmp"]finks@trafficmp[/EMAIL][6].txt -> TrackingCookie.Trafficmp : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@trafficmp"]finks@trafficmp[/EMAIL][7].txt -> TrackingCookie.Trafficmp : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tribalfusion"]finks@tribalfusion[/EMAIL][1].txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tribalfusion"]finks@tribalfusion[/EMAIL][2].txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tribalfusion"]finks@tribalfusion[/EMAIL][3].txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tribalfusion"]finks@tribalfusion[/EMAIL][4].txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@tribalfusion"]finks@tribalfusion[/EMAIL][5].txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@reduxads.valuead[2].txt -> TrackingCookie.Valuead : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@m.webtrends[1].txt -> TrackingCookie.Webtrends : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora_cheryl_finks@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ad.yieldmanager[3].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ad.yieldmanager[4].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ad.yieldmanager[5].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ad.yieldmanager[7].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl finks@ad.yieldmanager[8].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@zedo"]finks@zedo[/EMAIL][1].txt -> TrackingCookie.Zedo : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@zedo"]finks@zedo[/EMAIL][2].txt -> TrackingCookie.Zedo : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@zedo"]finks@zedo[/EMAIL][3].txt -> TrackingCookie.Zedo : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@zedo"]finks@zedo[/EMAIL][5].txt -> TrackingCookie.Zedo : Cleaned.
    C:\Documents and Settings\Nora Cheryl Finks\Cookies\nora cheryl [EMAIL="finks@zedo"]finks@zedo[/EMAIL][6].txt -> TrackingCookie.Zedo : Cleaned.

    ::Report end
  • TroganTrogan London, UK
    edited October 2007
    Could you post the log from C:\rapport.txt please.

    Also, I need to see another log from HijackThis.
    • Run Hijackthis.
    • Click on Open the Misc Tools section.
    • Next click on Open uninstall manager.
    • Press the Save list button.
    • Save the file to your desktop, with the default name of uninstall_list
    • Copy & Paste the entire contents of that file in your in your next post.
  • AllPawsHere
    edited October 2007
    725plc32
    Ad-Aware 2007
    Adobe Bridge 1.0
    Adobe Common File Installer
    Adobe Flash Player ActiveX
    Adobe Help Center 1.0
    Adobe Photoshop CS2
    Adobe Reader 8.1.0
    Adobe Stock Photos 1.0
    Advanced Media Extension v1.5
    AIM 6
    AOLIcon
    Apple Mobile Device Support
    Apple Software Update
    AVG 7.5
    AVG Anti-Spyware 7.5
    AVSystemCare 2.1.335.1
    Broadcom Management Programs
    Conexant HDA D110 MDC V.92 Modem
    Dell Color Printer 725
    Dell Driver Reset Tool
    Dell Game Console
    Dell Support 3.2.1
    Dell Wireless WLAN Card
    Digital Content Portal
    Digital Line Detect
    Documentation & Support Launcher
    EducateU
    Form Fill (Windows Live Toolbar)
    Games, Music, & Photos Launcher
    High Definition Audio Driver Package - KB835221
    HijackThis 2.0.2
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB926239)
    Intel(R) Graphics Media Accelerator Driver for Mobile
    iPod for Windows 2006-01-10
    IrfanView (remove only)
    iTunes
    J2SE Runtime Environment 5.0 Update 6
    McAfee Uninstaller
    MCU
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Office Outlook 2003 with Business Contact Manager Update
    Microsoft Office Professional Edition 2003
    Microsoft Plus! Digital Media Edition Installer
    Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ)
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Works
    Modem Helper
    MSN
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    Philips PC Camera
    Popup Blocker (Windows Live Toolbar)
    PowerDVD 5.5
    QuickSet
    QuickTime
    RealPlayer Basic
    Rhapsody Player Engine
    SearchAssist
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB916281)
    Security Update for Windows XP (KB917422)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921398)
    Security Update for Windows XP (KB921503)
    Security Update for Windows XP (KB922616)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923694)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924191)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925454)
    Security Update for Windows XP (KB925486)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928090)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB929969)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931768)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB933566)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB937143)
    Security Update for Windows XP (KB938127)
    Security Update for Windows XP (KB938829)
    Sonic DLA
    Sonic Update Manager
    Synaptics Pointing Device Driver
    Tabbed Browsing (Windows Live Toolbar)
    Update for Windows XP (KB894391)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB911280)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB929338)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB931836)
    Update for Windows XP (KB933360)
    Update for Windows XP (KB936357)
    Update for Windows XP (KB938828)
    URGE
    Viewpoint Media Player
    Web Piston
    WebVideo Support
    WildTangent Web Driver
    Windows Live Favorites for Windows Live Toolbar
    Windows Live Messenger
    Windows Live Outlook Toolbar (Windows Live Toolbar)
    Windows Live Sign-in Assistant
    Windows Live Toolbar
    Windows Live Toolbar
    Windows Live Toolbar Extension (Windows Live Toolbar)
    Windows Live Toolbar Feed Detector (Windows Live Toolbar)
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 10
    Windows Media Player 11
    Windows Media Player 11
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890859
    Yahoo! Install Manager
    Yahoo! Internet Mail
    Yahoo! Messenger
    Zuma Deluxe



    SmitFraudFix v2.239
    Scan done at 18:48:08.57, Sun 10/07/2007
    Run from C:\Documents and Settings\Nora Cheryl Finks\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode
    »»»»»»»»»»»»»»»»»»»»»»»» Process

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nora Cheryl Finks

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Nora Cheryl Finks\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\NORACH~1\FAVORI~1

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!
    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"="C:\\WINDOWS\\system32\\sulimo.dat"

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Rustock

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

    »»»»»»»»»»»»»»»»»»»»»»»» End



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:33:09 PM, on 10/7/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.exe
    C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    C:\PROGRA~1\mcafee.com\agent\McAgent.exe
    C:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4061128
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/campaign.asp?cid=16313
    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: IEHlprObj Class - {ABCDECF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\vtr.dll (file missing)
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: The netadv - {ABF529BE-6245-465A-BBD4-238C4EAB0F0A} - C:\WINDOWS\netadv.dll (file missing)
    O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\mcafee\SPAMKI~1\mskagent.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
    O4 - HKUS\S-1-5-21-3308182640-4278076361-2879258875-1007\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?4dd3b610f2e540f599dd743c2415721c
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?4dd3b610f2e540f599dd743c2415721c
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O20 - AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat
    O21 - SSODL: msvb - {5C7E4F70-FD9F-417F-B374-2DDF185B0163} - (no file)
    O21 - SSODL: sysdx - {CD7CEB67-886C-4860-9170-10FCF89659D8} - (no file)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    --
    End of file - 5885 bytes
  • TroganTrogan London, UK
    edited October 2007
    Please do the following...

    1. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 update3.
    • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications."
    • Click the "Download" button to the right.
    • Check the box that says: "Accept License Agreement."
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove the following...
      • J2SE Runtime Environment 5.0 Update 6
      • SearchAssist
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u3-windows-i586-p.exe to install the newest version.

    2. Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)

    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: IEHlprObj Class - {ABCDECF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\vtr.dll (file missing)

    O3 - Toolbar: The netadv - {ABF529BE-6245-465A-BBD4-238C4EAB0F0A} - C:\WINDOWS\netadv.dll (file missing)

    O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe

    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1

    O20 - AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat

    O21 - SSODL: msvb - {5C7E4F70-FD9F-417F-B374-2DDF185B0163} - (no file)
    O21 - SSODL: sysdx - {CD7CEB67-886C-4860-9170-10FCF89659D8} - (no file)

    - Close ALL open windows (especially Internet Explorer!)
    - Click Fix Checked
    Close HiajckThis

    3. Run HJT again and click on Open the Misc Tools section.
    Click on delete a file on reboot...
    Copy and paste the following into the "File name:" text box and then click Open:

    C:\WINDOWS\system32\printer.exe

    When you are asked "Do you want to restart your computer now?", click NO.
    Repeat these steps for the following file(s) and this time, when you reach the end, click OK:

    C:\WINDOWS\system32\WinAvXX.exe
    C:\WINDOWS\system32\sulimo.dat

    Your PC MUST reboot to delete the files!

    4. Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.

    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
        Extended (if available otherwise Standard)
      • Scan Options:
        Scan Archives
        Scan Mail Bases
        [*]Click OK
        [*]Now under select a target to scan:
          Select
        My Computer
        [*]This will program will start and scan your system.
        [*]The scan will take a while so be patient and let it run.
        [*]Once the scan is complete it will display if your system has been infected.
        • Now click on the Save as Text button:
        [*]Save the file to your desktop.

        5. Please post the following...

        Kaspersky report
        New HijackThis log

        Questions:
        1. Do you have a Firewall?
        2. I see you have McAfee. Are you using it for an Anti-Virus?
      • AllPawsHere
        edited October 2007
        Did all that, and now I can't get my Internet to run at all... The Radio Wireless button refuses to turn/come on.
      • AllPawsHere
        edited October 2007
        Nix that... Radio button is back on, but it refuses to open an internet search page...
      • TroganTrogan London, UK
        edited October 2007
        Please download WinSock XP Fix to your Desktop.

        Close ALL programs/windows.

        Open the tool and click on the Fix button.

        Restart the computer and check if the Internet is working.
      • AllPawsHere
        edited October 2007
        Trogan wrote:
        Please download WinSock XP Fix to your Desktop.

        Close ALL programs/windows.

        Open the tool and click on the Fix button.

        Restart the computer and check if the Internet is working.

        Everything (except the internet) was working fine until I downloaded that program. NOT good because now all the "has been blocked by your system administrator" has been returned.

        Next suggestion?
      • AllPawsHere
        edited October 2007
        And now I'm getting all the popups again...
      • TroganTrogan London, UK
        edited October 2007
        Please go to Add/Remove programs, and uninstall the following...

        AVSystemCare 2.1.335.1

        Restart the computer, and post a new HijackThis log please.
      • AllPawsHere
        edited October 2007
        I cant... It says its been blocked by the administrator... (and remember I am the only user of the computer)

        Laptop- Meet window... Window... meet laptop.
      • TroganTrogan London, UK
        edited October 2007
        Will it not let you post a HijackThis log?
      • AllPawsHere
        edited October 2007
        Let me see if I can run that...
      • AllPawsHere
        edited October 2007
        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 9:31:34 PM, on 10/7/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
        Boot mode: Normal
        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
        C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
        c:\program files\mcafee.com\agent\mcdetect.exe
        c:\PROGRA~1\mcafee.com\vso\mcshield.exe
        c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
        C:\WINDOWS\Explorer.EXE
        c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
        c:\program files\mcafee.com\vso\mcvsshld.exe
        C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
        c:\program files\mcafee.com\agent\mcagent.exe
        c:\progra~1\mcafee.com\vso\mcvsescn.exe
        C:\WINDOWS\system32\svchost.exe
        C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
        C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
        C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
        C:\WINDOWS\system32\igfxpers.exe
        C:\WINDOWS\system32\igfxsrvc.exe
        C:\WINDOWS\system32\hkcmd.exe
        C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
        C:\WINDOWS\system32\dla\tfswctrl.exe
        C:\Program Files\Dell\QuickSet\quickset.exe
        C:\WINDOWS\system32\WLTRAY.exe
        C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        C:\Program Files\Dell Support\DSAgnt.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun.exe
        c:\progra~1\mcafee.com\vso\mcvsftsn.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Program Files\Grisoft\AVG7\avgwa.dat
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        --
        End of file - 2267 bytes
      • TroganTrogan London, UK
        edited October 2007
        The log is not completely posted.
      Sign In or Register to comment.