1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Spyware/Malware/Adaware Infections

Discussion in 'Malware and Virus Removal Archive' started by reknaw, 2006/04/26.

Page 1 of 3
  1. 2006/04/26
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    I've just started getting annoying pop-ups from the Virus Alert Icon telling me my computer is infected referring me to a website for SpyFalcon, Malware Wipe & Pest Trap.

    I ran AVG 7 and it showed No Viruses. I ran Ad-Aware and SpyBot twice and deleted all they found. I had read a report on hear that a free version of Panda Active Scan had done wonders for someone. I tried that and although the scan was free I am to send the $12.95us to disinfect the 25 files they found infection.

    I don't mind paying to clean this up - but what do you knowledgeable guys think..... will this help or there better programmes that you could recommend?

    Thanks:mad:
     
    reknaw,
    #1
  2. 2006/04/26
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Save your $$ - do an online scan at Housecall (Trend Micro), accessible through Quicklinks in my signature.

    As a backup download and run the trial version of Ewido. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu ". Run Ewido and post the log here.

    If these fail to clean up then post back
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2006/04/26
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    I've tried the on-line scan at Housecall via your link and directly from their home page..... 4 times now when it comes on to launch I receive the MS Message re. encountering a serious error etc. and is closing down......
    Any other Utilities you'd recommend ?

    I did download that Panda one for 30 day trial.... it did dis-infect all it found but I'm still getting a pop-up saying my pc is infected. Thanks for your help so far Pete
     
    reknaw,
    #3
  5. 2006/04/26
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Have you run Ewido ?
     
    PeteC,
    #4
  6. 2006/04/26
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    Not yet - wasn't sure if I was suppose to run Housecall prior to..... I'll try that now
     
    reknaw,
    #5
  7. 2006/04/26
    Welshjim

    Welshjim Inactive

    Joined:
    2002/01/07
    Messages:
    5,643
    Likes Received:
    0
    reknaw--
    What program is the source of Virus Alert Icon? Maybe that is one of the malware items on your PC.
    Here is a complete procedure for attempting to rid your PC of malware
    http://www.windowsbbs.com/showthread.php?t=37074
    Are you running spyware and antivirus scans with the latest updates of reference files and virus definitions?
     
    Welshjim,
    #6
  8. 2006/04/26
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    OK I ran Ewido and that cleaned up two more - here's my Hi-jack log:

    Logfile of HijackThis v1.99.1
    Scan saved at 8:34:26 PM, on 26/04/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
    C:\WINDOWS\system32\brsvc01a.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\brss01a.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\System32\DVDRAMSV.exe
    C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
    C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PsImSvc.exe
    C:\WINDOWS\System32\ScsiAccess.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
    C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\apvxdwin.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    C:\WINDOWS\System32\igfxtray.exe
    C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\SRVLOAD.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\00THotkey.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    C:\WINDOWS\system32\TFNF5.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\System32\ezSP_Px.exe
    C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\WebProxy.exe
    C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe
    C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Labtec\Wireless Mouse\MulMouse.exe
    C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\palstart.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AVENGINE.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\DOCUME~1\KENALL~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
    C:\WINDOWS\system32\uWDF.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll (file missing)
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
    O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
    O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe "
    O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84 "
    O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [LXBSCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBStime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe -startup
    O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe /StartUp
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe "
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s
    O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe "
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU "
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Labtec Mouse Software 2.0.lnk = C:\Program Files\Labtec\Wireless Mouse\MulMouse.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: palstart.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: PUFLITE - http://brockvillerealestate.point2homes.biz/Photo/Control/PUFLITE.CAB
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {F8F88D0D-E455-11D6-B547-00400555C7FB} (DiskHealth2 Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
    O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
    O23 - Service: lxbs_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbscoms.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
    O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
    O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PsImSvc.exe
    O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe

    Thanks again
     
    reknaw,
    #7
  9. 2006/04/26
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    That could well be Jim - after running the above scans, that particular icon has gone and the web page that popped up has also gone. The only remaining annoyance is the one that pops up telling me my pc is infected ( I have a feeling it's not and I'm clean now) I'll check out the procedure above that you recommended and advise....thanks
     
    reknaw,
    #8
  10. 2006/04/26
    Welshjim

    Welshjim Inactive

    Joined:
    2002/01/07
    Messages:
    5,643
    Likes Received:
    0
    reknaw--Perhaps the popups come from your Instant Messenger service if you have one.
     
    Welshjim,
    #9
  11. 2006/04/26
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    Looks like it was wishful thinking - BitDefender found some problems that the others missed - here's the summary:


    BitDefender Online Scanner - Real Time Virus Report
    Generated at: Wed, Apr 26, 2006 - 22:22:59
    --------------------------------------------------------------------------
    Scan Info
    Scanned Files 255417

    Infected Files 6

    Virus Detected

    Application.Adware.NewDotNet.Dropper 1
    Application.Spyware.WebHancer.A 1
    Trojan.Downloader.Zlob.MJ 2
    BehavesLike:Win32.ExplorerHijack 1
    Trojan.Renos.E 1
    .....................................................................................................

    The full report :

    C:\WINDOWS\BDOSCAN8\BitDenfender April 26 2006.html

    BitDefender Online Scanner
    Scan report generated at: Wed, Apr 26, 2006 - 21:54:13
    Scan path: C:\;D:\;E:\;
    Statistics
    Time01:03:20
    Files255103
    Folders 4277

    Boot Sectors 2
    Archives 9556
    Packed Files 17458

    Results

    Identified Viruses 5
    Infected Files 6
    Suspect Files 0
    Warnings 0
    Disinfected 0
    Deleted Files 6

    Engines Info

    Virus Definitions 372263

    Engine build AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

    Scan plugins 13

    Archive plugins 39

    Unpack plugins 4

    E-mail plugins 6

    System plugins 1

    Scan Settings

    First Action Disinfect

    Second Action Delete

    Heuristics Yes

    Enable Warnings Yes

    Scanned Extensions *;

    Exclude Extensions

    Scan Emails Yes

    Scan Archives Yes

    Scan Packed Yes

    Scan Files Yes

    Scan Boot Yes

    Scanned File Status

    C:\My Downloads\marinefree.exe=>wise0089
    Detected with: Application.Adware.NewDotNet.Dropper

    C:\My Downloads\marinefree.exe=>wise0089
    Deleted

    C:\My Downloads\marinefree.exe
    Update failed

    C:\My Downloads\marinefree.exe=>wise0090=>(RAR Sfx o)=>WhAgent.exe
    Detected with: Application.Spyware.WebHancer.A

    C:\My Downloads\marinefree.exe=>wise0090=>(RAR Sfx o)=>WhAgent.exe
    Disinfection failed

    C:\My Downloads\marinefree.exe=>wise0090=>(RAR Sfx o)=>WhAgent.exe
    Deleted

    C:\My Downloads\marinefree.exe=>wise0090=>(RAR Sfx o)
    Update failed

    C:\System Volume Information\_restore{C187E191-830A-4F39-AE4C-62C27C3D3607}\RP487\A0037060.dll
    Infected with: Trojan.Renos.E

    C:\System Volume Information\_restore{C187E191-830A-4F39-AE4C-62C27C3D3607}\RP487\A0037060.dll
    Disinfection failed

    C:\System Volume Information\_restore{C187E191-830A-4F39-AE4C-62C27C3D3607}\RP487\A0037060.dll
    Deleted

    C:\WINDOWS\system32\dcomcfg.exe
    Infected with: Trojan.Downloader.Zlob.MJ

    C:\WINDOWS\system32\dcomcfg.exe
    Deleted

    C:\WINDOWS\system32\regperf.exe
    Infected with: BehavesLike:Win32.ExplorerHijack

    C:\WINDOWS\system32\regperf.exe
    Disinfection failed

    C:\WINDOWS\system32\regperf.exe
    Deleted

    C:\WINDOWS\system32\simpole.tlb
    Infected with: Trojan.Downloader.Zlob.MJ

    C:\WINDOWS\system32\simpole.tlb
    Deleted
    .........................................................
    Haven't a clue what all this means - any idea where I go from here ?
    Thanks Guys .
     
    reknaw,
    #10
  12. 2006/04/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    BitDefender found and fixed a few baddies, including some in System Restore. You should turn off System Restore until this problem is resolved, otherwise you may restore an infection.

    Your HJT log is now out of date as BitDefender has been run since you posted it.

    Please move hijackthis.exe to a folder on your hard drive, say C:\HJT as any fixed items are backed up and a temporary location or the desktop is not suitable.

    Reboot to Safe Mode, scan again and post the log here.
     
    PeteC,
    #11
  13. 2006/04/27
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    OK. I turned off System Restore and I made a C:\HJT file and copied the hijackthis file there.

    I re-booted to Safe Mode to scan again but found I couldn't connect to the internet to get to the BitDefender program (online). Should I, if there is a way, have downloaded BitDender to my hard drive first and then would BitDefender and highjackthis.exe work off-line in the safe mode ???

    Sorry, but I am easily confused :confused: :confused:
     
    reknaw,
    #12
  14. 2006/04/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    We are finished with BitDefender - just boot to Safe Mode and run HijackThis from it's new location in C:\HJT - 'Do a system scan and save a log file'. Reboot into Normal mode and post the log.
     
    PeteC,
    #13
  15. 2006/04/27
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    Thanks Pete..... here it is

    Logfile of HijackThis v1.99.1
    Scan saved at 1:52:23 PM, on 27/04/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\DOCUME~1\KENALL~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Sympatico
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll (file missing)
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
    O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
    O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe "
    O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84 "
    O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [LXBSCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBStime.dll,_RunDLLEntry@16
    O4 - HKLM\..\Run: [MemoryCardManager] C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe -startup
    O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe /StartUp
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe "
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s
    O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe "
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU "
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Labtec Mouse Software 2.0.lnk = C:\Program Files\Labtec\Wireless Mouse\MulMouse.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: palstart.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: PUFLITE - http://brockvillerealestate.point2homes.biz/Photo/Control/PUFLITE.CAB
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {F8F88D0D-E455-11D6-B547-00400555C7FB} (DiskHealth2 Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
    O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
    O23 - Service: lxbs_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbscoms.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
    O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
    O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - c:\program files\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PsImSvc.exe
    O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe
     
    reknaw,
    #14
  16. 2006/04/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Hmm - you ran HJT from the old location :( ....

    C:\DOCUME~1\KENALL~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

    Never mind, there is not a lot awry - one piece of low risk adware plus a few missing files (note fixing these in HJT will not restore the files, but will clear references to them from the registry) ....

    Rescan with HJT in Safe Mode - preferably from hijackthis.exe in C:\HJT and put a checkmark against these entries and then click on Fix Selected ....

    O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - C:\Program Files\Alcohol Soft\Alcohol 120% Toolbar\a120_tb.dll (file missing)
    O4 - Global Startup: palstart.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (file missing)
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)

    Stay in Safe Mode and search for and delete all instances of palstart.exe. you may need to enable 'View hidden files and folders' in Windows Explorer > Tools > Folder Options > View.

    Go Start > Run > type in msconfig > OK and go to the Startup tab and uncheck palstart.exe if present.

    Reboot to normal mode - is the problem gone?
     
    PeteC,
    #15
  17. 2006/04/27
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    I don't know if the problem has gone or not..... the pop up saying "I'm infected" seems to have stopped, however, I ran BitDefender On Line Scan again and here's what it says - it appears there are still some problems especially C:\WINDOWS\system32\atmclk.exe Infected with: Trojan.Downloader.Zlob.IP

    Doesn't look like they could get rid of it - should I be worried ?
    ................................
    Scanned File
    Status

    C:\My Downloads\marinefree.exe=>wise0089
    Detected with: Application.Adware.NewDotNet.Dropper

    C:\My Downloads\marinefree.exe=>wise0089
    Deleted

    C:\My Downloads\marinefree.exe
    Update failed

    C:\My Downloads\marinefree.exe=>wise0090=>(RAR Sfx o)=>WhAgent.exe
    Detected with: Application.Spyware.WebHancer.A

    C:\My Downloads\marinefree.exe=>wise0090=>(RAR Sfx o)=>WhAgent.exe
    Disinfection failed

    C:\My Downloads\marinefree.exe=>wise0090=>(RAR Sfx o)=>WhAgent.exe
    Deleted

    C:\My Downloads\marinefree.exe=>wise0090=>(RAR Sfx o)
    Update failed

    C:\WINDOWS\system32\atmclk.exe
    Infected with: Trojan.Downloader.Zlob.IP

    C:\WINDOWS\system32\atmclk.exe
    Disinfection failed

    C:\WINDOWS\system32\atmclk.exe
    Deleted
    .....................................
    My pc is also very slow, seems since I had to replace AVG with Panda before Panda would scan...... think I'll switch back to AVG and see if it is the reason
    Thanks Pete ...... should I turn on System Restore now or should we try to get rid of the above first ?
     
    reknaw,
    #16
  18. 2006/04/27
    Welshjim

    Welshjim Inactive

    Joined:
    2002/01/07
    Messages:
    5,643
    Likes Received:
    0
    reknaw--I would suggest you put that file atmclk.exe into your Recycle Bin (but do not delete). Now does that message disappear? If so keep running your PC several days, and if no other problems arise, delete atmclk.exe.
    If you still have the problem, there is no question that Trojan.Downloader.Zlob is malware. However, I do not find a clear way to get rid of it, unless it is buried here.
    http://www.geekstogo.com/forum/index.php?showtopic=50519
    You could also try a scan with some antiTrojan programs
    http://www.windowsecurity.com/trojanscan/trojanscan.asp (online scan)
    http://www.emsisoft.com/en/ A-squared is expensive. I do not know if the trial version will also delete found trojans.
     
    Welshjim,
    #17
  19. 2006/04/27
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1
    Jim:
    I just tried a search for C:\windows\system32\atmclk.exe and couldn't find it.
    I looked again at the Bitdefender report and it looks like they deleted it ( ? )
    ..........................
    C:\WINDOWS\system32\atmclk.exe
    Infected with: Trojan.Downloader.Zlob.IP

    C:\WINDOWS\system32\atmclk.exe
    Disinfection failed

    C:\WINDOWS\system32\atmclk.exe
    Deleted
    ..........................
    What do you make of that - does that mean I'm rid of the Trojan.Downloader.Zlob.IP ?
     
    reknaw,
    #18
  20. 2006/04/28
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    A Google search comes up with no references to atmclk.exe which could mean one of two things - if there is something still there it changes it's name at random or it's a false positive. BitDefender deleted it according to the report.

    The trojan is real enough I guess and is listed as Trojan.Downloader.Zlob. AVG should deal with it according to this Google search ....

    http://www.google.com/search?hl=en&...,GGLG:en&q=Trojan.Downloader.Zlob&btnG=Search

    As Jim suggests an online trojan scan is a sound idea but I would also run Ewido again and post the report here.

    And leave System Restore off for the moment.
     
    PeteC,
    #19
  21. 2006/04/28
    reknaw

    reknaw Well-Known Member Thread Starter

    Joined:
    2002/05/17
    Messages:
    214
    Likes Received:
    1

    I did the on-line DEEP SCAN....
    It showed: Processes Scanned - 36 Files Scanned - 100905 Traces scanned - 40736 Cookies Scanned - 91 Objects dected = 28
    .........
    Trace Directory. PalTalk - 3 traces
    Trace File. PalTalk - 17 traces
    Trace Tracking Cookie - 8 cookies
    ..............
    This took a long time so before I move onto Ewido & report back - should I delete any of the above..... they seem mostly associated with PalTalk....please advise
     
    reknaw,
    #20
Page 1 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...