Bullguard Antivirus Forum Download A Free Copy Of Bullguard Antivirus Software
Free Antivirus Forum - Learn about antivirus, firewalls and personal security Free Antivirus Forum - Learn about antivirus, firewalls and personal security
 HomeLog InRegisterCommunity CalendarSearch the ForumView The Member ListHelp
C:\ Drive
   
BullGuard Antivirus Forum > Virus > Virus Questions > C:\ Drive  
Forum Quick Jump
 
New Topic Post reply to : C:\ Drive Printable version of : C:\ Drive
[ << Previous Thread | Next Thread >> ]

ytam
New Member


Date Joined Jun 2008
Total Posts : 4
  		   Posted 7-7-2008 10:11 (GMT +1)    Quote: C:\ DriveAlert an admin about: C:\ Drive
Hello there I have a problem that when ever i started windows a window for drive C:\ open automatically, i don't know whethere its a virus or how to stop that.
Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 16319
  		   Posted 7-7-2008 11:49 (GMT +1)    Quote: C:\ DriveAlert an admin about: C:\ Drive
Hello smile
 
 
Let´s check and see if it a virus -
 
 

1. Get this version of Hijackthis from http://danborg.org/spy/hjt/alternativ.exe
 
2 Save it in a permanent folder of your choice, such as C:\HJT\. To create this specific folder on your hard drive: Double click the 'My Computer' icon on your desktop, then under the category hard disk drives: double click Local Disk:, then select file->New -> Folder and name it HJT
3 Run hijackthis.  (alternativ exe).

Choose the "Do a system scan and save a log file" option to perform your scan.
HijackThis will analyze your system, and automatically open a notepad textfile containing the HijackThis log when the scan is finished.
Open the text files containing the logs with a text editor and click Edit -> Select All, followed by Edit -> Copy.
From within the browser window and with the message body text box selected, click Edit -> Paste.
Post hijackthis log here

Do NOT post your problem in someone elses thread.
Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Back to Top
 

ytam
New Member


Date Joined Jun 2008
Total Posts : 4
  		   Posted 7-7-2008 1:43 (GMT +1)    Quote: C:\ DriveAlert an admin about: C:\ Drive
Thanks lot Touch, here is the Logfile:
Logfile of HijackThis v1.99.1
Scan saved at 4:40:28 AM, on 7/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\WINDOWS\System\svchost.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live Toolbar\msn_sl.exe
C:\Documents and Settings\XPPRESP3\My Documents\Hijack\alternativ.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe"
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System\svchost.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System\dumprep.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{798EB7B4-BCB6-44A2-8D84-475CD7A7D993}: NameServer = 196.29.180.29 196.29.164.29
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Tomcat5\apache-tomcat-5.5.26\apache-tomcat-5.5.26\bin\tomcat5.exe
O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00 (file missing)


Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 16319
  		   Posted 7-7-2008 1:55 (GMT +1)    Quote: C:\ DriveAlert an admin about: C:\ Drive
It seems to be Trojan/Backdoor related ;-)
 
 
Please download Combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
 
 
And save to the desktop.

Close all other browser windows.
 
 
 
 
Important-> Temporarily disable your anti-virus, real-time protection before performing a scan.
They can interfere with combofix or remove some of its embedded files which may cause "unpredictable results".
 
 
Go to Start->Run and copy/paste: ComboFix /snapshot and hit OK. It should run Combofix.
 
Please note, that once you start combofix you should not click anywhere on the combofix window
as it can cause the program to stall.
In fact, when combofix is running, do not touch your computer at all
and just take a break as it may take a while for it to complete.

 When finished, it will produce a logfile located at C:\combofix.txt.
 

Post the contents of that log in your next reply with a new hijackthis log.
 
Please copy and paste your log files. DO NOT add it as an attachment



NB. If you are using any P2P (file sharing) programs, please remove them before we clean your computer..
We do not clean logs that have P2P applications installed as this can cause reinfection during your cleaning.

Do NOT post your problem in someone elses thread.
Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Back to Top
 

ytam
New Member


Date Joined Jun 2008
Total Posts : 4
  		   Posted 7-7-2008 5:55 (GMT +1)    Quote: C:\ DriveAlert an admin about: C:\ Drive
Thank you lot Touch for your kindlly reply and cooperation. Now I have done ComboFix and hijackthis and here is the log file and the hijackithis respectivelly:
hop
ComboFix 08-07-05.1 - XPPRESP3 2008-07-07  8:42:59.1 - NTFSx86
Running from: C:\Documents and Settings\XPPRESP3\Desktop\ComboFix.exe
 * Resident AV is active

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\internet explorer\msimg32.dll
C:\WINDOWS\system\svchost.exe
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\pskill.exe
.
(((((((((((((((((((((((((   Files Created from 2008-06-07 to 2008-07-07  )))))))))))))))))))))))))))))))
.
2008-07-06 13:08 . 2008-07-06 13:08 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-07-06 13:04 . 2008-07-07 08:38 <DIR> d-------- C:\Program Files\ESET
2008-07-06 13:00 . 2008-07-06 13:06 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Avira
2008-07-04 07:06 . 2008-07-04 07:06 <DIR> d-------- C:\Program Files\MyABCD
2008-06-25 11:14 . 2008-06-25 11:14 <DIR> d-------- C:\Program Files\ArabicSP Software
2008-06-24 11:44 . 2008-06-24 11:44 <DIR> d-------- C:\Program Files\Klango
2008-06-23 11:00 . 2008-06-23 11:00 <DIR> d-------- C:\WINDOWS\Sun
2008-06-16 04:03 . 2008-06-16 04:03 244 --ah----- C:\sqmnoopt17.sqm
2008-06-12 06:39 . 2008-06-12 06:39 <DIR> d-------- C:\Program Files\MicroTools4U
2008-06-11 12:40 . 2008-06-11 12:40 <DIR> d-------- C:\Program Files\AskSBar
2008-06-11 12:36 . 2008-07-06 23:09 <DIR> d-------- C:\Program Files\SpeedBit Video Accelerator
2008-06-11 12:36 . 2008-06-11 12:45 <DIR> d-------- C:\Program Files\DAP
2008-06-11 12:36 . 2008-06-11 12:36 479,298 --a------ C:\WINDOWS\system32\wbocx.ocx
2008-06-11 12:36 . 2008-06-11 12:36 172,032 --a------ C:\WINDOWS\system32\AniGIF.ocx
2008-06-11 12:36 . 2008-06-11 12:36 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
2008-06-11 12:24 . 2008-06-11 12:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-06-09 10:39 . 2007-10-02 09:10 <DIR> d-------- C:\aha
2008-06-09 10:39 . 2008-05-28 11:56 11,515,042 --a------ C:\aha-3.0-p4.zip
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-06 20:08 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-07-06 19:35 --------- d-----w C:\Program Files\SPSS
2008-07-06 08:11 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-06-07 03:52 --------- d-----w C:\Program Files\Apache Software Foundation
2008-06-06 06:02 56 ----a-w C:\Tomcat.bat
2008-06-05 03:52 --------- d-----w C:\Program Files\Java
2008-06-05 01:55 --------- d-----w C:\Program Files\Common Files\Java
2008-06-02 03:58 --------- d-----w C:\Program Files\Star E-Media
2008-05-28 23:00 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Windows Live Toolbar
2008-05-28 22:54 --------- d-----w C:\Program Files\MSN Messenger
2008-05-22 03:38 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Talkback
.
------- Sigcheck -------
2006-06-17 23:43  663552  d94cffdb53e7ac867438e2dfd50e7cbc C:\WINDOWS\system32\wininet.dll
2005-07-13 04:07  360448  0601f83f6784c220ee302f03f702316e C:\WINDOWS\system32\drivers\tcpip.sys
2006-07-06 14:50  2058368  d20855e9a650415e4f65e0ce249839bd C:\WINDOWS\system32\ntkrnlpa.exe
2006-06-17 23:43  2181248  da58ba325f6148ec49abfc93c656a1df C:\WINDOWS\system32\ntoskrnl.exe
2005-10-15 14:07  949760  17e3c975c6fe3e94cf760f10d91c2af3 C:\WINDOWS\explorer.exe
2005-10-15 14:07  1032192  45757077a47c68a603a79b03a1a836ab C:\WINDOWS\XPize\Backup\explorer.exe
2004-08-04 19:00  30208  de8fa9cf18f95341079c7e6a215c226a C:\WINDOWS\system32\ctfmon.exe
2004-08-04 19:00  15360  24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\XPize\Backup\ctfmon.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-06-11 12:40 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 19:00 30208]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 14:54 5674352]
"Messenger (Yahoo!)"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2008-05-27 21:58 4269296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 18:00 98304]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2008-06-05 06:52 77824]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.EXE" [2008-06-11 12:36 3053056]
"SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2008-06-11 12:36 2705008]
"SiSPower"="SiSPower.dll" [2006-03-09 04:04 49152 C:\WINDOWS\system32\SiSPower.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 19:00 30208]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2008-04-26 03:30:27 262144]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2e,65,78,65,00
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WudfServiceGroup REG_SZ          hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,00
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86713af0-1372-11dd-af7d-806d6172696f}]
\Shell\AutoRun\command - J:\haircut2.exe
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-07-07 04:50:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-PHIME2002A - C:\WINDOWS\System\svchost.exe
HKLM-Run-PHIME2002ASync - C:\WINDOWS\System\dumprep.exe

**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-07 08:45:02
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfPf]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,57,00,75,00,64,00,66,00,50,00,66,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfRd]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,75,00,64,00,66,00,72,00,64,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
"ServiceDll"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,55,00,44,00,46,00,53,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfPf]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,57,00,75,00,64,00,66,00,50,00,66,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfRd]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,75,00,64,00,66,00,72,00,64,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
"ServiceDll"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,55,00,44,00,46,00,53,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00"
.
Completion time: 2008-07-07  8:46:45
ComboFix-quarantined-files.txt  2008-07-07 05:46:43
Pre-Run: 1,266,659,328 bytes free
Post-Run: 1,404,567,552 bytes free
144
******************************hijakthis**********************************************


Logfile of HijackThis v1.99.1
Scan saved at 08:47, on 7/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\CF24181.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
C:\WINDOWS\system32\notepad.exe
C:\ComboFix\NirCmd.cfexe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\XPPRESP3\My Documents\Hijack\alternativ.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe"
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System\svchost.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System\dumprep.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Tomcat5\apache-tomcat-5.5.26\apache-tomcat-5.5.26\bin\tomcat5.exe
O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00 (file missing)
hop
Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 16319
  		   Posted 7-7-2008 6:43 (GMT +1)    Quote: C:\ DriveAlert an admin about: C:\ Drive
Seems to We have improvement smile
 
 
Please download Free  Version of Superantispyware
http://www.superantispyware.com/superantispywarefreevspro.html
 
Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it.
close the program
 
 
Please download ATF Cleaner:
 http://www.atribune.org/ccount/click.php?id=1 by Atribune.
This program is for XP and Windows 2000 only
 
 
 
Run Hijackthis and place a check beside each of the following. Close all other browser windows except HJT.
Click fix checked.
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System\svchost.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System\dumprep.exe
 
 
 
 
 
Please print out or copy this page to Notepad as you will be in Safe Mode and unable to refer to this page.
 
 
 
Reboot to Safe mode
 
 
Delete the following files or folders (delete item in bold). Please do not be concerned if
any of the items are not found as they may have been automatically removed by actions I had
you take earlier in the cleaning process.
 
 
Open Folder Options in Controlpanel >view and check your settings:
Select
Show hidden files and folders
Display the contents of system folders
Uncheck: Hide protected operating system files
Delete:
Files:
C:\WINDOWS\System\svchost.exe
C:\WINDOWS\System\dumprep.exe
<<<ß These infection should not be confused with the
legitimate C:\Windows\System32\dumprep.exe and
C:\Windows\System32\ svchost.exe
 
 
 
Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of:
Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch (Windows XP) only.
Java Cache
Recycle Bin
NB. It's normal after running ATF cleaner that the PC will be slower to boot the first time.
 
 
 
 
Start Superantispyware.
Hit - Scan Your Computer - button
Click on the drive(s) you want to scan. Put a check in - Perform Complete Scan, then next,
it will scan now. When scan have finished, put a checkmark with  all items it found. Next, after cleaning, allow it to Reboot
 
 
 
Start Superantispyware again –
Click Preferences and then click the statistics/logs tab.
Click the dated log and press view log and a text file will appear.
 
 
 
Post this log along with fresh hijackthis log,  and tell how things are running  ?
 
 
 
 
 
 
 
 
 
 
 

Do NOT post your problem in someone elses thread.
Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Back to Top
 

ytam
New Member


Date Joined Jun 2008
Total Posts : 4
  		   Posted 7-7-2008 8:58 (GMT +1)    Quote: C:\ DriveAlert an admin about: C:\ Drive
Thanks lot TOUCH I think it works cause I didn't see the automatic opening of the C:\ when I rebote, but here is to logs SUPERAntiSpyware and hijackthis respectivelly:
yeah hop
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 07/07/2008 at 11:29 AM
Application Version : 4.15.1000
Core Rules Database Version : 3469
Trace Rules Database Version: 1460
Scan type       : Complete Scan
Total Scan Time : 00:30:21
Memory items scanned      : 340
Memory threats detected   : 0
Registry items scanned    : 3912
Registry threats detected : 0
File items scanned        : 33151
File threats detected     : 347
Trojan.Dropper/SVCHost-Fake
 C:\DOCUMENTS AND SETTINGS\DEFAULT USER\LOCAL SETTINGS\HISTORY\SVCHOST.EXE
Adware.Tracking Cookie
 .adbrite.com [ C:\Documents and Settings\XPPRESP3\Application Data\Mozilla\Firefox\Profiles\rkdqvo0e.default\cookies.txt ]
 .adbrite.com [ C:\Documents and Settings\XPPRESP3\Application Data\Mozilla\Firefox\Profiles\rkdqvo0e.default\cookies.txt ]
 .adbrite.com [ C:\Documents and Settings\XPPRESP3\Application Data\Mozilla\Firefox\Profiles\rkdqvo0e.default\cookies.txt ]
 .tdstats.com [ C:\Documents and Settings\XPPRESP3\Application Data\Mozilla\Firefox\Profiles\rkdqvo0e.default\cookies.txt ]
 .tdstats.com [ C:\Documents and Settings\XPPRESP3\Application Data\Mozilla\Firefox\Profiles\rkdqvo0e.default\cookies.txt ]
 C:\Documents and Settings\XPPRESP3\Cookies\xppresp3@tradedoubler[2].txt
 C:\Documents and Settings\XPPRESP3\Cookies\xppresp3@ad.yieldmanager[2].txt
 sitestats.ets.org [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .fastclick.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .fastclick.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 ad.yieldmanager.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 ad.yieldmanager.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 ad.yieldmanager.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 ad.yieldmanager.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 ad.yieldmanager.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .ad.yieldmanager.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .ad.yieldmanager.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .ad.yieldmanager.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statcounter.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .atdmt.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .doubleclick.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mediaplex.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mediaplex.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .advertising.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .advertising.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .advertising.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .advertising.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .advertising.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .apmebf.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .apmebf.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .tribalfusion.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .eb.adbureau.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .burstnet.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .tacoda.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .tacoda.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .tacoda.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .casalemedia.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .casalemedia.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .casalemedia.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .casalemedia.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .casalemedia.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .burstnet.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .questionmarket.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .questionmarket.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .specificclick.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .specificclick.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .specificclick.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .specificclick.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .specificclick.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .msnportal.112.2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .tradedoubler.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 uk.sitestat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 uk.sitestat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 eas.apm.emediate.eu [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 eas.apm.emediate.eu [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .revsci.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .revsci.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .revsci.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .revsci.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .revsci.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .revsci.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .revsci.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .hotlog.ru [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statse.webtrendslive.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 statse.webtrendslive.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adbrite.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adbrite.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adbrite.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 uk.sitestat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .zedo.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .zedo.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 ads.bridgetrack.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 ads.bridgetrack.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .realmedia.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .realmedia.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .kontera.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .kontera.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .kontera.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adinterax.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adinterax.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adinterax.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 statse.webtrendslive.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .ieee.adbureau.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mywebsearch.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mywebsearch.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mywebsearch.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mywebsearch.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mywebsearch.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mywebsearch.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mywebsearch.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mywebsearch.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .mywebsearch.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .ads.pointroll.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .ads.pointroll.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .ads.pointroll.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .ads.pointroll.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .yadro.ru [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .sitestat.mayoclinic.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .try.starware.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .valueclick.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .serving-sys.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .webstat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .webstat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .webstat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .serving-sys.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .serving-sys.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .serving-sys.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .serving-sys.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .stat.dealtime.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statse.webtrendslive.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .statse.webtrendslive.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .wpni.112.2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .targetnet.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .insightexpressai.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .insightexpressai.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .insightexpressai.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .insightexpressai.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .insightexpressai.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .insightexpressai.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .insightexpressai.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .insightexpressai.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .nl.sitestat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .nl.sitestat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .nl.sitestat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .roiservice.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .nextstat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .nextstat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .nextstat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .nextstat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .nextstat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .maxserving.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .maxserving.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .rotator.adjuggler.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .rotator.adjuggler.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .fortunecity.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .goclick.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .goclick.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .uk.sitestat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .uk.sitestat.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .findarticles.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .findarticles.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .highbeam.122.2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .overture.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .overture.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .overture.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .revenue.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .www.addfreestats.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .bs.serving-sys.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adtech.de [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adtech.de [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .bfast.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .data.coremetrics.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .www2.addfreestats.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .atwola.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .cnetasiapacific.122.2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .imrworldwide.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .imrworldwide.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adserver.matchcraft.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .www1.addfreestats.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adjuggler.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .adopt.euroclick.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 .sonygs.112.2o7.net [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 findarticles.com [ C:\Documents and Settings\yaser\Application Data\Mozilla\Firefox\Profiles\edo2ntuk.default\cookies.txt ]
 C:\Documents and Settings\yaser\Cookies\yaser@maxserving[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@media.adrevolver[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@wpni.112.2o7[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@advertising[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@counter.hitslink[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@zedo[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@questionmarket[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@spylog[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@3.adbrite[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adtech[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@valueclick[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ehg-leapfrog.hitbox[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@try.starware[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@burstnet[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ads.guardian.co[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@highbeam.122.2o7[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@indexstats[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@tribalfusion[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@upspiral[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ad.yieldmanager[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@112.2o7[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ehg-france24.hitbox[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@trafficmp[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adserver[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ad1.emediate[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@casalemedia[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ehg-tfl.hitbox[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@goclick[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@bfast[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@cnetasiapacific.122.2o7[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@serving-sys[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@tripod[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@anad.tacoda[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ads.addynamix[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adbrite[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@tacoda[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@m1.webstats.motigo[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@popularscreensavers[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ehg-medpagetoday.hitbox[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@overture[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@statse.webtrendslive[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@revsci[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@sales.liveperson[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ads.pointroll[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ads.touregypt[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@roiservice[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@realmedia[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@eas.apm.emediate[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@rotator.adjuggler[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@doubleclick[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@bluestreak[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@fastclick[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adv.webmd[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ehg-traderelectronicmedia.hitbox[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@fortunecity[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@msnaccountservices.112.2o7[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@atwola[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adjuggler[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ads.remal.com[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@account.live[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@apmebf[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@revenue[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@data.coremetrics[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@2o7[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@findarticles[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@mediaplex[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@h.starware[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ads.collegeconfidential[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@kanoodle[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@weborama[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@hg1.hitbox[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ecnext.advertserve[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ads.telegraph.co[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@sitestats.tiscali.co[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ehg-oreilly.hitbox[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@eb.adbureau[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@statcounter[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@salah555.tripod[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@yadro[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@accounts[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@media[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ehg-aha.hitbox[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@stat.dealtime[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@atdmt[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ad.islamonline[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@www.burstnet[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@azjmp[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adopt.euroclick[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adinterax[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@stats[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@specificclick[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@www.ezytrack[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@hotlog[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adlegend[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@sitestat.mayoclinic[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@mywebsearch[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@insightexpressai[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@bs.serving-sys[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@kontera[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ehg-fluorcorp.hitbox[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adrevolver[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@adrevolver[3].txt
 C:\Documents and Settings\yaser\Cookies\yaser@ehg-techtarget.hitbox[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@server.iad.liveperson[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@hitbox[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@allstardirectories.112.2o7[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@bilbo.counted[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@targetnet[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@a.findarticles[1].txt
 C:\Documents and Settings\yaser\Cookies\yaser@tradedoubler[2].txt
 C:\Documents and Settings\yaser\Cookies\yaser@msnportal.112.2o7[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@2o7[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@wpni.112.2o7[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@maxserving[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@media.adrevolver[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@advertising[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@counter.hitslink[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@zedo[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@questionmarket[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@3.adbrite[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adtech[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@valueclick[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ehg-leapfrog.hitbox[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@try.starware[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@burstnet[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@spylog[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ads.guardian.co[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@highbeam.122.2o7[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@indexstats[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@tribalfusion[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@upspiral[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ad.yieldmanager[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ad.yieldmanager[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@112.2o7[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ehg-france24.hitbox[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@trafficmp[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ad1.emediate[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adserver[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@casalemedia[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ehg-tfl.hitbox[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@goclick[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@bfast[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@cnetasiapacific.122.2o7[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@serving-sys[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@tripod[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@anad.tacoda[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ads.addynamix[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adbrite[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@tacoda[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@m1.webstats.motigo[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@popularscreensavers[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ehg-medpagetoday.hitbox[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@overture[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ads.touregypt[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@statse.webtrendslive[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@revsci[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@sales.liveperson[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ads.pointroll[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@realmedia[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@eas.apm.emediate[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@rotator.adjuggler[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@roiservice[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@bluestreak[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@fastclick[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adv.webmd[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@doubleclick[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ehg-traderelectronicmedia.hitbox[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@atwola[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@msnaccountservices.112.2o7[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adjuggler[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ads.remal.com[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@account.live[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@apmebf[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@fortunecity[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@revenue[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@data.coremetrics[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@findarticles[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@mediaplex[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@2o7[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@h.starware[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ads.collegeconfidential[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@kanoodle[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@weborama[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@hg1.hitbox[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ecnext.advertserve[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ads.telegraph.co[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@sitestats.tiscali.co[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ehg-oreilly.hitbox[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@eb.adbureau[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@statcounter[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@salah555.tripod[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@yadro[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@accounts[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@media[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@msnportal.112.2o7[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ehg-aha.hitbox[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@stat.dealtime[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@atdmt[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ad.islamonline[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@www.burstnet[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@azjmp[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adopt.euroclick[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adinterax[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@stats[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@specificclick[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@www.ezytrack[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@hotlog[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@mywebsearch[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adlegend[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@sitestat.mayoclinic[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@mywebsearch[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@insightexpressai[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@bs.serving-sys[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@kontera[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adrevolver[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@adrevolver[3].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ehg-techtarget.hitbox[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@ehg-fluorcorp.hitbox[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@allstardirectories.112.2o7[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@server.iad.liveperson[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@hitbox[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@bilbo.counted[2].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@tradedoubler[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@targetnet[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@a.findarticles[1].txt
 E:\?C??\ Root\Documents and Settings\yaser\Cookies\yaser@tradedoubler[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@2o7[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@wpni.112.2o7[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@maxserving[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@media.adrevolver[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@advertising[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@counter.hitslink[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@zedo[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@questionmarket[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@3.adbrite[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adtech[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@valueclick[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ehg-leapfrog.hitbox[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@try.starware[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@burstnet[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@spylog[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ads.guardian.co[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@highbeam.122.2o7[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@indexstats[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@tribalfusion[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@upspiral[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ad.yieldmanager[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ad.yieldmanager[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@112.2o7[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ehg-france24.hitbox[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@trafficmp[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ad1.emediate[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adserver[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@casalemedia[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ehg-tfl.hitbox[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@goclick[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@bfast[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@cnetasiapacific.122.2o7[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@serving-sys[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@tripod[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@anad.tacoda[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ads.addynamix[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adbrite[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@tacoda[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@m1.webstats.motigo[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@popularscreensavers[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ehg-medpagetoday.hitbox[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@overture[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ads.touregypt[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@statse.webtrendslive[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@revsci[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@sales.liveperson[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ads.pointroll[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@realmedia[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@eas.apm.emediate[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@rotator.adjuggler[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@roiservice[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@bluestreak[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@fastclick[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adv.webmd[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@doubleclick[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ehg-traderelectronicmedia.hitbox[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@atwola[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@msnaccountservices.112.2o7[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adjuggler[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ads.remal.com[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@account.live[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@apmebf[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@fortunecity[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@revenue[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@data.coremetrics[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@findarticles[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@mediaplex[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@2o7[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@h.starware[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ads.collegeconfidential[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@kanoodle[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@weborama[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@hg1.hitbox[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ecnext.advertserve[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ads.telegraph.co[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@sitestats.tiscali.co[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ehg-oreilly.hitbox[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@eb.adbureau[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@statcounter[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@salah555.tripod[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@yadro[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@accounts[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@media[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@msnportal.112.2o7[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ehg-aha.hitbox[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@stat.dealtime[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@atdmt[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ad.islamonline[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@www.burstnet[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@azjmp[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adopt.euroclick[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adinterax[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@stats[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@specificclick[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@www.ezytrack[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@hotlog[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@mywebsearch[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adlegend[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@sitestat.mayoclinic[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@mywebsearch[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@insightexpressai[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@bs.serving-sys[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@kontera[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adrevolver[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@adrevolver[3].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ehg-techtarget.hitbox[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@ehg-fluorcorp.hitbox[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@allstardirectories.112.2o7[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@server.iad.liveperson[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@hitbox[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@bilbo.counted[2].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@tradedoubler[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@targetnet[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@a.findarticles[1].txt
 E:\?C??\Documents and Settings\yaser\Cookies\yaser@tradedoubler[2].txt
Trojan.Downloader-Gen/Win
 C:\DOCUMENTS AND SETTINGS\XPPRESP3\MY DOCUMENTS\MY COMPLETED DOWNLOADS\ANTI-COPY.EXE\ANTI COPY.EXE.EXE
Adware.Starware
 C:\DOCUMENTS AND SETTINGS\YASER\MY DOCUMENTS\REFERENCE.EXE
Adware.MyWebSearch
 C:\PROGRAM FILES\TRUE SWORD 4\BACKUPED\6\MWSOEMON.EXE
 
***************************************************************************************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 11:47, on 7/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
C:\Documents and Settings\XPPRESP3\My Documents\Hijack\alternativ.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (file missing)
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Tomcat5\apache-tomcat-5.5.26\apache-tomcat-5.5.26\bin\tomcat5.exe
O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00 (file missing)
 
 
Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 16319
  		   Posted 7-9-2008 6:24 (GMT +1)    Quote: C:\ DriveAlert an admin about: C:\ Drive
That´s good news smilewinkgrin
 
 
I´ll suggest you block for tracking cookies -
 
"Open Internet Options | Privacy, click on the Advanced button.
Place a check in "Override automatic cookie handling".
Set "First Party Cookies" to allow, set "Third Party Cookies" to Block."


To completely and immediately remove any infected file or files in the data store, turn off and then turn on System Restore.
To do so, follow these steps:
System Restore
 
 
Please  read Tony Klein's excellent article  about how to prevent against  spyware/hijackers in the future
http://www.castlecops.com/t7736-So_how_did_I_get_infected_in_the_first_place.html   
 

Do NOT post your problem in someone elses thread.
Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Back to Top
 
New Topic Post reply to : C:\ Drive Printable version of : C:\ Drive
 
Forum Information
Currently it is Saturday, November 21, 2009 6:00 AM (GMT +1)
There are a total of 73.023 posts in 17.111 threads.
In the last 3 days there were 9 new threads and 75 reply posts. View Active Threads
Who's Online
This forum has 30331 registered members. Please welcome our newest member, bigpapa97.
32 Guest(s), 0 Registered Member(s) are currently online.  Details
5 Latest Threads
Please help with Redirecting and virus scan virus (0)21-11-2009 04:02:23 (bigpapa97)
Help Needed...Win32.Trojan (13)21-11-2009 03:53:58 (manutd83)
Cannot install anti-virus softeware or do window updates... need help (16)21-11-2009 02:44:45 (Touch)
How to remove VBS:Malware-gen virus??? (4)20-11-2009 22:26:03 (DarkPrincess)
Unable to start COM+ Event, BITs and Windows Update on Win2000 (13)20-11-2009 22:10:54 (sjrsquared)


Need Support? Write to: | Forum Help Manual

Download free trial version of Bullguard