Hijacked by "File Recovery" malware sales program

[an8el]

Can some wonderful person help me with a hijack malware problem on a win7 system acer? I've successfully been helped a couple of times before on this site and have had a good experience both times.

Not sure if it was related, but my first symptom this time could have been my second USB port didn't want to work when I tried to plug in my printer. Plugging it into another port did work. Not sure if that was related, but just after my printer was recognized, I had gone back to my browser to get the thing I wanted to print. Soon after poking around, the Firefox browser closed itself spontaneously; since I knew that's a symptom of an attack, I turned of the wireless access ASAP, but it was too late.

Suddenly appearing were error messages.  In this case, you'll see pictured "critical error," but there were many variations such as: "serious disk error writing to drive c:\" and "hard drive controller failure" etc. I knew these error messages were bogus, because I've had those things happen. So I began to poke around to find out what had really happened.

When I clicked on these notifications, this program that I didn't install was opened - called "File Recovery." After a bit of investigation, I found that it was connected to https://file-recovery-software.com/support-center/customer  - It opened automatically when I clicked on any one of these error messages, which was suspicious.

Then I noticed that my desktop icons and start menu short cuts had been disappeared to show me how important it was to order a fix from this service. Handily, this "File Recovery" program started an auto-scan to inform me about such things as...well, here's the screen shot.




Of course, to 'activate' the program it costs money - gosh, was I soooo lucky that my computer still worked well enough so that I could get to the website of the handy "File Recovery" program to make my order, eh? Of course, what they got from me was a question about why shouldn't I report them to their ISP, etc. for their sleazy sales "encouragements"

A quick check revealed that all my programs were still installed and all my files were still there. Knowing how to find the .exe program directly without relying on a shortcut, I ran a quick scan on Malwarebytes and the scan found that a couple of registry items were infected. Malwarebytes asked me to restart, which I did after getting some of this information.

Deleting these infected files did not solve the problem, because they were just the tip of an iceburg. The restart didn't make the "file recovery" program go away; it had now become pinned to my desktop. The restart also wiped out the rest of the desktop icons and start menu shortcuts, but allowed the screenshot software to work again so I could show you the above pic.

I realizeed that I hadn't updated Malwarebytes in a couple of days, so I did that and began a full scan with it and also a full scan on Avira Anti-Vir was scheduled anyway. These scans are now going really slowly - could those results be useful?

That was when I realized I was going to need more help.

HELP!

Here's the report of the quick scan on Malwarebytes that I did before the restart:
Malwarebytes' Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version:

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

7/13/2012 11:08:47 PM
mbam-log-2012-07-13 (23-08-47).txt

Scan type: Quick scan
Objects scanned: 262294
Time elapsed: 11 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[an8el]

Just another update - the Malwarebytes full scan has finished, with the same results as the quick scan. The PUM_hijack_start files that Malwarebytes attempted to delete from the registry are still there. Avira has been scanning for the last three hours and is only a third of the way through the process, so I'll have to go for many more hours before that scan is finished. But I doubt if anything will be revealed differently than Malwarebytes.
 
Also, it now appears as if *all* files are gone. The feature that opens file manager can only be opened if I plug in a flash drive, where it appears as if there are "no files" to run anything - even including Google Chrome (which works fine) and Open Office, (also working fine.) They are the only two programs that are still on the start menu. However, if I go into Open Office, (for instance) and ask that program's recent document feature to open a file, it has no problem doing so - it can even save that file, etc. Also if I look at the hard drive space available, it says the same proportionate size is free and occupied with files that I have always had available. So in fact my files are there, it's just that the infection is making it appear as if my files are "gone" when I look for them in the file manager. I'm guessing that it's the file manager that has been altered to appear as if all my files are gone - which is strange, because when I check back a second time, the files are there again. Fortunately, most of my own files are backed up, (except the work of the last month or so, which would be nice to have, because I write every day.) Everything is obviously not "gone" as it appears to be.



 

[johnie]

Post delete. You are not authorized to post instructions in this forum. If you need help, please start your own thread.

[an8el]

Yeah, these problems hit more than one target.
Of course, law of Murphy, I was late on doing my routine backup when the problem happened. To get my files off, I'm using an Ubuntu Linux load-from-CD disk and copying those possibly infected files onto a USB enclosed external HD. (They're mostly image files & Open Office writings, with a few videos I'd like to keep.) I imagine that I can just not plug that external HD into my other working laptop until the problems are solved on the Acer. Later I can run those suspect backups through the appropriate online scanners before I begin working with those possibly tainted files, so I don't reinfect the Acer once it's fixed.

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Hi an8el. I remember your picture.
If you ever experience USB ports not working usually a complete disconnecting of your computer from the electric plug fixes them.

• Please download Unhide by Grinler from here and save it to your desktop.
  
• Double click unhide.exe to run the tool.
  
• It will take some time to go through all your files, so please be patient.
• If this tool doesn´t fix the problem, please let me know.

***************************************************
SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.
*************************************************
Download Combofix from any of the links below, and save it to your DESKTOP. 

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with  ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

Click I Agree to start the program.

ComboFix will then extract the necessary files and you will see this:



As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to  have this pre-installed on your machine before doing any malware  removal. This will not occur in Windows Vista and 7

It will allow you to boot up into a special recovery/repair  mode that will allow us to more easily help you should your computer  have a problem after an attempted removal of malware.

If you did not have it installed, you will see the prompt below. Choose YES.



Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.

[Geraldo]

My wife's laptop got hit by this and the tools I used to successfully remove these sorts of things in the past did not work.  I'm currently following SuperDave's instructions.  I will report back later.

[SuperDave]

My wife's laptop got hit by this and the tools I used to successfully remove these sorts of things in the past did not work.  I'm currently following SuperDave's instructions.  I will report back later.

These instructions were meant for the original poster only. Using them on your computer could cause a lot more problems. Please start a thread of your own and you'll get the help that you require.

[an8el]

Ok, thanks Dave for taking on my thorny problem. Yes, the USB plug began to work again after I restarted - thanks for that tip. I'm not sure if I mentioned that I have a 64-bit system, if that makes a difference in your recommendations.

OK, I've done the unhide scan - had to do it twice because I forgot to disable the antiVir - but on the second time, everything came back. Then when I restarted as the unhide instructed, the file system stayed visible, (yay!) but only the start menu items disappeared again.

Then my Avira AntiVir (which loads as a priority on restart) is giving me notifications of two different viruses. One is: TR\Tibs.IT.195 being found in file C:\ProgramData\GBJivEIBJO.exe and the other is a TR\FakeSysdef.A.1052 was found in file C:\ProgramData\UnjfigFaN8Quv8.exe So when I hit the button that said "details" it started a scan that couldn't be cancelled. So I hit the button that selected "make a restore point". Then then second duplicate scan completed and it said I still had both viruses. Then I discovered that I could just close the notification without doing anything.

But the fan of notifications (that you saw on the original screen shot) disappeared from the desktop without me closing them. Now different icons are gone from the desktop again, so I'm just going to re-download SuperAntiSpyware to install it and run as directed...with a different name; which I know is already on the desktop, but I can't see it now.

I guess I should just leave Avira checked offline for now - or should I tell it to quarantine what it finds? Since I already have problems anyway, it doesn't make any difference whether it's protecting me if I'm online or not. It seems to be getting in the way and trying to do it's own thing.

[SuperDave]

I guess I should just leave Avira checked offline for now - or should I tell it to quarantine what it finds? Since I already have problems anyway, it doesn't make any difference whether it's protecting me if I'm online or not. It seems to be getting in the way and trying to do it's own thing.

Let it quarantine what it finds. If you can't run SAS, please try running ComboFix and post the log.

[an8el]

I apologize to not be able to devote more time to this project except being able to work on it a few hours at night.
Since last night, I hibernated the computer. Somehow without restarting this allowed Avira Anti-Vir to do it's thing - because the objectionable "file recovery" program wasn't opened on the desktop after hibernation.

So, I managed to run SuperAnti Spyware. Fortunately, the icon was there after the restart. I'll bet if we wanted to redo the unhide program again, the files would stay unhidden - but that can be done at any time later. It's nice to know they're all still there.

When I got to the part in SAS where it recommended that I check everything, one "Potentially unwanted Programs/Settings" would not allow itself to be checked. SAS even prompted me to remember to check it, which I tried multi-times to do.

We can guess why that happened. ;o)

The scan found three other files besides cookies & the "objectionable program", which I notice is at the end of the 700+ cookie collection.

Not sure if I can stay awake to run ComboFix, so I'll do that after I wake up because I don't have to leave to go anywhere until noon - because it's 3am where I am now.

Here's the SAS log...

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/18/2012 at 02:40 AM

Application Version : 5.5.1012

Core Rules Database Version : 8917
Trace Rules Database Version: 6729

Scan type       : Complete Scan
Total Scan Time : 02:37:18

Operating System Information
Windows 7 Home Premium 64-bit, Service

Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 562
Memory threats detected   : 0
Registry items scanned    : 65176
Registry threats detected : 0
File items scanned        : 248522
File threats detected     : 728

Adware.Tracking Cookie
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\P76M6198.txt [

/ads.pubmatic.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\HGQO1YTN.txt [

/ad.wsod.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\JSDE1KAD.txt [

/accounts.google.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\GGYEE1J5.txt [

/ad.yieldmanager.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\YBGDF5HB.txt [

/interclick.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\W339PV13.txt [

/andomedia.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\KI6FRSWC.txt [

/yieldmanager.net ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\2WTEUXD2.txt [

/accounts.youtube.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\PKDZK9B0.txt [

/adinterax.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\L5M38PVI.txt [

/amazon-adsystem.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\45HQC9FB.txt [

/a1.interclick.com ]
   C:\Users\Franis\AppData\Roaming

\Microsoft\Windows\Cookies\IV9Z2PIQ.txt [

/invitemedia.com ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies

\ZIUL6JKU.txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@casalemedia[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@yieldmanager[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@adxpose[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/html ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/

]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@doubleclick[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][3].txt [

Cookie:[email protected]/

ak/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@pointroll[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@apmebf[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@zedo[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@atwola[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@insightexpressai[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@trafficmp[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@mediaplex[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@advertising[2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/adlytics ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@revsci[1].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/prod/i

g/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/ ]
   C:\USERS\CERTAINLY\AppData

\Roaming\Microsoft\Windows\Cookies\Low

\certainly@adsonar[2].txt [

Cookie:[email protected]/adserving ]
   C:\USERS\CERTAINLY\Cookies

\ZIUL6JKU.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\JQZ1XXDJ.txt [

Cookie:[email protected]/adserving ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\S2A4MP6L.txt [

Cookie:[email protected]/

]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\DWZLL16T.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\N98WK8H4.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\YMQJ59RN.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\60VEC08V.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\BW3RXV3W.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\0DA40GHN.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\VR3BZ0ZJ.txt [

Cookie:[email protected]/adserving ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\PZU10EA7.txt [ Cookie:[email protected]/

]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\CV6LWLWA.txt [

Cookie:[email protected]/account

s ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\GGANSKG7.txt [ Cookie:franis@legolas-

media.com/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\WFWINRTX.txt [ Cookie:[email protected]/

]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\BUPLR51T.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\7SJ9455C.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\WMSU1W7K.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\[email protected][1].txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\PPFI686W.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\[email protected][2].txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\TBVOZE5R.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\CUZPHXKH.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\KZHC4YRD.txt [

Cookie:[email protected]/hc/19452074 ]
   C:\USERS\FRANIS\AppData\Roaming

\Microsoft\Windows\Cookies\Low

\D59GGRF4.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\GGYEE1J5.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\YBGDF5HB.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\JQZ1XXDJ.txt [

Cookie:[email protected]/adserving ]
   C:\USERS\FRANIS\Cookies

\KI6FRSWC.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\2WTEUXD2.txt [

Cookie:[email protected]/account

s ]
   C:\USERS\FRANIS\Cookies

\L5M38PVI.txt [ Cookie:franis@amazon-

adsystem.com/ ]
   C:\USERS\FRANIS\Cookies

\45HQC9FB.txt [

Cookie:[email protected]/ ]
   C:\USERS\FRANIS\Cookies

\IV9Z2PIQ.txt [

Cookie:[email protected]/ ]
   cdn4.specificclick.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MACROMEDIA

\FLASH PLAYER\#SHAREDOBJECTS\QAZ76C5Z ]
   convoad.technoratimedia.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING

\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS

\QAZ76C5Z ]
   core.insightexpressai.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING

\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS

\QAZ76C5Z ]
   media.mtvnservices.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MACROMEDIA

\FLASH PLAYER\#SHAREDOBJECTS\QAZ76C5Z ]
   media.muchosmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MACROMEDIA

\FLASH PLAYER\#SHAREDOBJECTS\QAZ76C5Z ]
   secure-us.imrworldwide.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING

\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS

\QAZ76C5Z ]
   udn.specificclick.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MACROMEDIA

\FLASH PLAYER\#SHAREDOBJECTS\QAZ76C5Z ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@ADBRITE[2].TXT [ /ADBRITE ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\[email protected][1].TXT [ /AT.ATWOLA ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@ATDMT[1].TXT [ /ATDMT ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\[email protected][2].TXT [

/CITI.BRIDGETRACK ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@FASTCLICK[1].TXT [ /FASTCLICK ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@INTERCLICK[2].TXT [ /INTERCLICK

]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@INVITEMEDIA[1].TXT [

/INVITEMEDIA ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@QUESTIONMARKET[2].TXT [

/QUESTIONMARKET ]
   C:\USERS\CERTAINLY\APPDATA

\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW

\CERTAINLY@SERVING-SYS[1].TXT [ /SERVING-

SYS ]
   .zedo.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   ad.yieldmanager.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .adbrite.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   stat.onestat.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stat.onestat.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .imrworldwide.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .imrworldwide.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .bs.serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .serving-sys.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .overture.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .overture.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .kontera.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .adbrite.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .247realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .specificmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .revenue.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ads.pointroll.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .mediaplex.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .247realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .realmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .advertising.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .revsci.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .interclick.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .interclick.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   api.muchosmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   api.muchosmedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .trackalyzer.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .statcounter.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .gooseeducationalmedia.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   in.getclicky.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .112.2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .112.2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .yieldmanager.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stats.townnews.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stats.townnews.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stats.townnews.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   stats.townnews.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   www.find-me-an-accountant.com [

C:\USERS\CERTAINLY\APPDATA\ROAMING

\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .interclick.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .ldproducts.122.2o7.net [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   statse.webtrendslive.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .liveperson.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .liveperson.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   tracking.waterfrontmedia.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .invitemedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .invitemedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   click.20mogul.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .apmebf.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .steelhousemedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .steelhousemedia.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .liveperson.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .atdmt.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .atdmt.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .atdmt.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .trafficmp.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .trafficmp.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .trafficmp.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .bruceclay.112.2o7.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   click.20mogul.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .adknowledge.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .adknowledge.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .adknowledge.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .2o7.net [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .linksynergy.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .azjmp.com [ C:\USERS\CERTAINLY

\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES

\QGL4J35N.DEFAULT\COOKIES.SQLITE ]
   .linksynergy.walmart.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.walmart.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .linksynergy.walmart.com [ C:

\USERS\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   www.qsstats.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   www.qsstats.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .paypal.112.2o7.net [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .stats.paypal.com [ C:\USERS

\CERTAINLY\APPDATA\ROAMING\MOZILLA

\FIREFOX\PROFILES\QGL4J35N.DEFAULT

\COOKIES.SQLITE ]
   .mediaplex.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .e-

2dj6wgkikmcpsep.stats.esomniture.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .interclick.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .interclick.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .edgeadx.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ads.pointroll.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .pointroll.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .adinterax.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .imrworldwide.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .imrworldwide.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .kontera.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .247realmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .247realmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .paypal.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .adbrite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .adserver.adtechus.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .realmedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .hawaiianairlines.112.2o7.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .cognitivemedia.co.uk [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .foxinteractivemedia.122.2o7.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .legolas-media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .web-stat.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .web-stat.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .web-stat.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .edge.ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .msnportal.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .yahoogroups.112.2o7.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   dc.tremormedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .overture.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .jibjab.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .apmebf.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   stat.onestat.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   stat.onestat.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .lulu.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mtvn.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .adxpose.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .usatoday1.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   static.freewebs.getclicky.com [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .cbsdigitalmedia.112.2o7.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .kantarmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .fbanners.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .fbanners.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .dbs.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .fbanners.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .fbannersusers.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mediaplex.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   

.automobileclubofsoutherncalifornia.122 .2o

7.net [ C:\USERS\FRANIS\APPDATA\LOCAL

\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
   .intermundomedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .track.freenewgifts.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .videos.mediaite.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mediaite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .mediaite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .mediaite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .adtech.de [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   in.getclicky.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .at.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .s.clickability.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .msnbc.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .eyewonder.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   ads.react2media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   ads.react2media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .media1.break.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .nextag.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .specificmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .nextag.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .staradvertiser.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .getclicky.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .static.getclicky.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ehg-techtarget.hitbox.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .hitbox.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .liveperson.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .microsoftwindows.112.2o7.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .s.clickability.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .amazon-adsystem.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .c.gigcount.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .find.keywordblocks.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .care2.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .traveladvertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .c5.zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .pubads.g.doubleclick.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .googleads.g.doubleclick.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .eyewonder.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .112.2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .amazon-adsystem.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   *Blocked Russian URL* [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   statse.webtrendslive.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .overture.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ad.mlnadvertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ad.mlnadvertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .revsci.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   z.blogads.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .burstnet.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .yieldmanager.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   

pappasgroup.rotator.hadj7.adjuggler.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   

pappasgroup.rotator.hadj7.adjuggler.net [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   ad10.walklightmedia.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   publishers.domainadvertising.com [

C:\USERS\FRANIS\APPDATA\LOCAL\GOOGLE

\CHROME\USER DATA\DEFAULT\COOKIES ]
   .histats.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .histats.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .server.cpmstar.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mediaplex.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   stat.dealtime.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .dmtracker.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   adserving.autotrader.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .trafficmp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .lfstmedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .liveperson.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .gostats.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .network.realmedia.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .adinterax.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .hypertracker.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .clickbank.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .clickbank.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   counter.hitslink.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .liveperson.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .liveperson.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .tracfone.122.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   d.mediaforge.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .mediaforge.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .usnews.122.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .clicktoapp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .clicktoapp.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .twittercounter.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .twittercounter.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .pro-market.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .bs.serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .bs.serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .martiniadnetwork.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .martiniadnetwork.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .martiniadnetwork.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .choicemediainc.112.2o7.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .banner.featuredusers.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .banner.featuredusers.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ru4.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .pubads.g.doubleclick.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .pubads.g.doubleclick.net [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   .thecreativefinder.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .ar.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .accounts.google.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .accounts.google.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .burstnet.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .2o7.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .stats.paypal.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .sympatico.112.2o7.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .c.atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .c.atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .kanoodle.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   accounts.youtube.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .adbrite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .adbrite.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .realmedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   accounts.google.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .legolas-media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .legolas-media.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .counterpunch.org [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .counterpunch.org [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   www.counterpunch.org [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .lucidmedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   mediaservices-

d.openxenterprise.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .specificclick.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .tacoda.at.atwola.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .tacoda.at.atwola.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .at.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .tacoda.at.atwola.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .tacoda.at.atwola.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ar.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .ar.atwola.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .advertising.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   www4.smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .smartadserver.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .insightexpressai.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   media.match.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .andomedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .andomedia.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   ad.yieldmanager.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .doubleclick.net [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .zedo.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .media6degrees.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   www.googleadservices.com [ C:

\USERS\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME

\USER DATA\DEFAULT\COOKIES ]
   *Blocked Russian URL* [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .serving-sys.com [ C:\USERS

\FRANIS\APPDATA\LOCAL\GOOGLE\CHROME\USER

DATA\DEFAULT\COOKIES ]
   .revsci.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .interclick.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .interclick.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .atdmt.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .revsci.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   .revsci.net [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIES ]
   uk.sitestat.com [ C:\USERS\FRANIS

\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA

\DEFAULT\COOKIE

[SuperDave]

Ok. Try to run ComboFix whenever you can.

[an8el]

OK, tell me what happened in this scan/fix. Now all of the icons have come back to my desktop, (even if they were located on top of each other and had to be dragged onto the desktop) as well as my file tree navigation has returned. YAY!

Think I'm going to install another firewall other than the one I had, to help this not happen again.

Here's the log from ComboFix:


ComboFix 12-07-19.02 - Franis 07/19/2012  14:02:52.1.1 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.2812.1861 [GMT -10:00]
Running from: c:\users\Franis\Desktop\ComboFixAlso.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\UnjfigFaN8Quv8
c:\users\Certainly\g2mdlhlpx.exe
c:\users\Franis\g2mdlhlpx.exe
c:\windows\SysWow64\spool\prtprocs\w32x86\ppbiPr.dll
.
.
(((((((((((((((((((((((((   Files Created from 2012-06-20 to 2012-07-20  )))))))))))))))))))))))))))))))
.
.
2012-07-20 00:13 . 2012-07-20 00:13   --------   d-----w-   c:\users\Default\AppData\Local\temp
2012-07-20 00:13 . 2012-07-20 00:13   --------   d-----w-   c:\users\Certainly\AppData\Local\temp
2012-07-20 00:13 . 2012-07-20 00:13   --------   d-----w-   c:\users\Guest\AppData\Local\temp
2012-07-18 09:57 . 2012-07-18 09:57   --------   d-----w-   c:\users\Franis\AppData\Roaming\SUPERAntiSpyware.com
2012-07-18 09:57 . 2012-07-18 09:57   --------   d-----w-   c:\program files\SUPERAntiSpyware
2012-07-18 09:57 . 2012-07-18 09:57   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
2012-07-15 20:29 . 2012-07-15 20:29   --------   d---a-w-   C:\.Trash-999
2012-07-11 22:32 . 2012-07-11 22:32   --------   d-----w-   c:\program files (x86)\Malwarebitey
2012-07-11 22:32 . 2012-04-05 01:56   24904   ----a-w-   c:\windows\system32\drivers\mbam.sys
2012-07-11 16:38 . 2012-07-11 16:38   --------   d-----w-   c:\program files (x86)\Mozilla Maintenance Service
2012-07-11 16:38 . 2012-07-11 16:38   421200   ----a-w-   c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-07-11 16:38 . 2012-07-11 16:38   770384   ----a-w-   c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-07-11 16:04 . 2012-06-12 03:08   3148800   ----a-w-   c:\windows\system32\win32k.sys
2012-07-11 15:48 . 2012-06-02 12:01   173056   ----a-w-   c:\windows\system32\ieUnatt.exe
2012-07-11 14:50 . 2012-06-06 06:06   2004480   ----a-w-   c:\windows\system32\msxml6.dll
2012-07-11 14:50 . 2012-06-06 06:06   1881600   ----a-w-   c:\windows\system32\msxml3.dll
2012-07-11 14:50 . 2012-06-06 05:05   1390080   ----a-w-   c:\windows\SysWow64\msxml6.dll
2012-07-11 14:50 . 2012-06-06 05:05   1236992   ----a-w-   c:\windows\SysWow64\msxml3.dll
2012-07-11 14:50 . 2010-06-26 03:55   2048   ----a-w-   c:\windows\system32\msxml3r.dll
2012-07-11 14:50 . 2010-06-26 03:24   2048   ----a-w-   c:\windows\SysWow64\msxml3r.dll
2012-06-22 06:50 . 2012-06-02 22:19   57880   ----a-w-   c:\windows\system32\wuauclt.exe
2012-06-22 06:50 . 2012-06-02 22:19   44056   ----a-w-   c:\windows\system32\wups2.dll
2012-06-22 06:50 . 2012-06-02 22:15   2622464   ----a-w-   c:\windows\system32\wucltux.dll
2012-06-22 06:50 . 2012-06-02 22:19   2428952   ----a-w-   c:\windows\system32\wuaueng.dll
2012-06-22 06:49 . 2012-06-02 22:19   38424   ----a-w-   c:\windows\system32\wups.dll
2012-06-22 06:49 . 2012-06-02 22:19   701976   ----a-w-   c:\windows\system32\wuapi.dll
2012-06-22 06:49 . 2012-06-02 22:15   99840   ----a-w-   c:\windows\system32\wudriver.dll
2012-06-22 06:48 . 2012-06-03 01:19   186752   ----a-w-   c:\windows\system32\wuwebv.dll
2012-06-22 06:48 . 2012-06-03 01:15   36864   ----a-w-   c:\windows\system32\wuapp.exe
2012-06-20 07:04 . 2012-06-20 07:04   --------   d--h--w-   c:\users\Certainly\AppData\Roaming\Avira
2012-06-20 06:59 . 2012-06-20 06:59   --------   d--h--w-   c:\users\Certainly\AppData\Roaming\CyberLink
2012-06-20 06:59 . 2012-06-20 08:42   --------   d--h--w-   c:\users\Certainly\AppData\Local\PlayMovie
2012-06-20 06:59 . 2012-06-20 06:59   --------   d--h--w-   c:\users\Certainly\AppData\Roaming\Apple Computer
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-13 10:14 . 2012-04-04 20:32   426184   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-13 10:14 . 2011-05-31 10:12   70344   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-11 15:52 . 2009-11-21 06:43   59701280   ----a-w-   c:\windows\system32\MRT.exe
2012-05-20 06:36 . 2012-05-16 21:14   98848   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2012-05-20 06:36 . 2012-05-16 21:14   132832   ----a-w-   c:\windows\system32\drivers\avipbb.sys
2012-05-04 11:06 . 2012-06-14 09:50   5559664   ----a-w-   c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 09:50   3968368   ----a-w-   c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 09:50   3913072   ----a-w-   c:\windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40 . 2012-06-14 09:50   209920   ----a-w-   c:\windows\system32\profsvc.dll
2012-04-28 03:55 . 2012-06-14 09:50   210944   ----a-w-   c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-14 09:50   77312   ----a-w-   c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-14 09:50   149504   ----a-w-   c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-14 09:50   9216   ----a-w-   c:\windows\system32\rdrmemptylst.exe
2012-04-24 05:37 . 2012-06-14 09:49   184320   ----a-w-   c:\windows\system32\cryptsvc.dll
2012-04-24 05:37 . 2012-06-14 09:49   140288   ----a-w-   c:\windows\system32\cryptnet.dll
2012-04-24 05:37 . 2012-06-14 09:49   1462272   ----a-w-   c:\windows\system32\crypt32.dll
2012-04-24 04:36 . 2012-06-14 09:49   1158656   ----a-w-   c:\windows\SysWow64\crypt32.dll
2012-04-24 04:36 . 2012-06-14 09:49   140288   ----a-w-   c:\windows\SysWow64\cryptsvc.dll
2012-04-24 04:36 . 2012-06-14 09:49   103936   ----a-w-   c:\windows\SysWow64\cryptnet.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-06 17:18   120104   ---ha-w-   c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Jing"="c:\program files (x86)\TechSmith\Jing\Jing.exe" [2012-02-02 2918224]
"Spotify"="c:\users\Franis\AppData\Roaming\Spotify\Spotify.exe" [2012-06-14 9478320]
"Spotify Web Helper"="c:\users\Franis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-06-14 932528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-07-28 1157128]
"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-29 419112]
"Acer Assist Launcher"="c:\program files (x86)\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-27 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2010-01-19 181480]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-19 254696]
"MessengerPlusForSkypeService"="c:\program files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe" [2012-06-19 119808]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-20 348624]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888]
.
c:\users\Franis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Evernote Clipper.lnk - c:\windows\Installer\{F761359C-9CED-45AE-9A51-9D6605CD55C4}\Evernote.ico [2010-12-22 293950]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages   REG_MULTI_SZ      kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-19 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-15 135664]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-13 250056]
R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [2009-07-14 281088]
R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [2009-06-10 15360]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [2010-07-02 51600]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-15 135664]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [2010-05-08 30304]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2012-01-18 351136]
R3 LVUVC64;Logitech Webcam 600(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2012-01-18 4865568]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-11 113120]
R3 Normandy;Normandy SR2;

R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-20 1255736]
S0 56337232;56337232 Boot Guard Driver;c:\windows\system32\DRIVERS\56337232.sys [2009-10-22 40464]
S1 56337231;56337231;c:\windows\system32\DRIVERS\56337231.sys [2009-09-26 157712]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-09-17 27760]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-29 203264]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-20 86224]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-08-06 844320]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-06-04 1150496]
S2 MsgPlusService;Messenger Plus! Service;c:\program files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [2012-06-19 119808]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-06 311592]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-11-13 67072]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-04-03 34872]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 10:14]
.
2012-07-20 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2010-06-07 20:01]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-15 09:40]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-15 09:40]
.
2012-07-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1109757479-377625319-1456128612-1000Core.job
- c:\users\Franis\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-24 01:45]
.
2012-07-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1109757479-377625319-1456128612-1000UA.job
- c:\users\Franis\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-24 01:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-06 17:19   137512   ---ha-w-   c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-06 828960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = https://ixquick.com/eng/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361109d545l0334z1h5t4852x232
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1 24.25.227.55 209.18.47.61 24.25.227.53
FF - ProfilePath - c:\users\Franis\AppData\Roaming\Mozilla\Firefox\Profiles\2c9a767w.default\
FF - prefs.js: browser.startup.homepage - hxxps://ixquick.com/
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
.
**************************************************************************
.
Completion time: 2012-07-19  15:10:15 - machine was rebooted
ComboFix-quarantined-files.txt  2012-07-20 01:10
.
Pre-Run: 76,384,890,880 bytes free
Post-Run: 77,677,522,944 bytes free
.
- - End Of File - - 9D5AB5335171AD13A9C37BE267343BA0

[SuperDave]

Well, ComboFix did remove some malicous items.
Did you create this folder: C:\.Trash-999

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

[an8el]

Just now when I got online, Avira did find another objectionable file: C:\OEM\Preload\Autorun\...\Installer_v6.exe  It had the choice to delete the file, (which sometimes doesn't work) or "details." When I asked for details, it began a short scan that formerly resulted in a quarrentine, but the scan did not complete.
So I guess we're not done yet.

Here's the result of the Security Check scan:

Results of screen317's Security Check version 0.99.43 
 Windows 7 Service Pack 1 x64   
 Internet Explorer 9 
``````````````Antivirus/Firewall Check:``````````````[/u]
 Windows Firewall Enabled! 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````[/u]
 Rootkit Unhooker LE 3.8 SR 2
 Malwarebytes Anti-Malware version 1.61.0.1400 
 Abexo Free Registry Cleaner 
 Java(TM) 6 Update 22 
 Java(TM) 6 Update 31 
 Java version out of Date!
 Adobe Reader 9 Adobe Reader out of Date!
 Mozilla Firefox 13.0.1 Firefox out of Date! 
 Google Chrome 20.0.1132.47 
 Google Chrome 20.0.1132.57 
````````Process Check: objlist.exe by Laurent````````[/u] 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````[/u]
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````[/u]

[an8el]

Oh and no, I didn't create the C:\.Trash-999 folder.

[SuperDave]

Update Your Java (JRE)

Old versions of Java have vulnerabilities that malware can use to infect your system.

First Verify your Java Version

If there are any other version(s) installed then update now.

Get the new version (if needed)

If your version is out of date install the newest version of the Sun Java Runtime Environment.

Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Be sure to close ALL open web browsers before starting the installation.

Remove any old versions

1. Download JavaRa and unzip the file to your Desktop.
2. Open JavaRA.exe and choose Remove Older Versions
3. Once complete exit JavaRA.

Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
**************************************************
Re-running ComboFix to remove infections:

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the quotebox below into it:
  

  KillAll::
  
  DirLook::
  
  C:\.Trash-999
  
  
• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Please post the contents of the log in your next reply.

[an8el]

I didn't realize that you had to remove old java versions... I did clean up some of them previously, but hadn't realized they weren't disabled once an update had been installed. Thanks for the utility to do that.

It appears that the trash-999 folder was genuinely connected to the trash, because the files in it were empty folders that I recently deleted on purpose.

Here's what ComboFix spit out this time:

ComboFix 12-07-21.01 - Franis 07/22/2012  15:35:39.2.1 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.2812.1809 [GMT -10:00]
Running from: c:\users\Franis\Desktop\ComboFixAlso.exe
Command switches used :: c:\users\Franis\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((   Files Created from 2012-06-23 to 2012-07-23  )))))))))))))))))))))))))))))))
.
.
2012-07-23 01:45 . 2012-07-23 01:45   --------   d-----w-   c:\users\Guest\AppData\Local\temp
2012-07-23 01:45 . 2012-07-23 01:45   --------   d-----w-   c:\users\Default\AppData\Local\temp
2012-07-23 01:45 . 2012-07-23 01:45   --------   d-----w-   c:\users\Certainly\AppData\Local\temp
2012-07-23 00:25 . 2012-07-23 00:25   476976   ----a-w-   c:\windows\SysWow64\npdeployJava1.dll
2012-07-18 09:57 . 2012-07-18 09:57   --------   d-----w-   c:\users\Franis\AppData\Roaming\SUPERAntiSpyware.com
2012-07-18 09:57 . 2012-07-18 09:57   --------   d-----w-   c:\program files\SUPERAntiSpyware
2012-07-18 09:57 . 2012-07-18 09:57   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
2012-07-15 20:29 . 2012-07-15 20:29   --------   d---a-w-   C:\.Trash-999
2012-07-11 22:32 . 2012-07-11 22:32   --------   d-----w-   c:\program files (x86)\Malwarebitey
2012-07-11 22:32 . 2012-04-05 01:56   24904   ----a-w-   c:\windows\system32\drivers\mbam.sys
2012-07-11 16:38 . 2012-07-11 16:38   --------   d-----w-   c:\program files (x86)\Mozilla Maintenance Service
2012-07-11 16:38 . 2012-07-11 16:38   421200   ----a-w-   c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-07-11 16:38 . 2012-07-11 16:38   770384   ----a-w-   c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-07-11 16:04 . 2012-06-12 03:08   3148800   ----a-w-   c:\windows\system32\win32k.sys
2012-07-11 15:48 . 2012-06-02 12:01   173056   ----a-w-   c:\windows\system32\ieUnatt.exe
2012-07-11 14:50 . 2012-06-06 06:06   2004480   ----a-w-   c:\windows\system32\msxml6.dll
2012-07-11 14:50 . 2012-06-06 06:06   1881600   ----a-w-   c:\windows\system32\msxml3.dll
2012-07-11 14:50 . 2012-06-06 05:05   1390080   ----a-w-   c:\windows\SysWow64\msxml6.dll
2012-07-11 14:50 . 2012-06-06 05:05   1236992   ----a-w-   c:\windows\SysWow64\msxml3.dll
2012-07-11 14:50 . 2010-06-26 03:55   2048   ----a-w-   c:\windows\system32\msxml3r.dll
2012-07-11 14:50 . 2010-06-26 03:24   2048   ----a-w-   c:\windows\SysWow64\msxml3r.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-23 00:25 . 2010-06-07 12:18   472880   ----a-w-   c:\windows\SysWow64\deployJava1.dll
2012-07-13 10:14 . 2012-04-04 20:32   426184   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-13 10:14 . 2011-05-31 10:12   70344   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-11 15:52 . 2009-11-21 06:43   59701280   ----a-w-   c:\windows\system32\MRT.exe
2012-06-03 01:19 . 2012-06-22 06:48   186752   ----a-w-   c:\windows\system32\wuwebv.dll
2012-06-03 01:15 . 2012-06-22 06:48   36864   ----a-w-   c:\windows\system32\wuapp.exe
2012-06-02 22:19 . 2012-06-22 06:49   38424   ----a-w-   c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 06:50   2428952   ----a-w-   c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-22 06:50   57880   ----a-w-   c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 06:50   44056   ----a-w-   c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 06:49   701976   ----a-w-   c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-22 06:50   2622464   ----a-w-   c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-22 06:49   99840   ----a-w-   c:\windows\system32\wudriver.dll
2012-05-20 06:36 . 2012-05-16 21:14   98848   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2012-05-20 06:36 . 2012-05-16 21:14   132832   ----a-w-   c:\windows\system32\drivers\avipbb.sys
2012-05-04 11:06 . 2012-06-14 09:50   5559664   ----a-w-   c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 09:50   3968368   ----a-w-   c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 09:50   3913072   ----a-w-   c:\windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40 . 2012-06-14 09:50   209920   ----a-w-   c:\windows\system32\profsvc.dll
2012-04-28 03:55 . 2012-06-14 09:50   210944   ----a-w-   c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-14 09:50   77312   ----a-w-   c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-14 09:50   149504   ----a-w-   c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-14 09:50   9216   ----a-w-   c:\windows\system32\rdrmemptylst.exe
2012-04-24 05:37 . 2012-06-14 09:49   184320   ----a-w-   c:\windows\system32\cryptsvc.dll
2012-04-24 05:37 . 2012-06-14 09:49   140288   ----a-w-   c:\windows\system32\cryptnet.dll
2012-04-24 05:37 . 2012-06-14 09:49   1462272   ----a-w-   c:\windows\system32\crypt32.dll
2012-04-24 04:36 . 2012-06-14 09:49   1158656   ----a-w-   c:\windows\SysWow64\crypt32.dll
2012-04-24 04:36 . 2012-06-14 09:49   140288   ----a-w-   c:\windows\SysWow64\cryptsvc.dll
2012-04-24 04:36 . 2012-06-14 09:49   103936   ----a-w-   c:\windows\SysWow64\cryptnet.dll
.
.
((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\.Trash-999 ----
.
2012-07-15 22:14 . 2012-07-15 22:14   111   ----a-w-   c:\.trash-999\info\Out4improv.trashinfo
2012-07-15 22:13 . 2012-07-15 22:13   105   ----a-w-   c:\.trash-999\info\Text.trashinfo
2012-07-15 20:52 . 2012-07-15 20:52   102   ----a-w-   c:\.trash-999\info\video clips.trashinfo
2012-07-15 20:34 . 2012-07-15 20:34   108   ----a-w-   c:\.trash-999\info\Hula-at-Volcano on SAT-July14th.txt.trashinfo
2012-07-15 20:29 . 2012-07-15 20:29   98   ----a-w-   c:\.trash-999\info\malware_File_Recovery.lnk.trashinfo
2012-07-14 08:10 . 2012-07-14 08:10   659   ----a-w-   c:\.trash-999\files\malware_File_Recovery.lnk
2012-07-08 17:04 . 2012-07-08 17:04   1494   ----a-w-   c:\.trash-999\files\Hula-at-Volcano on SAT-July14th.txt
.
.

[SuperDave]

Please download Rooter and Save it to your desktop.

• Double click it to start the tool.Vista and Windows7 run as administrator.
• Click Scan.
  
• Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.
  

[an8el]

The ones I don't recognize as programs I use are:
Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (2924) -
Deluxe\PlayMovie\PMVService.exe (3216)
C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (3216)
C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe (1612)

(these may have been part of the bloatware that came originally with the computer, even though I don't use them)

Programs that I do use and recognize are:
C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe (1584)
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (1440)
C:\Users\Franis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (2388)
C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (2260)
C:\Windows\Tasks\GlaryInitialize.job


I'm curious about what the rest of this scan means, if you care to educate me a bit.

Here is the Rooter scan results:


Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully ...
.
Windows 7 Home Edition (6.1.7601) Service Pack 1
[32_bits] - AMD64 Family 15 Model 124 Stepping 2, AuthenticAMD
.
[wscsvc] (Security Center) RUNNING (state:4)
[MpsSvc] RUNNING (state:4)
Windows Firewall -> Enabled
Windows Defender -> Enabled
.
Internet Explorer 9.0.8112.16421
Mozilla Firefox 13.0.1 (en-US)
.
C:\  [Fixed-NTFS] .. ( Total:136 Go - Free:76 Go )
D:\  [CD_Rom]
.
Scan : 02:39.14
Path : C:\Users\Franis\Desktop\Rooter.exe
User : Franis ( Administrator -> YES )
.
----------------------\\ Processes
.
Locked [System Process] (0)
Locked System (4)
______ ? (260)
______ ? (400)
______ ? (472)
______ ? (484)
______ ? (532)
______ ? (540)
______ ? (548)
______ ? (604)
______ ? (700)
______ ? (772)
______ ? (820)
______ ? (940)
______ ? (984)
______ ? (100)
______ C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (308)
______ ? (716)
______ ? (1080)
______ ? (1108)
______ ? (1252)
______ C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (1292)
______ ? (1312)
______ ? (1420)
______ C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (1440)
______ ? (1492)
______ C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (1536)
______ C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe (1584)
______ C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe (1612)
______ C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (1660)
______ ? (1760)
______ C:\Program Files\Acer\Acer Updater\UpdaterService.exe (1824)
______ ? (1864)
______ ? (1988)
______ ? (2144)
______ ? (2152)
______ ? (2516)
______ ? (2608)
______ ? (2648)
______ ? (2856)
______ ? (2868)
______ ? (2896)
______ C:\Users\Franis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (2388)
______ ? (140)
______ C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (960)
______ ? (1324)
______ ? (1956)
______ C:\Program Files (x86)\Launch Manager\LManager.exe (2940)
______ C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (2924)
______ C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (2260)
______ ? (904)
______ C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe (2384)
______ C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (3216)
______ ? (3232)
______ C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe (3268)
______ C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (3308)
______ C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (3444)
______ ? (3484)
______ ? (2404)
______ ? (2364)
______ ? (3968)
______ ? (4104)
______ ? (4992)
Locked audiodg.exe (4524)
______ C:\Users\Franis\Desktop\Rooter.exe (4600)
.
----------------------\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 (Start_Offset:32256 | Length:12888981504)
\Device\Harddisk0\Partition2 --[ MBR ]-- (Start_Offset:12889013760 | Length:106928640)
\Device\Harddisk0\Partition3 (Start_Offset:12995942400 | Length:147044894720)
.
----------------------\\ Scheduled Tasks
.
C:\Windows\Tasks\Adobe Flash Player Updater.job
C:\Windows\Tasks\GlaryInitialize.job
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1109757479-377625319-1456128612-1000Core.job
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1109757479-377625319-1456128612-1000UA.job
C:\Windows\Tasks\SA.DAT
C:\Windows\Tasks\SCHEDLGU.TXT
.
----------------------\\ Registry
.
.
----------------------\\ Files & Folders
.
----------------------\\ Scan completed at 02:39.26
.
C:\Rooter$\Rooter_3.txt - (24/07/2012 | 02:39.26)

[SuperDave]

The ones I don't recognize as programs I use are:
Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (2924) -
Deluxe\PlayMovie\PMVService.exe (3216)
C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (3216)
C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe (1612)

They probably were install when your computer was loaded or by another program. If you don't use them, uninstall them.

I'm curious about what the rest of this scan means, if you care to educate me a bit.

I don't wish to go into too much detail in an open forum but it is a scanner looking for Rootkits.
How is your computer working now?

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

[an8el]

OK, that scan (which took twelve hours!) found a couple of objections... The computer seems to be running normally, even before these two little problems were found.

Is there any cleanup that I should do to uninstall some of these programs we've used to scour these bugs away? These programs you recommended to use in this process seem pretty tiny - is there any danger of leaving them installed?


Here's the log file from the online scan:

C:\Users\Franis\Documents\THINKGS\src\browsers\newerChrome\chromupdater_exe.exe   a variant of Win32/InstallCore.D application   cleaned by deleting - quarantined
C:\Users\Franis\Documents\THINKGS\src\skype\recording messenger svs\Setup-SkypePlus-1.2.exe   a variant of Win32/MessengerPlus.A application   deleted - quarantined

[SuperDave]

Is there any cleanup that I should do to uninstall some of these programs we've used to scour these bugs away? These programs you recommended to use in this process seem pretty tiny - is there any danger of leaving them installed?

Yes, we can do some cleanup. You can keep SAS and MBAM on your computer, if you wish. Update them and run them on a regular basis as they are not full-time scanners.

Download this program and run it Uninstall ComboFix .It will remove ComboFix for you.

***************************************************
To set a new Restore Point.

Click Start button , click Control Panel, click System and Maintenance, and then clicking System. In the left pane, click System Protection.  If you are prompted for an administrator password or confirmation, type the password or provide confirmation. To turn off System Protection for a hard disk, clear the check box next to the disk, and then click OK. Reboot to Normal Mode.
Click the Start button , click Control Panel, click System and Maintenance, and then click System.
In the left pane, click System Protection.  If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
To turn on System Protection for a hard disk, select the check box next to the disk, and then click OK.
This will give you a new, clean Restore Point.
***************************************************
Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
**************************************************
Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!

[an8el]

Yes, I appreciate the reminder to do a new restore point again and the other things to do you suggested to beef up my protection levels. I'm considering also using Comodor for my firewall too, because I heard that the default one I have been using wasn't really adequate.

I have a few more clueless questions.
When I ran the uninstall to Combofix, it didn't disappear the .exe file that was on my desktop where I'd downloaded it. So does that mean the uninstall program uninstalled ComboFix, but left the original file that installed ComboFix alone... and if I clicked on the .exe file of ComboFix I would reinstall it again?

Another one of the things that changed because of the attack was how the list of currently running programs is displayed on my task bar. These currently running programs used to be in a menu that took up a half an inch of space on my lower right corner. Since the attack, these programs are in a line, taking up three inches instead of a half inch. Also, I imagine I can replace the icons that used to be next to my "start" button by dragging them onto the task bar on the other side, but there used to be an icon there signifying "show desktop" that I'd like to have back too. I think that I'm remembering this change happened when I ran the "unhide" program.

[SuperDave]

When I ran the uninstall to Combofix, it didn't disappear the .exe file that was on my desktop where I'd downloaded it. So does that mean the uninstall program uninstalled ComboFix, but left the original file that installed ComboFix alone... and if I clicked on the .exe file of ComboFix I would reinstall it again?

It's probably just something left over. You can check for ComboFix on C: Combofix. If it's still there please run the uninstall program. I've never tried that uninstall program so I'm unsure how it works.

Another one of the things that changed because of the attack was how the list of currently running programs is displayed on my task bar. These currently running programs used to be in a menu that took up a half an inch of space on my lower right corner. Since the attack, these programs are in a line, taking up three inches instead of a half inch. Also, I imagine I can replace the icons that used to be next to my "start" button by dragging them onto the task bar on the other side, but there used to be an icon there signifying "show desktop" that I'd like to have back too. I think that I'm remembering this change happened when I ran the "unhide" program.

I'm not sure what you mean. Could you provide a screenprint?
How to post screenshots or images

[an8el]

OK, here's a screen shot of what I mean... I was about wrote a little note on the picture itself.
(Hope the typeface isn't too small to see... but if it is, it says: Here's a screenprint. these icons you see below used to not be located in a line as they are now. They used to be in a menu, (which did not take up more than an eighth of the space here) After clicking on the menu, each icon was displayed and could be interacted with in the same way, but they were displayed in a menu box rather than in a line as they appear here. )

[SuperDave]

That looks normal but here's more information about the icons.