Tech Support banner

Status
Not open for further replies.
1 - 9 of 9 Posts

·
Registered
Joined
·
5 Posts
Discussion Starter #1
Have tried Spybot,spyware doctor,Xoftspy.

Hope you can help.


Logfile of HijackThis v1.99.1
Scan saved at 22:10:22, on 05/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\RevoTask.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Nebula\DigiTV\DigiSvc.exe
C:\Program Files\UltraMon\UltraMon.exe
C:\Program Files\StartBarTicker\StartBarTicker.exe
C:\Program Files\UltraMon\UltraMonTaskbar.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\BitTorrent\btdownloadgui.exe
C:\WINDOWS\system32\calc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://uk.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.muathe.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://uk.search.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...k/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://uk.search.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.muathe.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://uk.search.yahoo.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINDOWS\System32\RevoTask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [StartBarTicker] "C:\Program Files\StartBarTicker\StartBarTicker.exe"
O4 - HKCU\..\Run: [MrkWhoIs] "C:\Program Files\StartBarTicker\market.exe"
O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe
O4 - Startup: StartBarTicker.lnk = C:\Program Files\StartBarTicker\StartBarTicker.exe
O4 - Global Startup: Digisvc.lnk = C:\Program Files\Nebula\DigiTV\DigiSvc.exe
O4 - Global Startup: UltraMon.lnk = C:\Program Files\UltraMon\UltraMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123255941155
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32\m2280cfuef280.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
 

·
Registered
Joined
·
1,462 Posts
afraid a popup blocker wont stop this guy,

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

If after the reboot the desktop icons dont dissappear or the log does not pop up then in the l2mfix folder double click the second.bat file to continue with the fix.
 

·
Registered
Joined
·
5 Posts
Discussion Starter #5 (Edited)
Thank you for your help :)

L2Mfix 1.04a

Running From:
C:\Documents and Settings\russel ward\Desktop\spywarething\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

Setting Directory
C:\Documents and Settings\russel ward\Desktop\spywarething\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\russel ward\Desktop\spywarething\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1756 'explorer.exe'
Killing PID 1756 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1536 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\gp00l3dm1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kt02l7do1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lvr2099oe.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wynsock.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\gp00l3dm1.dll
Successfully Deleted: C:\WINDOWS\system32\gp00l3dm1.dll
deleting: C:\WINDOWS\system32\kt02l7do1.dll
Successfully Deleted: C:\WINDOWS\system32\kt02l7do1.dll
deleting: C:\WINDOWS\system32\lvr2099oe.dll
Successfully Deleted: C:\WINDOWS\system32\lvr2099oe.dll
deleting: C:\WINDOWS\system32\wynsock.dll
Successfully Deleted: C:\WINDOWS\system32\wynsock.dll
deleting: C:\WINDOWS\system32\guard.tmp


Zipping up files for submission:
adding: gp00l3dm1.dll (164 bytes security) (deflated 5%)
adding: kt02l7do1.dll (164 bytes security) (deflated 5%)
adding: lvr2099oe.dll (164 bytes security) (deflated 5%)
adding: wynsock.dll (164 bytes security) (deflated 4%)
adding: guard.tmp (164 bytes security) (deflated 4%)
adding: clear.reg (164 bytes security) (deflated 37%)
adding: echo.reg (164 bytes security) (deflated 13%)
adding: direct.txt (164 bytes security) (deflated 1%)
adding: lo2.txt (164 bytes security) (deflated 77%)
adding: readme.txt (164 bytes security) (deflated 52%)
adding: test.txt (164 bytes security) (deflated 59%)
adding: test2.txt (164 bytes security) (deflated 17%)
adding: test3.txt (164 bytes security) (deflated 17%)
adding: test5.txt (164 bytes security) (deflated 17%)
adding: xfind.txt (164 bytes security) (deflated 52%)
adding: backregs/1383538C-BC06-452B-8E84-F12D237F138C.reg (164 bytes security) (deflated 70%)
adding: backregs/86A54448-9944-460C-963E-459C3FEC76D7.reg (164 bytes security) (deflated 69%)
adding: backregs/notibac.reg (164 bytes security) (deflated 88%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!
Warning (option /rga:(ci)) - There is no ACE to remove!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

Restoring Windows Update Certificates.:

deleting local copy: gp00l3dm1.dll
deleting local copy: kt02l7do1.dll
deleting local copy: lvr2099oe.dll
deleting local copy: wynsock.dll
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\H323TSP]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\dnn0015me.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\gp00l3dm1.dll
C:\WINDOWS\system32\kt02l7do1.dll
C:\WINDOWS\system32\lvr2099oe.dll
C:\WINDOWS\system32\wynsock.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{86A54448-9944-460C-963E-459C3FEC76D7}"=-
"{1383538C-BC06-452B-8E84-F12D237F138C}"=-
[-HKEY_CLASSES_ROOT\CLSID\{86A54448-9944-460C-963E-459C3FEC76D7}]
[-HKEY_CLASSES_ROOT\CLSID\{1383538C-BC06-452B-8E84-F12D237F138C}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************













****************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 04:12:46, on 06/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\RevoTask.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\StartBarTicker\StartBarTicker.exe
C:\Program Files\Nebula\DigiTV\DigiSvc.exe
C:\Program Files\UltraMon\UltraMon.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\UltraMon\UltraMonTaskbar.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://uk.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.muathe.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://uk.search.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...k/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://uk.search.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.muathe.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://uk.search.yahoo.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINDOWS\System32\RevoTask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [StartBarTicker] "C:\Program Files\StartBarTicker\StartBarTicker.exe"
O4 - HKCU\..\Run: [MrkWhoIs] "C:\Program Files\StartBarTicker\market.exe"
O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe
O4 - Startup: StartBarTicker.lnk = C:\Program Files\StartBarTicker\StartBarTicker.exe
O4 - Global Startup: Digisvc.lnk = C:\Program Files\Nebula\DigiTV\DigiSvc.exe
O4 - Global Startup: UltraMon.lnk = C:\Program Files\UltraMon\UltraMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123255941155
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O20 - Winlogon Notify: H323TSP - C:\WINDOWS\system32\dnn0015me.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
 

·
Registered
Joined
·
1,462 Posts
Looks like you got the new Variant :sad: unfortunately ATM this is the only thing that will fix it.

Download, install & launch - Webroot SpySweeper (Trial) (8.3 MB Download)

When SpySweeper starts, please accept any prompts to update definitions.

Then configure it as followed:
  • From the left pane, click Options
  • Select the Sweep Options tab & ensure the following are ticked:
    • Sweep Memory
    • Sweep Registry
    • Sweep Cookies
    • Sweep All Users accounts
    • Do Not Sweep System Restore Folder
    • Enable Direct Disk Sweeping
    • Sweep For Rootkits
  • After that's done, select Sweep from the left pane & click on the Start button
  • Allow Spysweeper to reboot your machine to remove the infected files.
After rebooting, launch SpySweeper & select Results from the left pane
Click the 'Session Log' tab & choose Save to File to create a log.

Post that in your next reply along with a new HJT log.
 

·
Registered
Joined
·
5 Posts
Discussion Starter #7
Logfile of HijackThis v1.99.1
Scan saved at 20:41:52, on 06/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\RevoTask.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Nebula\DigiTV\DigiSvc.exe
C:\Program Files\UltraMon\UltraMon.exe
C:\Program Files\StartBarTicker\StartBarTicker.exe
C:\Program Files\UltraMon\UltraMonTaskbar.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://uk.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.muathe.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://uk.search.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...k/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://uk.search.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.muathe.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://uk.search.yahoo.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINDOWS\System32\RevoTask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [StartBarTicker] "C:\Program Files\StartBarTicker\StartBarTicker.exe"
O4 - HKCU\..\Run: [MrkWhoIs] "C:\Program Files\StartBarTicker\market.exe"
O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe
O4 - Startup: StartBarTicker.lnk = C:\Program Files\StartBarTicker\StartBarTicker.exe
O4 - Global Startup: Digisvc.lnk = C:\Program Files\Nebula\DigiTV\DigiSvc.exe
O4 - Global Startup: UltraMon.lnk = C:\Program Files\UltraMon\UltraMon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123255941155
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe







********
19:39: | Start of Session, 06 November 2005 |
19:39: Spy Sweeper started
19:39: Sweep initiated using definitions version 567
19:39: Starting Memory Sweep
19:39: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:39: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:40: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:40: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:40: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:40: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:42: Found Adware: icannnews
19:42: Detected running threat: C:\WINDOWS\system32\dvprov.dll (ID = 83)
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:43: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:52: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:52: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:52: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:52: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:53: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:53: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:53: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:53: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:53: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:53: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:53: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:53: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:55: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:55: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:55: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:55: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:03: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:03: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:03: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:03: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:03: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:03: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:03: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:03: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:05: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:06: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:06: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:06: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:06: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:06: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:06: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:06: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:06: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:07: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:08: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:09: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:09: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:09: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:09: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:09: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:09: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:09: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:09: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:10: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:11: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:12: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:13: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:14: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:14: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:14: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:14: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:14: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:14: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:14: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:14: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:15: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:15: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:15: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:15: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:15: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:15: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:15: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:15: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:16: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:17: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:17: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:17: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:17: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:17: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:17: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:17: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:17: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:18: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:19: Detected running threat: C:\WINDOWS\system32\o884lilq18qe.dll (ID = 83)
20:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:19: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: Memory Sweep Complete, Elapsed Time: 00:41:40
20:21: Starting Registry Sweep
20:21: Registry Sweep Complete, Elapsed Time:00:00:10
20:21: Starting Cookie Sweep
20:21: Found Spy Cookie: a cookie
20:21: russel [email protected][1].txt (ID = 2027)
20:21: Found Spy Cookie: touchclarity cookie
20:21: russel [email protected][1].txt (ID = 3566)
20:21: Found Spy Cookie: adjuggler cookie
20:21: russel [email protected][1].txt (ID = 2071)
20:21: Cookie Sweep Complete, Elapsed Time: 00:00:00
20:21: Starting File Sweep
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:22: Found Adware: look2me
20:22: appwrap[1].exe (ID = 65739)
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:23: Found Adware: ist yoursitebar
20:23: crack.exe (ID = 144585)
20:23: Found Adware: targetsaver
20:23: glf19cglf19c.exe (ID = 166444)
20:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:24: appwrap[1].exe (ID = 65721)
20:24: bw2.com (ID = 65721)
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:27: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:27: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:27: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:27: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:30: appwrap[2].exe (ID = 65722)
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:30: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: File Sweep Complete, Elapsed Time: 00:11:06
20:32: Full Sweep has completed. Elapsed time 00:13:23
20:32: Traces Found: 11
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:34: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:34: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:34: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:34: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:34: Removal process initiated
20:34: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:34: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:34: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:34: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:34: Quarantining All Traces: icannnews
20:34: icannnews is in use. It will be removed on reboot.
20:34: C:\WINDOWS\system32\dvprov.dll is in use. It will be removed on reboot.
20:34: C:\WINDOWS\system32\o884lilq18qe.dll is in use. It will be removed on reboot.
20:34: Quarantining All Traces: look2me
20:34: Quarantining All Traces: ist yoursitebar
20:34: Quarantining All Traces: targetsaver
20:34: Quarantining All Traces: a cookie
20:34: Quarantining All Traces: adjuggler cookie
20:34: Quarantining All Traces: touchclarity cookie
20:34: Warning: Launched explorer.exe
20:34: Warning: Quarantine process could not restart Explorer.
20:35: Preparing to restart your computer. Please wait...
20:35: Removal process completed. Elapsed time 00:00:43
********
19:19: | Start of Session, 06 November 2005 |
19:19: Spy Sweeper started
19:19: Sweep initiated using definitions version 567
19:19: Starting Memory Sweep
19:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:19: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:19: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:20: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:20: Found Adware: icannnews
19:20: Detected running threat: C:\WINDOWS\system32\dnn6015se.dll (ID = 83)
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: Detected running threat: C:\WINDOWS\system32\npevent.dll (ID = 83)
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: Sweep Canceled
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:22: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: Memory Sweep Complete, Elapsed Time: 00:03:25
19:23: Traces Found: 2
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:23: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:34: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:34: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
********
 

·
Registered
Joined
·
1,462 Posts
Russel do me a favour, SpySweeper tends to miss about 3 files so go through the first instructions again:

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

If after the reboot the desktop icons dont dissappear or the log does not pop up then in the l2mfix folder double click the second.bat file to continue with the fix.
 
1 - 9 of 9 Posts
Status
Not open for further replies.
Top