Infected with Trojan.Agent/Gen-IEFake, Trojan.Agent/Gen-IExplorer[Fake] &Trojan.Agent/Gen-PEC

kschneider · February 8, 2012

Hi,

Last night sometime I came across this virus. I tried running Superantispyware, which found the virus and thought I deleted it, but the next morning the virus was back. Malwarebytes didn't recognize any viruses at all. Also when I was removing the viruses with SAS, I think I noticed that the virus was in the Malwarebytes file. Anyway, here are the two Attach and DDS logs. I GREATLY appreciate any help! Thank you in advance!

-Kayla

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24

Run by Kayla at 15:07:59 on 2012-02-08

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3894.1838 [GMT -6:00]

.

AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\PROGRA~2\AVG\AVG10\avgchsva.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_471277d5d45019ea\STacSV64.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\Hpservice.exe

C:\Program Files\WTouch\WTouchService.exe

C:\Windows\system32\vcsFPService.exe

C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisService.exe

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_471277d5d45019ea\AESTSr64.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe

C:\SwSetup\QuickWeb\QW.SYS\config\DVMExportService.exe

C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE

C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE

C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\Pen_Tablet.exe

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\Program Files (x86)\AVG\AVG10\avgnsa.exe

C:\Program Files (x86)\AVG\AVG10\avgemca.exe

C:\Windows\system32\conhost.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files\WTouch\WTouchUser.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\AVG\AVG10\avgtray.exe

C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

C:\Program Files (x86)\AVG Secure Search\vprot.exe

C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

C:\Windows\system32\WTablet\Pen_TabletUser.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\Pen_Tablet.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisTSR.exe

C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wuauclt.exe

C:\PROGRA~2\AVG\AVG10\avgrsa.exe

C:\Program Files (x86)\AVG\AVG10\avgcsrva.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\taskmgr.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\AVG\AVG10\avgscana.exe

C:\Windows\system32\conhost.exe

C:\Program Files (x86)\AVG\AVG10\avgcsrva.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\explorer.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local

mURLSearchHooks: H - No File

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: EgisPBIE Class: {7b51ccbe-4af9-44a6-bdab-d7f7e4c4e6f9} - C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisPBIE.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File

TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll

{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}

uRun: [EPSON NX125 NX127 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGA.EXE /FU "C:\Windows\TEMP\E_SC7B2.tmp" /EF "HKCU"

uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

mRun: [<NO NAME>]

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe

mRun: [VitaKeyTSR] C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisTSR.exe /run

mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot

mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

mRun: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

TCP: DhcpNameServer = 128.104.254.254 144.92.254.254

TCP: Interfaces\{9D241A6A-03D1-45D0-BA13-7443F604F1F4} : DhcpNameServer = 10.0.0.1

TCP: Interfaces\{9D241A6A-03D1-45D0-BA13-7443F604F1F4}\37F6D656478696E6763796D607C656 : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{9D241A6A-03D1-45D0-BA13-7443F604F1F4}\46C696E6B6 : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{9D241A6A-03D1-45D0-BA13-7443F604F1F4}\6657E696E636 : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{9D241A6A-03D1-45D0-BA13-7443F604F1F4}\6657E696E63613 : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{9D241A6A-03D1-45D0-BA13-7443F604F1F4}\932333 : DhcpNameServer = 24.196.64.53 68.115.71.53 24.159.193.40

TCP: Interfaces\{CD3C92F6-BAA6-41E8-99BD-3767231247D9} : DhcpNameServer = 128.104.254.254 144.92.254.254

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\10.0.6\ViProtocol.dll

LSA: Notification Packages = EgisPwdFilter EgisDSPwdFilter

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll

BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File

BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO-X64: EgisPBIE Class: {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisPBIE.dll

BHO-X64: EgisPBIE - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File

TB-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\10.0.0.7\AVG Secure Search_toolbar.dll

mRun-x64: [(Default)]

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe

mRun-x64: [VitaKeyTSR] C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisTSR.exe /run

mRun-x64: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot

mRun-x64: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

mRun-x64: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12

IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\

FF - prefs.js: browser.startup.homepage - google.com

FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B57b90192-5921-4eb5-96ce-6bdd42bb2d41%7D&mid=32621f2af53645499e407e14a020966a-04d5f14531e0e027ade46568425df058191b9a88&ds=AVG&v=9.0.0.18.1〈=us&pr=fr&d=2011-12-13%2014%3A46%3A05&sap=ku&q=

FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff10.dll

FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff4.dll

FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff5.dll

FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff6.dll

FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff7.dll

FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff8.dll

FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff9.dll

FF - component: C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\FFExt\components\EgisPBFF.dll

FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll

FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordlegacyext.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

FF - Ext: SimplePass Online Accounts Extension : {41ecbc0b-34d5-4cd4-935f-253a30e2cb7e} - C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\FFExt

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - C:\Program Files (x86)\AVG\AVG10\Firefox4

FF - Ext: AVG Security Toolbar: avg@toolbar - C:\ProgramData\AVG Secure Search\9.0.0.18

.

---- FIREFOX POLICIES ----

FF - user.js: network.protocol-handler.warn-external.dnupdate - false

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys --> C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [?]

R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?]

R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]

R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?]

R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?]

R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?]

R1 DVMIO;DeviceVM IO Service;C:\Windows\system32\DRIVERS\dvmio.sys --> C:\Windows\system32\DRIVERS\dvmio.sys [?]

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752]

R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-9-16 169312]

R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_471277d5d45019ea\AESTSr64.exe [2009-3-3 89600]

R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2012-1-31 7391072]

R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [2011-2-8 269520]

R2 CinemaNow Service;CinemaNow Service;C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe [2010-2-26 127984]

R2 DvmMDES;DeviceVM Meta Data Export Service;C:\SwSetup\QuickWeb\QW.SYS\config\DVMExportService.exe [2010-3-31 338168]

R2 EgisTec Service;EgisTec Service;C:\Program Files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisService.exe [2010-2-4 689008]

R2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [2010-8-30 166400]

R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2010-8-30 128512]

R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2009-12-16 102968]

R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe --> C:\Windows\system32\Hpservice.exe [?]

R2 HPWMISVC;HPWMISVC;C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-1-18 20480]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-7-20 13336]

R2 TabletServicePen;TabletServicePen;C:\Windows\system32\Pen_Tablet.exe --> C:\Windows\system32\Pen_Tablet.exe [?]

R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-7-20 2320920]

R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 1799472]

R2 vToolbarUpdater;vToolbarUpdater;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe [2012-1-19 909152]

R2 WTouchService;WTouch Service;C:\Program Files\WTouch\WTouchService.exe [2011-11-23 127272]

R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys --> C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [?]

R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys --> C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [?]

R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]

R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 Impcd;Impcd;C:\Windows\system32\DRIVERS\Impcd.sys --> C:\Windows\system32\DRIVERS\Impcd.sys [?]

R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]

S3 AmUStor;AM USB Stroage Driver;C:\Windows\system32\drivers\AmUStor.SYS --> C:\Windows\system32\drivers\AmUStor.SYS [?]

S3 AVG Security Toolbar Service;AVG Security Toolbar Service;C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-6-2 167264]

S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]

S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]

S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]

S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 wacmoumonitor;Wacom Mode Helper;C:\Windows\system32\DRIVERS\wacmoumonitor.sys --> C:\Windows\system32\DRIVERS\wacmoumonitor.sys [?]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]

.

=============== Created Last 30 ================

.

2012-01-26 18:46:59 -------- d-----w- C:\Program Files\R

2012-01-16 02:57:25 -------- d-----w- C:\Users\Kayla\AppData\Roaming\WTablet

2012-01-16 02:57:21 -------- d-----w- C:\Users\Kayla\AppData\Roaming\WTouch

2012-01-13 22:29:23 -------- d-----w- C:\Users\Kayla\AppData\Roaming\Malwarebytes

2012-01-13 22:29:12 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-01-13 22:29:12 -------- d-----w- C:\ProgramData\Malwarebytes

2012-01-13 22:29:11 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-01-10 00:57:50 -------- d-----w- C:\Users\Kayla\AppData\Roaming\inkscape

2012-01-10 00:53:10 -------- d-----w- C:\Program Files (x86)\Inkscape

.

==================== Find3M ====================

.

2011-11-24 00:13:55 129784 ------w- C:\Windows\SysWow64\pxafs.dll

2011-11-24 00:13:55 116472 ------w- C:\Windows\SysWow64\pxcpyi64.exe

2011-11-24 00:13:55 10488 ------w- C:\Windows\System32\drivers\cdralw2k.sys

2011-11-24 00:13:55 10488 ------w- C:\Windows\System32\drivers\cdr4_xp.sys

2011-11-24 00:13:54 52856 ------w- C:\Windows\System32\drivers\PxHlpa64.sys

2011-11-24 00:13:54 118520 ------w- C:\Windows\SysWow64\pxinsi64.exe

.

============= FINISH: 15:08:51.45 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 8/13/2010 6:43:34 PM

System Uptime: 2/8/2012 2:28:47 PM (1 hours ago)

.

Motherboard: Hewlett-Packard | | 146A

Processor: Intel® Core i5 CPU M 430 @ 2.27GHz | CPU | 1314/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 447 GiB total, 377.666 GiB free.

D: is FIXED (NTFS) - 18 GiB total, 2.666 GiB free.

E: is FIXED (FAT32) - 0 GiB total, 0.091 GiB free.

F: is CDROM (UDF)

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP88: 12/9/2011 1:22:39 PM - Scheduled Checkpoint

RP89: 12/17/2011 1:31:29 PM - Scheduled Checkpoint

RP90: 12/18/2011 8:10:19 PM - HPSF Restore Point

RP91: 12/31/2011 2:01:31 AM - Scheduled Checkpoint

RP92: 1/7/2012 11:06:08 PM - Scheduled Checkpoint

RP93: 1/15/2012 12:00:04 AM - Scheduled Checkpoint

RP94: 1/23/2012 2:28:07 AM - Scheduled Checkpoint

RP96: 1/30/2012 4:58:36 PM - Scheduled Checkpoint

RP97: 2/6/2012 6:18:59 PM - Scheduled Checkpoint

.

==== Installed Programs ======================

.

7-Zip 9.20

Acrobat.com

ActiveCheck component for HP Active Support Library

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Photoshop Elements 7.0

Adobe Reader 9.3.3 MUI

Adobe Shockwave Player

AIM 7

Alcor Micro USB Card Reader

America's Army

Apple Application Support

Apple Software Update

Bamboo

CinemaNow Media Manager

Compatibility Pack for the 2007 Office system

ConnectUO 2.0

CyberLink DVD Suite

Download Updater (AOL LLC)

Dungeon Keeper 2

DVD Menu Pack for HP MediaSmart Video

EA Download Manager

Epson Event Manager

EPSON Scan

ESU for Microsoft Windows 7

GIMP 2.6.10

HP Advisor

HP Customer Experience Enhancements

HP MediaSmart CinemaNow 2.0

HP MediaSmart DVD

HP MediaSmart Internet TV

HP MediaSmart Music

HP MediaSmart Photo

HP MediaSmart Video

HP MediaSmart Webcam

HP MediaSmart/TouchSmart Netflix

HP Photo Creations

HP QuickWeb Installer

HP Setup

HP SimplePass Identity Protection

HP Software Framework

HP Support Assistant

HP Update

HP User Guides 0207

HPAsset component for HP Active Support Library

IDT Audio

Inkscape 0.48.2

Intel® Control Center

Intel® Graphics Media Accelerator Driver

Intel® Management Engine Components

Intel® Rapid Storage Technology

Java Auto Updater

Java 6 Update 24

Junk Mail filter update

LabelPrint

Malwarebytes Anti-Malware version 1.60.1.1000

Microsoft Age of Empires II

Microsoft Age of Empires II: The Conquerors Expansion

Microsoft Choice Guard

Microsoft Office Excel MUI (English) 2007

Microsoft Office Home and Student 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Suite Activation Assistant

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Works

Microsoft WSE 3.0 Runtime

mIRC

Movie Theme Pack for HP MediaSmart Video

Mozilla Firefox (3.6.26)

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Norton Online Backup

OpenOffice.org 3.2

PhotoNow!

Power2Go

PowerDirector

QuickTime

RealNetworks - Microsoft Visual C++ 2008 Runtime

RealPlayer

Realtek Ethernet Controller Driver For Windows 7

RealUpgrade 1.1

Recovery Manager

Roxio CinemaNow 2.0

Soldat 1.6.0

Soldat 1.6.1

Soldat 1.6.2

The Movies

The Sims™ 3

Ultima Online: Mondain's Legacy

Update for Microsoft Office Word 2007 (KB974631)

Update for Office 2007 (KB934528)

Ventrilo Client

Visual C++ 8.0 Runtime Setup Package (x64)

Visual Studio 2008 x64 Redistributables

Warcraft III

Warcraft III: All Products

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Mail

Windows Live Messenger

Windows Live Photo Gallery

Windows Live Sync

Windows Live Upload Tool

Windows Live Writer

.

==== End Of File ===========================

Maniac · February 9, 2012

Hello Kayla and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Please open SUPERAntiSpyware and click on View Scan Logs. Post the latest log file to see exactly what is the problem.

kschneider · February 9, 2012

Hi Maniac,

Thanks for the quick response! Heres my SAS log from 2-7-12 and 2-6-12

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 02/07/2012 at 00:54 AM

Application Version : 4.49.1000

Core Rules Database Version : 6633

Trace Rules Database Version: 4445

Scan type : Complete Scan

Total Scan Time : 00:59:32

Memory items scanned : 511

Memory threats detected : 0

Registry items scanned : 14352

Registry threats detected : 0

File items scanned : 33673

File threats detected : 241

Adware.Tracking Cookie

C:\Users\Kayla\AppData\Roaming\Microsoft\Windows\Cookies\kayla@yieldmanager[1].txt

.realmedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.invitemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.doubleclick.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.realmedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.invitemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.serving-sys.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.apmebf.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.mediaplex.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.legolas-media.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

ad.yieldmanager.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.interclick.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.a1.interclick.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.ads.pointroll.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.pointroll.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.ads.pointroll.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.a1.interclick.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.pubads.g.doubleclick.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.dmtracker.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

ad.yieldmanager.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.revsci.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.adbrite.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.adfarm1.adition.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

ad2.adfarm1.adition.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.atdmt.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.googleads.g.doubleclick.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.yieldmanager.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.adbrite.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.www.burstnet.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.casalemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.traveladvertising.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.zedo.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.r1-ads.ace.advertising.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.advertising.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.interclick.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.amazon-adsystem.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.media6degrees.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.lucidmedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.ru4.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.advertising.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.at.atwola.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.advertising.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.ru4.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.advertising.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.zedo.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.casalemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.ru4.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.avgtechnologies.112.2o7.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.tribalfusion.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.casalemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.burstnet.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.adserver.adtechus.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.lfstmedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.media.adfrontiers.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.imrworldwide.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.adserver.adtechus.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.revsci.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.fastclick.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.statcounter.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.casalemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.invitemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.insightexpressai.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.pro-market.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

www.burstnet.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.adxpose.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.technoratimedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.zedo.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.revsci.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

www.googleadservices.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.nextag.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.zedo.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.revsci.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.viacom.adbureau.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.2o7.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.collective-media.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.steelhousemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.media6degrees.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.mediaplex.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.media6degrees.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.usatoday1.112.2o7.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.revsci.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.solvemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.trafficmp.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.interclick.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.akamai.interclickproxy.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.questionmarket.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.ads.pointroll.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.serving-sys.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.bs.serving-sys.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.casalemedia.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.specificclick.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.apmebf.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.adbrite.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.atdmt.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.h.atdmt.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.atdmt.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.h.atdmt.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.c.atdmt.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

citi.bridgetrack.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.at.atwola.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.linksynergy.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.demandwarecrocs.112.2o7.net [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.traveladvertising.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.account.woot.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.tacoda.at.atwola.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.at.atwola.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.tacoda.at.atwola.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]

.ar.atwola.com [ C:\Users\Kayla\AppData\Roaming\Mozilla\Firefox\Profiles\6e404xgr.default\cookies.sqlite ]