Malware and Virus RemovalProblems removing malware/viruses? Get help from our Malware removal experts.
Mission Statement
WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.
Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.
I am actually a friend of psiegel81 and he was telling me about the great job you guys have been doing, so I figured I'd run a quick question by you.
I just recently had a pretty nasty trojan, everything seems to be running smoothly now, but I just wanted to make sure I got everything.
Here's my HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 6:08:40 PM, on 2/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
I am currently running ZoneAlarm for a Software Firewall and AVG:AS/AV, although I am looking for a new AS since my free trial of AVG:AS has just expired.
Any help would be greatly appreciated.
Thanks,
Aaron
Didn't find the information you thought to find? Check out these Similar Threads
Please download SmitfraudFix (by S!Ri) to your Desktop.
Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.
Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
Scan done at 20:40:51.62, Mon 02/26/2007
Run from C:\Documents and Settings\Aaron J Heiks\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
C:\DOCUME~1\AARONJ~1\FAVORI~1\Online Security Test.url FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".
The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt
Warning : running option #2 on a non infected computer will remove your Desktop background.
Please post the report and a new HJT log.
Thanks
Geri
Scan done at 21:20:16.84, Mon 02/26/2007
Run from C:\Documents and Settings\Aaron J Heiks\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
Logfile of HijackThis v1.99.1
Scan saved at 9:30:51 PM, on 2/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Once you are on the Panda site click the Scan your PC button
A new window will open...click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Click the big Scan Now button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on My Computer to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
Also your Java is some what out of date we will fix that later.
I wish I could remember the name of the trojan I had. I do remember that it had my anti-spyware and anti-virus going nuts. As well as an extremely annoying icon in the systray that said I was infected and that I should download their anti-spyware software to heal my pc. I thought that I had everything clean, but at this point I am less than convinced.
Here's the Panda log:
Incident Status Location
Adware:adware/surfaccuracy Not disinfected Windows Registry
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-10.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-11.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-13.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-14.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-30.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-31.txt[.azjmp.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-33.txt[.xiti.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-37.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-9.txt[.azjmp.com/]
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies.txt[.ccbill.com/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies.txt[.adultfriendfinder.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies.txt[.go.com/]
Spyware:Cookie/Tucows Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies.txt[.tucows.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies.txt[.xiti.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@2o7[2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@adrevolver[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@advertising[1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@atwola[1].txt
Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@ct.360i[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@doubleclick[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@go[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@go[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@go[3].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@questionmarket[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Aaron J Heiks\Desktop\CleanUp!\SmitfraudFix\Process.exe
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Aaron J Heiks\Local Settings\Temp\Cookies\aaron j heiks@atwola[1].txt
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\WindowsEx.dll.041
Virus:mIRC/Gen Disinfected C:\Programs\mIRC\hix\aliases.ini
Potentially unwanted tool:Application/MotherboardMonitor.A Not disinfected C:\Programs\mIRC\hix\moo.dll
Potentially unwanted tool:Application/MotherboardMonitor.A Not disinfected C:\Programs\mIRC\hix\scripts\systeminfo\moo.dll
Adware:Adware/VideoActiveXObject Not disinfected C:\RECYCLER\S-1-5-21-329068152-1547161642-839522115-1003\Dc574.exe
Well, I found most of that log to be an easy fix since most were just cookies. I have deleted my cookies and cleared my temp internet files in IE and FF2.
I've since deleted Process.exe
But I don't know what it doesn't like about mIRC\hix. I suppose I could take that off my system since I no longer us it.
Running AVG now then Panda again later, will post updated log when I am done.
I see you have AVG Anti-spyware.
Please run it at the settings given. Skip the download part.
Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
On the main screen select the icon "Update" then select the "Update now" link.
Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
Under "Reports"
Select "Automatically generate report after every scan"
Un-Select "Only if threats were found"
Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.
Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter. IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time. Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.
Please post the AVG log.
I would also like to see a uninstall list. Here is how to do this.
Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.
Incase you are wondering I don't like these. I'm hoping AVG will get rid of them.
surfaccuracy
ISTBar
Then I ran Panda's ActiveScan again as a second check to see what was left, here's that report.
Incident Status Location
Adware:adware/surfaccuracy Not disinfected Windows Registry
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-10.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-11.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-13.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-14.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-30.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-31.txt[.azjmp.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-33.txt[.xiti.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-37.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-9.txt[.azjmp.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@advertising[1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@atwola[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@doubleclick[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@go[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@go[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Aaron J Heiks\Local Settings\Temp\Cookies\aaron j heiks@atwola[1].txt
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\WindowsEx.dll.041
As you can see surfaccuracy and ISTBar are still there.
And here's the HJT Uninstall List you requested.
ABBYY FineReader 5.0 Sprint Plus
Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Flash Player 9 ActiveX
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 7.0.7
Adobe Stock Photos 1.0
AIM 6.0
AOL Instant Messenger
ArcSoft Software Suite
AutoCAD 2000
AV Voice Changer Software 4.0
AVG Anti-Spyware 7.5
AVG Free Edition
BitTorrent 4.2.0
Cook'n with Betty Crocker
Descent 3
DivX
DivX Player
EPSON CardMonitor
EPSON Copy Utility
EPSON ES CX6400 Manual
EPSON Photo Print
EPSON PhotoStarter3.0
EPSON Printer Software
EPSON Scan
EPSON Smart Panel
ESPN RunTime
Fraps
GameSpy Arcade
Google Earth
GTK+ 2.4.1 runtime environment
Half-Life(R) 2
HijackThis 1.99.1
HLSW v1.0.0.39
Hotfix for Windows XP (KB926239)
InCD (ahead software)
iTunes
J2SE Runtime Environment 5.0 Update 5
Kali II
Kquery4 (remove only)
LimeWire 4.12.6
Macromedia Shockwave Player
MAIET entertainment - Gunz
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Halo
Microsoft Office 97, Professional Edition
Microsoft User-Mode Driver Framework Feature Pack 1.0
mIRC
Mozilla Firefox (1.5.0.8)
Mozilla Firefox (2.0.0.2)
Mozilla Thunderbird (1.5)
MSN Music Assistant
MSXML 4.0 SP2 Parser and SDK
Musicmatch® Jukebox
Need for Speed Underground 2
Nero - Burning Rom
NVIDIA Drivers
NVIDIA nForce Utilities
NVIDIA Windows 2000/XP nForce Drivers
ObjectDock
Oscar's Renamer 1.0
Panda ActiveScan
Pivot Stickfigure Animator
PokerStars
PokerStars.net
Quake 4 (TM) SDK (remove only)
Quake 4(TM)
Quake II Demo
QuickTime
RealPlayer
ResChanger XP
SaTstrat (remove only)
ScanToWeb
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB925486)
Silkroad
SmartFTP Client 2.0
SmartFTP Client 2.0 Setup Files (remove only)
SolidWorks 2000
SoulSeek Client 156c
Speed
Steam(TM)
Surf Accuracy
System Alert Popup
TDK Digital MixMaster
TeamSpeak 2 RC2
The GIMP 2.0.2
UltraVNC v1.0.1
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Ventrilo Client
Verizon Online
Verizon Yahoo! Applications
Viewpoint Manager (Remove Only)
Viewpoint Media Player
WildTangent Web Driver
WinAce Archiver
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinRAR archiver
Xfire (remove only)
ZoneAlarm
I have know idea where the Surf Accuracy came from, especially since the date on it in my Add/Remove was from 2005. Anyway, I removed it, ran SpyBot and AdAware and here's what's left:
Incident Status Location
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-10.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-11.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-13.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-14.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-30.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-31.txt[.azjmp.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-33.txt[.xiti.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-37.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-9.txt[.azjmp.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@2o7[1].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@advertising[1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@atwola[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@doubleclick[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@go[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@go[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Aaron J Heiks\Local Settings\Temp\Cookies\aaron j heiks@atwola[1].txt
Adware:Adware/IST.ISTBar Not disinfected C:\Program Files\Common Files\Totem Shared\Update\WindowsEx.dll.041
Reboot into safe mode.
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.
Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete this folder (if present):
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-10.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-11.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-13.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-14.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-30.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-31.txt[.azjmp.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-33.txt[.xiti.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-37.txt[.azjmp.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Aaron J Heiks\Application Data\Mozilla\Firefox\Profiles\rkpxk3ot.default\cookies-9.txt[.azjmp.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@advertising[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@atwola[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@doubleclick[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@go[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Aaron J Heiks\Cookies\aaron j heiks@go[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Aaron J Heiks\Local Settings\Temp\Cookies\aaron j heiks@atwola[1].txt
