Hijacked by "File Recovery" malware sales program

[an8el]

Can some wonderful person help me with a hijack malware problem on a win7 system acer? I've successfully been helped a couple of times before on this site and have had a good experience both times.

Not sure if it was related, but my first symptom this time could have been my second USB port didn't want to work when I tried to plug in my printer. Plugging it into another port did work. Not sure if that was related, but just after my printer was recognized, I had gone back to my browser to get the thing I wanted to print. Soon after poking around, the Firefox browser closed itself spontaneously; since I knew that's a symptom of an attack, I turned of the wireless access ASAP, but it was too late.

Suddenly appearing were error messages.  In this case, you'll see pictured "critical error," but there were many variations such as: "serious disk error writing to drive c:\" and "hard drive controller failure" etc. I knew these error messages were bogus, because I've had those things happen. So I began to poke around to find out what had really happened.

When I clicked on these notifications, this program that I didn't install was opened - called "File Recovery." After a bit of investigation, I found that it was connected to https://file-recovery-software.com/support-center/customer  - It opened automatically when I clicked on any one of these error messages, which was suspicious.

Then I noticed that my desktop icons and start menu short cuts had been disappeared to show me how important it was to order a fix from this service. Handily, this "File Recovery" program started an auto-scan to inform me about such things as...well, here's the screen shot.




Of course, to 'activate' the program it costs money - gosh, was I soooo lucky that my computer still worked well enough so that I could get to the website of the handy "File Recovery" program to make my order, eh? Of course, what they got from me was a question about why shouldn't I report them to their ISP, etc. for their sleazy sales "encouragements"

A quick check revealed that all my programs were still installed and all my files were still there. Knowing how to find the .exe program directly without relying on a shortcut, I ran a quick scan on Malwarebytes and the scan found that a couple of registry items were infected. Malwarebytes asked me to restart, which I did after getting some of this information.

Deleting these infected files did not solve the problem, because they were just the tip of an iceburg. The restart didn't make the "file recovery" program go away; it had now become pinned to my desktop. The restart also wiped out the rest of the desktop icons and start menu shortcuts, but allowed the screenshot software to work again so I could show you the above pic.

I realizeed that I hadn't updated Malwarebytes in a couple of days, so I did that and began a full scan with it and also a full scan on Avira Anti-Vir was scheduled anyway. These scans are now going really slowly - could those results be useful?

That was when I realized I was going to need more help.

HELP!

Here's the report of the quick scan on Malwarebytes that I did before the restart:
Malwarebytes' Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version:

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

7/13/2012 11:08:47 PM
mbam-log-2012-07-13 (23-08-47).txt

Scan type: Quick scan
Objects scanned: 262294
Time elapsed: 11 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[an8el]

Just another update - the Malwarebytes full scan has finished, with the same results as the quick scan. The PUM_hijack_start files that Malwarebytes attempted to delete from the registry are still there. Avira has been scanning for the last three hours and is only a third of the way through the process, so I'll have to go for many more hours before that scan is finished. But I doubt if anything will be revealed differently than Malwarebytes.
 
Also, it now appears as if *all* files are gone. The feature that opens file manager can only be opened if I plug in a flash drive, where it appears as if there are "no files" to run anything - even including Google Chrome (which works fine) and Open Office, (also working fine.) They are the only two programs that are still on the start menu. However, if I go into Open Office, (for instance) and ask that program's recent document feature to open a file, it has no problem doing so - it can even save that file, etc. Also if I look at the hard drive space available, it says the same proportionate size is free and occupied with files that I have always had available. So in fact my files are there, it's just that the infection is making it appear as if my files are "gone" when I look for them in the file manager. I'm guessing that it's the file manager that has been altered to appear as if all my files are gone - which is strange, because when I check back a second time, the files are there again. Fortunately, most of my own files are backed up, (except the work of the last month or so, which would be nice to have, because I write every day.) Everything is obviously not "gone" as it appears to be.



 

[johnie]

Post delete. You are not authorized to post instructions in this forum. If you need help, please start your own thread.

[an8el]

Yeah, these problems hit more than one target.
Of course, law of Murphy, I was late on doing my routine backup when the problem happened. To get my files off, I'm using an Ubuntu Linux load-from-CD disk and copying those possibly infected files onto a USB enclosed external HD. (They're mostly image files & Open Office writings, with a few videos I'd like to keep.) I imagine that I can just not plug that external HD into my other working laptop until the problems are solved on the Acer. Later I can run those suspect backups through the appropriate online scanners before I begin working with those possibly tainted files, so I don't reinfect the Acer once it's fixed.

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Hi an8el. I remember your picture.
If you ever experience USB ports not working usually a complete disconnecting of your computer from the electric plug fixes them.

• Please download Unhide by Grinler from here and save it to your desktop.
  
• Double click unhide.exe to run the tool.
  
• It will take some time to go through all your files, so please be patient.
• If this tool doesn´t fix the problem, please let me know.

***************************************************
SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.
*************************************************
Download Combofix from any of the links below, and save it to your DESKTOP. 

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with  ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

Click I Agree to start the program.

ComboFix will then extract the necessary files and you will see this:



As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to  have this pre-installed on your machine before doing any malware  removal. This will not occur in Windows Vista and 7

It will allow you to boot up into a special recovery/repair  mode that will allow us to more easily help you should your computer  have a problem after an attempted removal of malware.

If you did not have it installed, you will see the prompt below. Choose YES.



Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.

[Geraldo]

My wife's laptop got hit by this and the tools I used to successfully remove these sorts of things in the past did not work.  I'm currently following SuperDave's instructions.  I will report back later.

[SuperDave]

My wife's laptop got hit by this and the tools I used to successfully remove these sorts of things in the past did not work.  I'm currently following SuperDave's instructions.  I will report back later.

These instructions were meant for the original poster only. Using them on your computer could cause a lot more problems. Please start a thread of your own and you'll get the help that you require.

[an8el]

Ok, thanks Dave for taking on my thorny problem. Yes, the USB plug began to work again after I restarted - thanks for that tip. I'm not sure if I mentioned that I have a 64-bit system, if that makes a difference in your recommendations.

OK, I've done the unhide scan - had to do it twice because I forgot to disable the antiVir - but on the second time, everything came back. Then when I restarted as the unhide instructed, the file system stayed visible, (yay!) but only the start menu items disappeared again.

Then my Avira AntiVir (which loads as a priority on restart) is giving me notifications of two different viruses. One is: TR\Tibs.IT.195 being found in file C:\ProgramData\GBJivEIBJO.exe and the other is a TR\FakeSysdef.A.1052 was found in file C:\ProgramData\UnjfigFaN8Quv8.exe So when I hit the button that said "details" it started a scan that couldn't be cancelled. So I hit the button that selected "make a restore point". Then then second duplicate scan completed and it said I still had both viruses. Then I discovered that I could just close the notification without doing anything.

But the fan of notifications (that you saw on the original screen shot) disappeared from the desktop without me closing them. Now different icons are gone from the desktop again, so I'm just going to re-download SuperAntiSpyware to install it and run as directed...with a different name; which I know is already on the desktop, but I can't see it now.

I guess I should just leave Avira checked offline for now - or should I tell it to quarantine what it finds? Since I already have problems anyway, it doesn't make any difference whether it's protecting me if I'm online or not. It seems to be getting in the way and trying to do it's own thing.

[SuperDave]

I guess I should just leave Avira checked offline for now - or should I tell it to quarantine what it finds? Since I already have problems anyway, it doesn't make any difference whether it's protecting me if I'm online or not. It seems to be getting in the way and trying to do it's own thing.

Let it quarantine what it finds. If you can't run SAS, please try running ComboFix and post the log.

[an8el]

I apologize to not be able to devote more time to this project except being able to work on it a few hours at night.
Since last night, I hibernated the computer. Somehow without restarting this allowed Avira Anti-Vir to do it's thing - because the objectionable "file recovery" program wasn't opened on the desktop after hibernation.

So, I managed to run SuperAnti Spyware. Fortunately, the icon was there after the restart. I'll bet if we wanted to redo the unhide program again, the files would stay unhidden - but that can be done at any time later. It's nice to know they're all still there.

When I got to the part in SAS where it recommended that I check everything, one "Potentially unwanted Programs/Settings" would not allow itself to be checked. SAS even prompted me to remember to check it, which I tried multi-times to do.

We can guess why that happened. ;o)

The scan found three other files besides cookies & the "objectionable program", which I notice is at the end of the 700+ cookie collection.

Not sure if I can stay awake to run ComboFix, so I'll do that after I wake up because I don't have to leave to go anywhere until noon - because it's 3am where I am now.

Here's the SAS log...

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/18/2012 at 02:40 AM

Application Version : 5.5.1012

Core Rules Database Version : 8917
Trace Rules Database Version: 6729

Scan type       : Complete Scan
Total Scan Time : 02:37:18

Operating System Information
Windows 7 Home Premium 64-bit, Service

Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 562
Memory threats detected   : 0
Registry items scanned    : 65176
Registry threats detected : 0
File items scanned        : 248522
File threats detected     : 728

Adware.Tracking Cookie
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\P76M6198.txt [

/ads.pubmatic.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\HGQO1YTN.txt [

/ad.wsod.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\JSDE1KAD.txt [

/accounts.google.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\GGYEE1J5.txt [

/ad.yieldmanager.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\YBGDF5HB.txt [

/interclick.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\W339PV13.txt [

/andomedia.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\KI6FRSWC.txt [

/yieldmanager.net ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\2WTEUXD2.txt [

/accounts.youtube.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\PKDZK9B0.txt [

/adinterax.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\L5M38PVI.txt [

/amazon-adsystem.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\45HQC9FB.txt [

/a1.interclick.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\IV9Z2PIQ.txt [

/invitemedia.com ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies

\ZIUL6JKU.txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@casalemedia[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@yieldmanager[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@adxpose[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/html ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/

]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@doubleclick[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][3].txt [

Cookie:[email protected]/

ak/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@pointroll[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@apmebf[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@zedo[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@atwola[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@insightexpressai[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@trafficmp[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@mediaplex[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@advertising[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/adlytics ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@revsci[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/prod/i

g/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@adsonar[2].txt [

Cookie:[email protected]/adserving ]
   C:\USERS\CERTAINLY\Cookies

\ZIUL6JKU.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\JQZ1XXDJ.txt [

Cookie:[email protected]/adserving ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\S2A4MP6L.txt [

Cookie:[email protected]/

]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\DWZLL16T.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\N98WK8H4.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\YMQJ59RN.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\60VEC08V.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\BW3RXV3W.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\0DA40GHN.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\VR3BZ0ZJ.txt [

Cookie:[email protected]/adserving ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\PZU10EA7.txt [ Cookie:[email protected]/

]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\CV6LWLWA.txt [

Cookie:[email protected]/account

s ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\GGANSKG7.txt [ Cookie:franis@legolas-

media.com/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\WFWINRTX.txt [ Cookie:[email protected]/

]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\BUPLR51T.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\7SJ9455C.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\WMSU1W7K.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\PPFI686W.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\TBVOZE5R.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\CUZPHXKH.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\KZHC4YRD.txt [

Cookie:[email protected]/hc/19452074 ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\D59GGRF4.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\GGYEE1J5.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\YBGDF5HB.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\JQZ1XXDJ.txt [

Cookie:[email protected]/adserving ]
   C:\USERS\FRANIS\Cookies

\KI6FRSWC.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\2WTEUXD2.txt [

Cookie:[email protected]/account

s ]
   C:\USERS\FRANIS\Cookies

\L5M38PVI.txt [ Cookie:franis@amazon-

adsystem.com/ ]
   C:\USERS\FRANIS\Cookies

\45HQC9FB.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\IV9Z2PIQ.txt [

Cookie:[email protected]/ ]
   cdn4.specificclick.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MACROMEDIA

\FLASH PLAYER\#SHAREDOBJECTS\QAZ76C5Z ]
   convoad.technoratimedia.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING

\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS

\QAZ76C5Z ]
   core.insightexpressai.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING

\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS

\QAZ76C5Z ]
   media.mtvnservices.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MACROMEDIA

\FLASH PLAYER\#SHAREDOBJECTS\QAZ76C5Z ]
   media.muchosmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MACROMEDIA

\FLASH PLAYER\#SHAREDOBJECTS\QAZ76C5Z ]
   secure-us.imrworldwide.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING

\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS

\QAZ76C5Z ]
   udn.specificclick.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MACROMEDIA

\FLASH PLAYER\#SHAREDOBJECTS\QAZ76C5Z ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@ADBRITE[2].TXT [ /ADBRITE ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\[email protected][1].TXT [ /AT.ATWOLA ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@ATDMT[1].TXT [ /ATDMT ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\[email protected][2].TXT [

/CITI.BRIDGETRACK ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@FASTCLICK[1].TXT [ /FASTCLICK ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@INTERCLICK[2].TXT [ /INTERCLICK

]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@INVITEMEDIA[1].TXT [

/INVITEMEDIA ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@QUESTIONMARKET[2].TXT [

/QUESTIONMARKET ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@SERVING-SYS[1].TXT [ /SERVING-

SYS ]
   .zedo.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   ad.yieldmanager.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .adbrite.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   stat.onestat.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stat.onestat.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .imrworldwide.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .imrworldwide.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .bs.serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .overture.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .overture.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .kontera.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .adbrite.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .247realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .specificmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .revenue.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .mediaplex.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .247realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .revsci.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .interclick.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .interclick.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   api.muchosmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   api.muchosmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .trackalyzer.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .statcounter.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .gooseeducationalmedia.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   in.getclicky.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .112.2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .112.2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .yieldmanager.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stats.townnews.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stats.townnews.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stats.townnews.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stats.townnews.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   www.find-me-an-accountant.com [

C:\USERS\CERTAINLY\APPDATA\ROAMING

\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .interclick.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ldproducts.122.2o7.net [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   statse.webtrendslive.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .liveperson.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .liveperson.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   tracking.waterfrontmedia.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .invitemedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .invitemedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   click.20mogul.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .apmebf.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .steelhousemedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .steelhousemedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .liveperson.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .atdmt.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .atdmt.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .atdmt.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .trafficmp.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .trafficmp.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .trafficmp.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .bruceclay.112.2o7.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   click.20mogul.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .adknowledge.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .adknowledge.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .adknowledge.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .linksynergy.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .azjmp.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .linksynergy.walmart.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.walmart.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.walmart.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   www.qsstats.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   www.qsstats.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .paypal.112.2o7.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .stats.paypal.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .mediaplex.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .e-

2dj6wgkikmcpsep.stats.esomniture.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .interclick.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .interclick.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .edgeadx.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ads.pointroll.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .pointroll.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .adinterax.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .imrworldwide.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .imrworldwide.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .kontera.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .247realmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .247realmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .paypal.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .adbrite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .adserver.adtechus.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .realmedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .hawaiianairlines.112.2o7.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .cognitivemedia.co.uk [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .foxinteractivemedia.122.2o7.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .legolas-media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .web-stat.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .web-stat.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .web-stat.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .edge.ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .msnportal.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .yahoogroups.112.2o7.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   dc.tremormedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .overture.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .jibjab.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .apmebf.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   stat.onestat.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   stat.onestat.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .lulu.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mtvn.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .adxpose.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .usatoday1.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   static.freewebs.getclicky.com [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .cbsdigitalmedia.112.2o7.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .kantarmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .fbanners.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .fbanners.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .dbs.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .fbanners.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .fbannersusers.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mediaplex.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   

.automobileclubofsoutherncalifornia.122 .2o

7.net [ C:\USERS\FRANIS\APPDATA\LOCAL

\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
   .intermundomedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .track.freenewgifts.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .videos.mediaite.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mediaite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .mediaite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .mediaite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .adtech.de [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   in.getclicky.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .at.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .s.clickability.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .msnbc.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .eyewonder.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   ads.react2media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   ads.react2media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .media1.break.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .nextag.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .specificmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .nextag.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .getclicky.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .static.getclicky.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ehg-techtarget.hitbox.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .hitbox.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .liveperson.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .microsoftwindows.112.2o7.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .s.clickability.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .amazon-adsystem.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .c.gigcount.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .find.keywordblocks.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .care2.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .traveladvertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .c5.zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .pubads.g.doubleclick.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .googleads.g.doubleclick.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .eyewonder.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .112.2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .amazon-adsystem.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   *Blocked Russian URL* [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   statse.webtrendslive.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .overture.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ad.mlnadvertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ad.mlnadvertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .revsci.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   z.blogads.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .burstnet.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .yieldmanager.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   

pappasgroup.rotator.hadj7.adjuggler.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   

pappasgroup.rotator.hadj7.adjuggler.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   ad10.walklightmedia.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   publishers.domainadvertising.com [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .histats.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .histats.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .server.cpmstar.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mediaplex.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   stat.dealtime.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .dmtracker.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   adserving.autotrader.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .lfstmedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .liveperson.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .gostats.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .network.realmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .adinterax.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .hypertracker.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .clickbank.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .clickbank.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   counter.hitslink.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .liveperson.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .liveperson.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .tracfone.122.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   d.mediaforge.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mediaforge.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .usnews.122.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .clicktoapp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .clicktoapp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .twittercounter.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .twittercounter.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .pro-market.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .bs.serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .bs.serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .martiniadnetwork.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .martiniadnetwork.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .martiniadnetwork.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .choicemediainc.112.2o7.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .banner.featuredusers.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .banner.featuredusers.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .pubads.g.doubleclick.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .pubads.g.doubleclick.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .thecreativefinder.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ar.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .accounts.google.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .accounts.google.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .burstnet.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .stats.paypal.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .sympatico.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .c.atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .c.atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .kanoodle.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   accounts.youtube.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .adbrite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .adbrite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .realmedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   accounts.google.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .legolas-media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .legolas-media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .counterpunch.org [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .counterpunch.org [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   www.counterpunch.org [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .lucidmedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   mediaservices-

d.openxenterprise.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .specificclick.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .tacoda.at.atwola.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .tacoda.at.atwola.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .at.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .tacoda.at.atwola.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .tacoda.at.atwola.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ar.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ar.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   www4.smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   media.match.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .andomedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .andomedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .doubleclick.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .media6degrees.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   www.googleadservices.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   *Blocked Russian URL* [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .revsci.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .interclick.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .interclick.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .revsci.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .revsci.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   uk.sitestat.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIE

[SuperDave]

Ok. Try to run ComboFix whenever you can.

[an8el]

OK, tell me what happened in this scan/fix. Now all of the icons have come back to my desktop, (even if they were located on top of each other and had to be dragged onto the desktop) as well as my file tree navigation has returned. YAY!

Think I'm going to install another firewall other than the one I had, to help this not happen again.

Here's the log from ComboFix:


ComboFix 12-07-19.02 - Franis 07/19/2012  14:02:52.1.1 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.2812.1861 [GMT -10:00]
Running from: c:\users\Franis\Desktop\ComboFixAlso.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\UnjfigFaN8Quv8
c:\users\Certainly\g2mdlhlpx.exe
c:\users\Franis\g2mdlhlpx.exe
c:\windows\SysWow64\spool\prtprocs\w32x86\ppbiPr.dll
.
.
(((((((((((((((((((((((((   Files Created from 2012-06-20 to 2012-07-20  )))))))))))))))))))))))))))))))
.
.
2012-07-20 00:13 . 2012-07-20 00:13   --------   d-----w-   c:\users\Default\AppData\Local\temp
2012-07-20 00:13 . 2012-07-20 00:13   --------   d-----w-   c:\users\Certainly\AppData\Local\temp
2012-07-20 00:13 . 2012-07-20 00:13   --------   d-----w-   c:\users\Guest\AppData\Local\temp
2012-07-18 09:57 . 2012-07-18 09:57   --------   d-----w-   c:\users\Franis\AppData\Roaming\SUPERAntiSpyware.com
2012-07-18 09:57 . 2012-07-18 09:57   --------   d-----w-   c:\program files\SUPERAntiSpyware
2012-07-18 09:57 . 2012-07-18 09:57   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
2012-07-15 20:29 . 2012-07-15 20:29   --------   d---a-w-   C:\.Trash-999
2012-07-11 22:32 . 2012-07-11 22:32   --------   d-----w-   c:\program files (x86)\Malwarebitey
2012-07-11 22:32 . 2012-04-05 01:56   24904   ----a-w-   c:\windows\system32\drivers\mbam.sys
2012-07-11 16:38 . 2012-07-11 16:38   --------   d-----w-   c:\program files (x86)\Mozilla Maintenance Service
2012-07-11 16:38 . 2012-07-11 16:38   421200   ----a-w-   c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-07-11 16:38 . 2012-07-11 16:38   770384   ----a-w-   c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-07-11 16:04 . 2012-06-12 03:08   3148800   ----a-w-   c:\windows\system32\win32k.sys
2012-07-11 15:48 . 2012-06-02 12:01   173056   ----a-w-   c:\windows\system32\ieUnatt.exe
2012-07-11 14:50 . 2012-06-06 06:06   2004480   ----a-w-   c:\windows\system32\msxml6.dll
2012-07-11 14:50 . 2012-06-06 06:06   1881600   ----a-w-   c:\windows\system32\msxml3.dll
2012-07-11 14:50 . 2012-06-06 05:05   1390080   ----a-w-   c:\windows\SysWow64\msxml6.dll
2012-07-11 14:50 . 2012-06-06 05:05   1236992   ----a-w-   c:\windows\SysWow64\msxml3.dll
2012-07-11 14:50 . 2010-06-26 03:55   2048   ----a-w-   c:\windows\system32\msxml3r.dll
2012-07-11 14:50 . 2010-06-26 03:24   2048   ----a-w-   c:\windows\SysWow64\msxml3r.dll
2012-06-22 06:50 . 2012-06-02 22:19   57880   ----a-w-   c:\windows\system32\wuauclt.exe
2012-06-22 06:50 . 2012-06-02 22:19   44056   ----a-w-   c:\windows\system32\wups2.dll
2012-06-22 06:50 . 2012-06-02 22:15   2622464   ----a-w-   c:\windows\system32\wucltux.dll
2012-06-22 06:50 . 2012-06-02 22:19   2428952   ----a-w-   c:\windows\system32\wuaueng.dll
2012-06-22 06:49 . 2012-06-02 22:19   38424   ----a-w-   c:\windows\system32\wups.dll
2012-06-22 06:49 . 2012-06-02 22:19   701976   ----a-w-   c:\windows\system32\wuapi.dll
2012-06-22 06:49 . 2012-06-02 22:15   99840   ----a-w-   c:\windows\system32\wudriver.dll
2012-06-22 06:48 . 2012-06-03 01:19   186752   ----a-w-   c:\windows\system32\wuwebv.dll
2012-06-22 06:48 . 2012-06-03 01:15   36864   ----a-w-   c:\windows\system32\wuapp.exe
2012-06-20 07:04 . 2012-06-20 07:04   --------   d--h--w-   c:\users\Certainly\AppData\Roaming\Avira
2012-06-20 06:59 . 2012-06-20 06:59   --------   d--h--w-   c:\users\Certainly\AppData\Roaming\CyberLink
2012-06-20 06:59 . 2012-06-20 08:42   --------   d--h--w-   c:\users\Certainly\AppData\Local\PlayMovie
2012-06-20 06:59 . 2012-06-20 06:59   --------   d--h--w-   c:\users\Certainly\AppData\Roaming\Apple Computer
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-13 10:14 . 2012-04-04 20:32   426184   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-13 10:14 . 2011-05-31 10:12   70344   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-11 15:52 . 2009-11-21 06:43   59701280   ----a-w-   c:\windows\system32\MRT.exe
2012-05-20 06:36 . 2012-05-16 21:14   98848   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2012-05-20 06:36 . 2012-05-16 21:14   132832   ----a-w-   c:\windows\system32\drivers\avipbb.sys
2012-05-04 11:06 . 2012-06-14 09:50   5559664   ----a-w-   c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 09:50   3968368   ----a-w-   c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 09:50   3913072   ----a-w-   c:\windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40 . 2012-06-14 09:50   209920   ----a-w-   c:\windows\system32\profsvc.dll
2012-04-28 03:55 . 2012-06-14 09:50   210944   ----a-w-   c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-14 09:50   77312   ----a-w-   c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-14 09:50   149504   ----a-w-   c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-14 09:50   9216   ----a-w-   c:\windows\system32\rdrmemptylst.exe
2012-04-24 05:37 . 2012-06-14 09:49   184320   ----a-w-   c:\windows\system32\cryptsvc.dll
2012-04-24 05:37 . 2012-06-14 09:49   140288   ----a-w-   c:\windows\system32\cryptnet.dll
2012-04-24 05:37 . 2012-06-14 09:49   1462272   ----a-w-   c:\windows\system32\crypt32.dll
2012-04-24 04:36 . 2012-06-14 09:49   1158656   ----a-w-   c:\windows\SysWow64\crypt32.dll
2012-04-24 04:36 . 2012-06-14 09:49   140288   ----a-w-   c:\windows\SysWow64\cryptsvc.dll
2012-04-24 04:36 . 2012-06-14 09:49   103936   ----a-w-   c:\windows\SysWow64\cryptnet.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-06 17:18   120104   ---ha-w-   c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Jing"="c:\program files (x86)\TechSmith\Jing\Jing.exe" [2012-02-02 2918224]
"Spotify"="c:\users\Franis\AppData\Roaming\Spotify\Spotify.exe" [2012-06-14 9478320]
"Spotify Web Helper"="c:\users\Franis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-06-14 932528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-07-28 1157128]
"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-29 419112]
"Acer Assist Launcher"="c:\program files (x86)\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-27 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2010-01-19 181480]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-19 254696]
"MessengerPlusForSkypeService"="c:\program files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe" [2012-06-19 119808]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-20 348624]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888]
.
c:\users\Franis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Evernote Clipper.lnk - c:\windows\Installer\{F761359C-9CED-45AE-9A51-9D6605CD55C4}\Evernote.ico [2010-12-22 293950]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages   REG_MULTI_SZ      kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-19 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-15 135664]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 250056]
R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [2009-07-14 281088]
R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [2009-06-10 15360]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [2010-07-02 51600]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-15 135664]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [2010-05-08 30304]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2012-01-18 351136]
R3 LVUVC64;Logitech Webcam 600(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2012-01-18 4865568]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-11 113120]
R3 Normandy;Normandy SR2;

R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-20 1255736]
S0 56337232;56337232 Boot Guard Driver;c:\windows\system32\DRIVERS\56337232.sys [2009-10-22 40464]
S1 56337231;56337231;c:\windows\system32\DRIVERS\56337231.sys [2009-09-26 157712]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-09-17 27760]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-29 203264]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-20 86224]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-08-06 844320]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496]
S2 MsgPlusService;Messenger Plus! Service;c:\program files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [2012-06-19 119808]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-06 311592]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-11-13 67072]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 34872]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 10:14]
.
2012-07-20 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2010-06-07 20:01]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-15 09:40]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-15 09:40]
.
2012-07-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1109757479-377625319-1456128612-1000Core.job
- c:\users\Franis\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-24 01:45]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1109757479-377625319-1456128612-1000UA.job
- c:\users\Franis\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-24 01:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-06 17:19   137512   ---ha-w-   c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-06 828960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = https://ixquick.com/eng/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361109d545l0334z1h5t4852x232
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1 24.25.227.55 209.18.47.61 24.25.227.53
FF - ProfilePath - c:\users\Franis\AppData\Roaming\Mozilla\Firefox\Profiles\2c9a767w.default\
FF - prefs.js: browser.startup.homepage - hxxps://ixquick.com/
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
.
**************************************************************************
.
Completion time: 2012-07-19  15:10:15 - machine was rebooted
ComboFix-quarantined-files.txt  2012-07-20 01:10
.
Pre-Run: 76,384,890,880 bytes free
Post-Run: 77,677,522,944 bytes free
.
- - End Of File - - 9D5AB5335171AD13A9C37BE267343BA0

[SuperDave]

Well, ComboFix did remove some malicous items.
Did you create this folder: C:\.Trash-999

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

[an8el]

Just now when I got online, Avira did find another objectionable file: C:\OEM\Preload\Autorun\...\Installer_v6.exe  It had the choice to delete the file, (which sometimes doesn't work) or "details." When I asked for details, it began a short scan that formerly resulted in a quarrentine, but the scan did not complete.
So I guess we're not done yet.

Here's the result of the Security Check scan:

Results of screen317's Security Check version 0.99.43 
 Windows 7 Service Pack 1 x64   
 Internet Explorer 9 
``````````````Antivirus/Firewall Check:``````````````[/u]
 Windows Firewall Enabled! 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````[/u]
 Rootkit Unhooker LE 3.8 SR 2
 Malwarebytes Anti-Malware version 1.61.0.1400 
 Abexo Free Registry Cleaner 
 Java(TM) 6 Update 22 
 Java(TM) 6 Update 31 
 Java version out of Date!
 Adobe Reader 9 Adobe Reader out of Date!
 Mozilla Firefox 13.0.1 Firefox out of Date! 
 Google Chrome 20.0.1132.47 
 Google Chrome 20.0.1132.57 
````````Process Check: objlist.exe by Laurent````````[/u] 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````[/u]
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````[/u]

[an8el]

Oh and no, I didn't create the C:\.Trash-999 folder.