Inactive Live Messenger (MSN) AVG reports recurring tracking cookies

[Inactive] Live Messenger (MSN) AVG reports recurring tracking cookies

I have a similar problem to:

http://www.windowsbbs.com/malware-v...tracking-cookie-atdmt-when-connecting-ie.html

It only seems to happen when logging in an out of windows live messenger (msn) or at least that's when I notice it most. After following the advice and using ATF Cleaner and Malwarebytes' Anti-Malware. AVG shows several variations of the following problem files:

C:\Users\AppData\Roaming\Microsoft\Windows\Cookies\user@atdmt[2]

The problem is i get a clear log even though avg shows these problem files - is avg the problem, should I uninstall it?

My Log:

Malwarebytes' Anti-Malware 1.40
Database version: 2672
Windows 6.0.6002 Service Pack 2

21/08/2009 22:28:14
mbam-log-2009-08-21 (22-28-14).txt

Scan type: Quick Scan
Objects scanned: 78498
Time elapsed: 5 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

Ah, sorry. Here are the logs as requested.

DSS log:

DDS (Ver_09-07-30.01) - NTFSx86
Run by User at 0:27:52.42 on 24/08/2009
Internet Explorer: 8.0.6001.18813
Microsoft® Windows Vistaâ„¢ Business 6.0.6002.2.1252.44.1033.18.2008.775 [GMT 1:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Softex\OmniPass\OmniServ.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\ifxtcs.exe
C:\Windows\system32\taskeng.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Mil Incorporated\Mil Shield\ShieldService.exe
C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\IfxPsdSv.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Samsung\Easy ALS Manager\EasyALSManager.exe
C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Windows\System32\StkCSrv.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Softex\OmniPass\opvapp.exe
C:\Program Files\Softex\OmniPass\scureapp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Mil Incorporated\Mil Shield\ShieldWorker.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\User\Desktop\dds-1.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page =
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [MilShieldSlave] "c:\program files\mil incorporated\mil shield\ShieldWorker.exe" -logon
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [OmniPass] c:\program files\softex\omnipass\scureapp.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe "
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe "
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: avgrsstx.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-7-20 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-7-20 108552]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [2007-1-23 39080]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-7-20 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-7-20 297752]
R2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\drivers\KMDFMEMIO.sys [2009-7-2 13312]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y6032.sys [2009-7-2 224384]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-7-2 112128]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2009-5-28 4233728]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\drivers\StkCMini.sys [2009-7-2 1363088]

=============== Created Last 30 ================

2009-08-23 18:51 376 a------- c:\windows\ODBC.INI
2009-08-23 18:51 28,040 a------- c:\windows\system32\mdimon.dll
2009-08-23 18:50 <DIR> --d----- c:\program files\Microsoft ActiveSync
2009-08-22 00:41 <DIR> --d----- c:\program files\TagRename
2009-08-21 22:20 <DIR> --d----- c:\users\user\appdata\roaming\Malwarebytes
2009-08-21 22:20 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-21 22:20 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-08-21 22:20 <DIR> --d----- c:\programdata\Malwarebytes
2009-08-21 22:20 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-08-21 22:20 <DIR> --d----- c:\progra~2\Malwarebytes
2009-08-21 00:51 <DIR> --d----- c:\users\user\appdata\roaming\foobar2000
2009-08-21 00:51 <DIR> --d----- c:\program files\foobar2000
2009-08-20 08:58 32 a------- c:\windows\vb_mconf.ini
2009-08-20 08:58 <DIR> --d----- c:\program files\Mil Incorporated
2009-08-19 17:58 <DIR> --d----- c:\programdata\CyberLink
2009-08-19 01:18 <DIR> --d----- c:\programdata\Yahoo! Companion
2009-08-19 01:15 <DIR> --d----- c:\programdata\Yahoo!
2009-08-19 01:15 <DIR> --d----- c:\program files\Yahoo!
2009-08-19 00:58 <DIR> --d----- c:\program files\Microsoft
2009-08-18 02:56 <DIR> a-d----- c:\programdata\TEMP
2009-08-18 02:56 <DIR> --d----- c:\program files\Spyware Doctor
2009-08-17 12:58 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-08-17 12:58 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-17 12:58 <DIR> --d----- c:\program files\iPod
2009-08-17 12:58 <DIR> --d----- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-17 12:58 <DIR> --d----- c:\program files\iTunes
2009-08-17 12:58 <DIR> --d----- c:\progra~2\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-16 11:52 499,712 a------- c:\windows\system32\kerberos.dll
2009-08-16 11:52 270,848 a------- c:\windows\system32\schannel.dll
2009-08-16 11:52 218,624 a------- c:\windows\system32\msv1_0.dll
2009-08-16 11:52 175,104 a------- c:\windows\system32\wdigest.dll
2009-08-16 11:52 1,259,008 a------- c:\windows\system32\lsasrv.dll
2009-08-16 11:52 439,864 a------- c:\windows\system32\drivers\ksecdd.sys
2009-08-16 11:52 72,704 a------- c:\windows\system32\secur32.dll
2009-08-16 11:52 9,728 a------- c:\windows\system32\lsass.exe
2009-08-12 13:20 313,344 a------- c:\windows\system32\wmpdxm.dll
2009-08-12 13:20 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-08-12 13:20 7,680 a------- c:\windows\system32\spwmp.dll
2009-08-12 13:20 4,096 a------- c:\windows\system32\msdxm.ocx
2009-08-12 13:20 4,096 a------- c:\windows\system32\dxmasf.dll
2009-08-12 13:20 43,520 a------- c:\windows\system32\msdxm.tlb
2009-08-12 13:20 18,432 a------- c:\windows\system32\amcompat.tlb
2009-08-12 12:59 71,680 a------- c:\windows\system32\atl.dll
2009-08-12 12:59 160,256 a------- c:\windows\system32\wkssvc.dll
2009-08-12 12:59 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-08-12 12:58 91,136 a------- c:\windows\system32\avifil32.dll
2009-08-08 23:40 385,024 a------- c:\windows\system32\html.iec
2009-08-08 23:40 169,472 a------- c:\windows\system32\iexpress.exe
2009-08-08 23:40 45,568 a------- c:\windows\system32\mshta.exe
2009-08-08 23:40 109,568 a------- c:\windows\system32\PDMSetup.exe
2009-08-08 23:40 107,520 a------- c:\windows\system32\RegisterIEPKEYs.exe
2009-08-08 23:40 107,008 a------- c:\windows\system32\SetIEInstalledDate.exe
2009-08-08 23:40 103,936 a------- c:\windows\system32\SetDepNx.exe
2009-07-27 01:05 <DIR> --d----- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-07-26 23:43 251,751,396 a------- c:\windows\MEMORY.DMP
2009-07-26 16:44 48,448 a------- c:\windows\system32\sirenacm.dll

==================== Find3M ====================

2009-08-18 15:00 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-18 15:00 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
2009-08-17 12:57 143,360 a------- c:\windows\inf\infstrng.dat
2009-08-17 12:57 86,016 a------- c:\windows\inf\infstor.dat
2009-08-17 12:57 51,200 a------- c:\windows\inf\infpub.dat
2009-07-21 22:52 915,456 a------- c:\windows\system32\wininet.dll
2009-07-21 22:47 109,056 a------- c:\windows\system32\iesysprep.dll
2009-07-21 22:47 71,680 a------- c:\windows\system32\iesetup.dll
2009-07-21 21:13 133,632 a------- c:\windows\system32\ieUnatt.exe
2009-07-20 11:07 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-07-07 16:55 665,600 a------- c:\windows\inf\drvindex.dat
2009-07-07 16:33 0 a---h--- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-07-02 15:36 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_KMDFMEMIO_01000.Wdf
2009-07-02 15:29 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2009-07-02 15:24 319,456 a------- c:\windows\DIFxAPI.dll
2009-07-02 15:24 315,392 a------- c:\windows\HideWin.exe
2009-06-15 15:53 156,672 a------- c:\windows\system32\t2embed.dll
2009-06-15 15:52 23,552 a------- c:\windows\system32\lpk.dll
2009-06-15 15:52 72,704 a------- c:\windows\system32\fontsub.dll
2009-06-15 15:51 10,240 a------- c:\windows\system32\dciman32.dll
2009-06-15 13:42 289,792 a------- c:\windows\system32\atmfd.dll
2008-01-21 03:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 13:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 0:29:30.14 ===============


Attach Log:

DDS (Ver_09-07-30.01)

Microsoft® Windows Vistaâ„¢ Business
Boot Device: \Device\HarddiskVolume2
Install Date: 02/07/2009 15:14:59
System Uptime: 23/08/2009 12:27:59 (12 hours ago)

Motherboard: SAMSUNG ELECTRONICS CO., LTD. | | P560
Processor: Intel(R) Core(TM)2 Duo CPU P7350 @ 2.00GHz | U2E1 | 2000/mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 223 GiB total, 166.375 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================


==== Installed Programs ======================

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.3
Adobe Shockwave Player 11.5
Agere Systems HDA Modem
Apple Mobile Device Support
Apple Software Update
µTorrent
AuthenTec Fingerprint Sensor Minimum Install
AVG Free 8.5
Bonjour
CyberLink DVD Suite
CyberLink Power2Go
Easy ALS Manager
Easy Battery Manager
Easy Display Manager
Easy Network Manager 4.0
Easy SpeedUp Manager
Exact Audio Copy 0.99pb5
foobar2000 v0.9.6.8
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
imagine digital freedom - Samsung
Infineon TPM Professional Package
Inst5657
Inst565a
Intel PROSet Wireless
Intel(R) Graphics Media Accelerator Driver
Intel(R) Network Connections Drivers
Intel(R) PROSet/Wireless WiFi Software
Intel® Matrix Storage Manager
iTunes
Junk Mail filter update
LabelPrint
LightScribe System Software 1.12.37.1
Malwarebytes' Anti-Malware
Medieval CUE Splitter
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Standard Edition 2003
Microsoft Silverlight
Microsoft SOAP Toolkit 2.0 SP2
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Mil Shield
MSVCRT
OmniPass 5.01.25.A
Play Camera
PowerDirector
PowerDVD
PowerProducer
QuickTime
Realtek High Definition Audio Driver
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.06
Safari
Samsung Magic Doctor
Samsung Update Plus
Security Update for CAPICOM (KB931906)
Synaptics Pointing Device Driver
Tag&Rename 3.5.2
USB2.0 UVC 1.3M WebCam
USB2.0 UVC WebCam
User Guide
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar

==== End Of File ===========================

 

That's good news if that's the case. Thanks very much. Could you recommend an alternative to AVG? It's really bugging me. It come up with multiple threat detections, refuses to remove them ect.

 

Nice, thanks very much. Now i don't know what to pick LOL.