Here’s couple of good antispyware programs you may want to try. They even may ferret out a trojan or two.
AVG anti-spyware
http://www.ewido.net/en/download/
Resident scanner during trial On-Demand after trial ends.
Or SUPERantispyware
http://www.superantispyware.com/
On-Demand only in free version.
As I said earlier in the thread and echoed by DavidR, spybot is highly unlikely to be the culprit here. All the entries where to av or security sites. These where placed here by some malware. This malware may or may not still be present. Spybot at one time may have added the two lines "# Start of entries inserted by Spybot - Search & Destroy
BTW you can also remove the host.txt file you created earlier if you like, it’s just a copy of your original hosts file minus the two avast entries. It’s inert and won’t do anything if you choose to leave it there.
Need someone with xp to confirm if the hosts file should be read only or archive. It’s archive on win98se.
Just to correct my post regarding boottime scan, it should have said right click the “a” icon, select start avast antivirus. this will start the simple user interface. Right click on the skin, select schedule bootime scan. Reboot.
Why create new files when you should edit the ‘existing’ original HOSTS file, note this is a file without an extension and do a Save and not a Save as.
When saving it should save the original file with adding a file extension .txt at the end of it. However if it has a whinge about that make sure that the Save as type is set to All Files and this should stop the file type extension .txt being added.
Edit: The hosts file in XP is also read only (I may have changed that to protect it from being edited though), archive, but I suspect that would have been changed to be able to edit the file to place the redirects in.
I have just checked further and even with All Files selected it may still create a new hosts.txt because the original is read only. If that is the case you can either uncheck the read only to be able to write and save any changes.
@ DavidR
People sometimes are more comfortable making changes knowing that a backup is in place. Rename and create new would have done this.
It seems, since it was a read only file, what ever modified the original file has the ability to either modify protected files without user input and/or change attributes, don’t you think?
On an xp upgrade, seeing how the hosts file remains in the 98/me location does the sam extention still apply?
Since I did an upgrade from win98 to XP Pro the only hosts file/s that remained in the Windows folder was HOSTS which was empty, no hosts.sam or imhosts.sam or hosts.isc which are in the XP system32\drivers\etc folder.
I think that some of the applications that purport to protect the hosts file only change the attributes to read only.
Thanks. Just checking to see what else is slightly different in an upgrade version vs full.
As for the protection, that’s kinda what I thought.
Hi…I’m back…had to be a Canteen Mum today so only just getting back to you. I ran a boot-time scan yesterday and when I came back to the computer when it finally finished there was nothing on the screen so I guess it didn’t pick up on anything. A couple of days ago I did have some ‘Neptunia’ trojans…my system is really slow at the moment too. I run Ad-aware, Spyware Blaster and Spybot weekly and Windows Defender occasionally so shouldn’t get too many problems but I suspect my system probably does need further ‘repair’.
So where are we up to with the hosts file? In reading your discussion, I’m a bit confused. (Easily done!)
Also with regard to suggested programs…will look into them. I’ll end up having more spyware apps than fun stuff on my computer. The desktop will look like an armory!
Can you also explain what a Hi-Jack log is and how it’s read to solve mysterious computer ailments?
Ness
I would say your hosts file is resolved, except to try and determine how it was changed. Depending on what you did you either replaced it or created a new one.
.
Our discussion was mainly on the merits of create a new file versus edit the original. The result would have been the same unless you ran into a windows permissions error such as you did wilth the imhosts.sam file. The other part was on a system running the upgrade version of xp a few files aren’t where you expect them.
The boottime scan will stop and ask for input if it finds anything. If it doesn’t find anything windows will load as usuall. You say the screen was blank, can you elaborate a bit? The bootime scan screen is, I believe, blue with white text.(not available to me on win9se)
I can’t find anything on “neptunia” except it’s a game. Perhaps avast detected a trojan in one of the neptunia files. If it was avast that detected something, it should be in the log file. Right click the “a” icon, select avast log viewer and click on the warning button. You will have to expand the columns by sliding them sideways to be able to read the full file name and what was detected. You can post that info here if you wish.
.
Fixxing the hosts file shouldn’t impact your computer’s performance. In fact you can run withouy it. Malware though will slow you down.
.
Hijackthis is a program which can help see what is running on your computer. You can down load it from here
http://www.download.com/HijackThis/3000-8022_4-10379544.html
it’s zip file so you need winzip to open it. A couple of tutorials can be read here http://www.bleepingcomputer.com/tutorials/tutorial42.html and http://www.tomcoyote.org/hjt/#introduction
After it runs don’t fix anything, save the log and post it here in this thread. It probably won’t fit in one post so break it down into 2 or3. Someone here will have a look.
[/quote]
I have the Hi-Jack this log.
Logfile of HijackThis v1.99.1
Scan saved at 10:29:52 AM, on 21/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\OptusNet DSL Internet\DSC.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ness\My Documents\Downloads\hijackthis\HijackThis.exe
Also, from memory I think my system just booted into windows after the boot scan. By “nothing on the screen” I meant that there was no report of anything found.
There is alot in the ‘Warnings’ section in Avast so will post that too, but I guess I should tackle one report at a time.
I really appreciate all your help with this oldman.
Heres the rest of it…
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by OptusNet
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM..\Run: [Desktop Service Centre] C:\Program Files\OptusNet DSL Internet\DSC.exe
O4 - HKLM..\Run: [SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe”
O4 - HKLM..\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime
O4 - HKLM..\Run: [Windows Defender] “C:\Program Files\Windows Defender\MSASCui.exe” -hide
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM..\Run: [nwiz] nwiz.exe /install
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [Corel Photo Downloader] “C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe” -startup
O4 - HKCU..\Run: [EPSON Stylus C61 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A “C:\WINDOWS\system32\E_S48.tmp”
O4 - HKCU..\Run: [NBJ] “C:\Program Files\Ahead\Nero BackItUp\nbj.exe”
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://dsl.optusnet.com.au/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://frangipannikat.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144044991140
O16 - DPF: {712362BF-E411-4F43-99D2-EB15F80AF1DB} (MsneDiag Class) - http://entimg.msn.com/client/msnediag3209.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax3209.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: B’s Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Blue Coat K9 Web Protection (WebFilter) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
Your log seems ok.
I’m not an expert on HijackThis… But you can check the automatic analysis of your HijackThis log here.
You can find more info in the links of the last column of this table.
That info could guide you on the cleaning process.
Anyway, if you have doubts, just post here.
Also, take a careful look at the first column of the table:
If you don’t recognize a legit program in one of the items marked as FIX IF UNKNOWN, please post it back here and maybe we can help you. Or, if you’re sure it’s a malware item, you can remove it as posted bellow.
If you agree with the automatic classification of the infected items marked as FIX (CHECK NOTES!), you can turn back to HijackThis program, check the box of this item and then remove it using the button ‘Fix checked’.
Hope it helps.
Like Tech, I’m not an expert on hijackthis logs. There are a lot of others here that are.
Which symantec products do you or did you have installed? I see some refernces to a live updater for norton internet security suite.
Very good point… you’re fully right… with Symantec products the user will have conflicts and maybe this is exactly what is preventing him to connect.
Tech, the user’s connection problem has been resolved. It was a hosts file modification. A list of av and security sites had been added. Now we’re trying to determine what may have done this and is it still present on the computer. It could have been a drive by kinda thing to.
So, he must follow your advices…
Or
Spyware Terminator
a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
I thought some of Norton was still on my machine. Have used your link and (hopefully) gotten rid of all traces. Thanks Tech. The link you gave me for analysis shows a file sharing page. This is safe isn’t it?
Oldman,I downloaded AVG Anti-Spyware and ran a thorough scan. It found entries in two rarely used accounts. This leads me to wonder whether Ad-aware and Spybot scan these two accounts (My husband has his own log in and the Guest account) Anyway will continue working through these fixes. Thank you.
After running the norton removal tool, did your preformance improve? Which line was shown as a file sharing page?
What did avg find?
Where? On K9? The links are safe.
Hi…sorry I haven’t been back to you…have been super busy.
The AVG report was
mozilla.29:C:\Documents and Settings\Tony\Application Data\Mozilla\Firefox\Profiles\76ajr282.default\cookies.txt → TrackingCookie.Adtech : No action taken.
:mozilla.30:C:\Documents and Settings\Tony\Application Data\Mozilla\Firefox\Profiles\76ajr282.default\cookies.txt → TrackingCookie.Adtech : No action taken.
:mozilla.28:C:\Documents and Settings\Tony\Application Data\Mozilla\Firefox\Profiles\76ajr282.default\cookies.txt → TrackingCookie.Atdmt : No action taken.
:mozilla.6:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Atdmt : No action taken.
:mozilla.13:C:\Documents and Settings\Tony\Application Data\Mozilla\Firefox\Profiles\76ajr282.default\cookies.txt → TrackingCookie.Doubleclick : No action taken.
:mozilla.14:C:\Documents and Settings\Tony\Application Data\Mozilla\Firefox\Profiles\76ajr282.default\cookies.txt → TrackingCookie.Imrworldwide : No action taken.
:mozilla.15:C:\Documents and Settings\Tony\Application Data\Mozilla\Firefox\Profiles\76ajr282.default\cookies.txt → TrackingCookie.Imrworldwide : No action taken.
:mozilla.15:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Realmedia : No action taken.
:mozilla.34:C:\Documents and Settings\Tony\Application Data\Mozilla\Firefox\Profiles\76ajr282.default\cookies.txt → TrackingCookie.Realtracker : No action taken.
:mozilla.16:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Trafficmp : No action taken.
:mozilla.17:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Trafficmp : No action taken.
:mozilla.18:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Trafficmp : No action taken.
:mozilla.19:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Trafficmp : No action taken.
:mozilla.20:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Trafficmp : No action taken.
:mozilla.21:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Trafficmp : No action taken.
:mozilla.22:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Trafficmp : No action taken.
:mozilla.23:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Trafficmp : No action taken.
:mozilla.24:C:\Documents and Settings\Guest\Application Data\Mozilla\Firefox\Profiles\6xhi6lob.default\cookies.txt → TrackingCookie.Trafficmp : No action taken.
C:\Documents and Settings\Ness\Cookies\ness@m.webtrends[2].txt → TrackingCookie.Webtrends : No action taken.
I did “kill” them even though it says no action taken. My computer seems to be responding better. (Not as slow to load programs)
Super Anti Spyware found some too.
Adware.Tracking Cookie
C:\Documents and Settings\Katie\Cookies\katie@acvs.mediaonenetwork[1].txt
C:\Documents and Settings\Katie\Cookies\katie@ad.joetec[2].txt
C:\Documents and Settings\Katie\Cookies\katie@azjmp[2].txt
C:\Documents and Settings\Katie\Cookies\katie@media.sensis.com[1].txt
C:\Documents and Settings\Katie\Cookies\katie@media.soundbuzz[1].txt
C:\Documents and Settings\Katie\Cookies\katie@mediaonenetwork[1].txt
C:\Documents and Settings\Katie\Cookies\katie@mediaservices.myspace[1].txt
C:\Documents and Settings\Katie\Cookies\katie@www.3dstats[2].txt
Ness
Which line was shown as a file sharing page?
I'm not an expert on HijackThis... But you can check the automatic analysis of your HijackThis log here.Tech...I understand what you wanted me to do now, was worried about downloading something that already had my name on it! Anyway am currently printing 11 pages of the analysis and will try to look at it when I get home from work. There is quite a few "Fix if Unknown"s and one "Fix.Check Notes" Entry.
FIX (CHECK NOTES!) O11 - Options group: [INTERNATIONAL] Internationa l* Currently only the ‘CommonName’ hijacker uses this. Extra group in IE ‘Advanced Options’ window Google
I have no idea what this means!
Ness