Author Topic: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon  (Read 1453 times)

0 Members and 2 Guests are viewing this topic.

Offline Blue55

  • Full Member
  • ***
  • Posts: 104
Re: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon
« Reply #15 on: January 30, 2011, 04:55:37 AM »
Not good.

MSE's complete scan finished. It found and removed Rouge:Win32/FakeVimes ...Again.
It supposedly removed it a few hours ago but it's Baaacck. And off again. Yeah right. Confidence is low.
Something is here that can keep putting it back on.

Oops, I had MSE on when I started Combos install, which it did complain about, but continued anyway.
I tried to stop the real time on MSE but it did an non-responsive on me.
Combo seemed to finish OK. Still no reaction from MSE. Restart.
After restart, MSE was off so it must have turned off before it locked up and was probably off for most of Combo's work. Apparently good enough. I tried to uninstall Combo again but it said it wasn't there.
Turned MSE back on.

2 New Folders, apparently empty, were on the desktop which seemed to cooperate about deleting.
A settings.dat is on the desktop. It appears to be empty inside. Can I try to delete this?
An Allowed.txt is on the desktop. Insides are posted below.
These worry me.

Also, tell me about C:/Qoobox
Should that be there ?

Now here's the real bad news:
It was running good. Nice and responsive. Nice and normal. Really. For a little while. I was so looking forward to wrapping this up. Really.
Over the last few hours, it is slowing down.  and Down.
More sluggish, response delays even on moving the pointer, uncalled for hard drive spinning but not constant ...yet, taking minutes to do the simplist of tasks like open explorer or navigate inside it. Taking almost a minute just to pop up the options on a right or left click over start before I can even ask for explorer.
I've seen this.

Something somewhere is putting something bad back on.


Welcome to the club on keeping these 2 straight.
I'm writing Everything down and putting every bit into the threads and I'm keeping a updated hard copy of the threads in my hands (with Laptop/Desktop and page numbers) and checking off and writing notes on them as I go.
Otherwise I would screw them up for sure.
As it is, the remembering to turn MSE off and turn it back on after off is no longer needed has tripped me up a touch. If that's my worst, I think I'm doing good.

Oh and Secunia is a great idea to what I'm sure would be been an ongoing issue. Thanks
- ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~
Contents of    Allowed.txt   on desktop

3832  3748  Checking:
3832  3748  o.aolcdn.com
3832  3748  StartCheck
3832  3748  Word:
3832  3748  search
3832  3748  TmpDomainName:
3832  3748  google;yahoo;msn;click;banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  google
3832  3748  TmpDomainName:
3832  3748  yahoo;msn;click;banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  yahoo
3832  3748  TmpDomainName:
3832  3748  msn;click;banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  msn
3832  3748  TmpDomainName:
3832  3748  click;banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  click
3832  3748  TmpDomainName:
3832  3748  banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  banner
3832  3748  TmpDomainName:
3832  3748  microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  microsoft
3832  3748  TmpDomainName:
3832  3748  live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  live
3832  3748  TmpDomainName:
3832  3748  
3832  3748  PosDot:
3832  3748  search;google;yahoo;msn;click;banner;microsoft;live;
3832  3748  Checking:
3832  3748  o.aolcdn.com
3832  3748  StartCheck
3832  3748  Word:
3832  3748  search
3832  3748  TmpDomainName:
3832  3748  google;yahoo;msn;click;banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  google
3832  3748  TmpDomainName:
3832  3748  yahoo;msn;click;banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  yahoo
3832  3748  TmpDomainName:
3832  3748  msn;click;banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  msn
3832  3748  TmpDomainName:
3832  3748  click;banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  click
3832  3748  TmpDomainName:
3832  3748  banner;microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  banner
3832  3748  TmpDomainName:
3832  3748  microsoft;live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  microsoft
3832  3748  TmpDomainName:
3832  3748  live;
3832  3748  PosDot:
3832  3748  Word:
3832  3748  live
3832  3748  TmpDomainName:
3832  3748  
3832  3748  PosDot:
3832  3748  search;google;yahoo;msn;click;banner;microsoft;live;
4028  3524  Checking:
4028  3524  www.google.com
4028  3524  StartCheck
4028  3524  Word:
4028  3524  search
4028  3524  TmpDomainName:
4028  3524  google;yahoo;msn;click;banner;microsoft;live;
4028  3524  PosDot:
4028  3524  Word:
4028  3524  google
4028  3524  TmpDomainName:
4028  3524  yahoo;msn;click;banner;microsoft;live;
4028  3524  PosDot:
4028  3524  search;google;yahoo;msn;click;banner;microsoft;live;
4028  3524  Checking:
4028  3524  www.google.com
4028  3524  StartCheck
4028  3524  Word:
4028  3524  search
4028  3524  TmpDomainName:
4028  3524  google;yahoo;msn;click;banner;microsoft;live;
4028  3524  PosDot:
4028  3524  Word:
4028  3524  google
4028  3524  TmpDomainName:
4028  3524  yahoo;msn;click;banner;microsoft;live;
4028  3524  PosDot:
4028  3524  search;google;yahoo;msn;click;banner;microsoft;live;
4028  2428  Checking:
4028  2428  www.google.com
4028  2428  StartCheck
4028  2428  Word:
4028  2428  search
4028  2428  TmpDomainName:
4028  2428  google;yahoo;msn;click;banner;microsoft;live;
4028  2428  PosDot:
4028  2428  Word:
4028  2428  google
4028  2428  TmpDomainName:
4028  2428  yahoo;msn;click;banner;microsoft;live;
4028  2428  PosDot:
4028  2428  search;google;yahoo;msn;click;banner;microsoft;live;
4028  160  Checking:
4028  160  www.castingaudition.com
4028  160  StartCheck
4028  160  Word:
4028  160  search
4028  160  TmpDomainName:
4028  160  google;yahoo;msn;click;banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  google
4028  160  TmpDomainName:
4028  160  yahoo;msn;click;banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  yahoo
4028  160  TmpDomainName:
4028  160  msn;click;banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  msn
4028  160  TmpDomainName:
4028  160  click;banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  click
4028  160  TmpDomainName:
4028  160  banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  banner
4028  160  TmpDomainName:
4028  160  microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  microsoft
4028  160  TmpDomainName:
4028  160  live;
4028  160  PosDot:
4028  160  Word:
4028  160  live
4028  160  TmpDomainName:
4028  160  
4028  160  PosDot:
4028  160  search;google;yahoo;msn;click;banner;microsoft;live;
4028  160  Checking:
4028  160  www.castingaudition.com
4028  160  StartCheck
4028  160  Word:
4028  160  search
4028  160  TmpDomainName:
4028  160  google;yahoo;msn;click;banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  google
4028  160  TmpDomainName:
4028  160  yahoo;msn;click;banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  yahoo
4028  160  TmpDomainName:
4028  160  msn;click;banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  msn
4028  160  TmpDomainName:
4028  160  click;banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  click
4028  160  TmpDomainName:
4028  160  banner;microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  banner
4028  160  TmpDomainName:
4028  160  microsoft;live;
4028  160  PosDot:
4028  160  Word:
4028  160  microsoft
4028  160  TmpDomainName:
4028  160  live;
4028  160  PosDot:
4028  160  Word:
4028  160  live
4028  160  TmpDomainName:
4028  160  
4028  160  PosDot:
4028  160  search;google;yahoo;msn;click;banner;microsoft;live;
4028  160  Checking:
4028  160  www.castingaudition.com
4028  160  StartCheck
4028  160  Word:
4028  160  search
4028  160  TmpDomainName:
4028  160  google;yahoo;msn;click;banner;microsoft;live;www.castingaudition.com;
4028  160  PosDot:
4028  160  Word:
4028  160  google
4028  160  TmpDomainName:
4028  160  yahoo;msn;click;banner;microsoft;live;www.castingaudition.com;
4028  160  PosDot:
4028  160  Word:
4028  160  yahoo
4028  160  TmpDomainName:
4028  160  msn;click;banner;microsoft;live;www.castingaudition.com;
4028  160  PosDot:
4028  160  Word:
4028  160  msn
4028  160  TmpDomainName:
4028  160  click;banner;microsoft;live;www.castingaudition.com;
4028  160  PosDot:
4028  160  Word:
4028  160  click
4028  160  TmpDomainName:
4028  160  banner;microsoft;live;www.castingaudition.com;
4028  160  PosDot:
4028  160  Word:
4028  160  banner
4028  160  TmpDomainName:
4028  160  microsoft;live;www.castingaudition.com;
4028  160  PosDot:
4028  160  Word:
4028  160  microsoft
4028  160  TmpDomainName:
4028  160  live;www.castingaudition.com;
4028  160  PosDot:
4028  160  Word:
4028  160  live
4028  160  TmpDomainName:
4028  160  www.castingaudition.com;
4028  160  PosDot:
4028  160  Word:
4028  160  www.castingaudition.com
4028  160  TmpDomainName:
4028  160  
4028  160  PosDot:
4028  160  search;google;yahoo;msn;click;banner;microsoft;live;www.castingaudition.com;
4028  1700  Checking:
4028  1700  www.couponmountain.com
4028  1700  StartCheck
4028  1700  Word:
4028  1700  search
4028  1700  TmpDomainName:
4028  1700  google;yahoo;msn;click;banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  google
4028  1700  TmpDomainName:
4028  1700  yahoo;msn;click;banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  yahoo
4028  1700  TmpDomainName:
4028  1700  msn;click;banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  msn
4028  1700  TmpDomainName:
4028  1700  click;banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  click
4028  1700  TmpDomainName:
4028  1700  banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  banner
4028  1700  TmpDomainName:
4028  1700  microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  microsoft
4028  1700  TmpDomainName:
4028  1700  live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  live
4028  1700  TmpDomainName:
4028  1700  www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  www.castingaudition.com
4028  1700  TmpDomainName:
4028  1700  
4028  1700  PosDot:
4028  1700  search;google;yahoo;msn;click;banner;microsoft;live;www.castingaudition.com;
4028  1700  Checking:
4028  1700  www.couponmountain.com
4028  1700  StartCheck
4028  1700  Word:
4028  1700  search
4028  1700  TmpDomainName:
4028  1700  google;yahoo;msn;click;banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  google
4028  1700  TmpDomainName:
4028  1700  yahoo;msn;click;banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  yahoo
4028  1700  TmpDomainName:
4028  1700  msn;click;banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  msn
4028  1700  TmpDomainName:
4028  1700  click;banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  click
4028  1700  TmpDomainName:
4028  1700  banner;microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  banner
4028  1700  TmpDomainName:
4028  1700  microsoft;live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  microsoft
4028  1700  TmpDomainName:
4028  1700  live;www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  live
4028  1700  TmpDomainName:
4028  1700  www.castingaudition.com;
4028  1700  PosDot:
4028  1700  Word:
4028  1700  www.castingaudition.com
4028  1700  TmpDomainName:
4028  1700  
4028  1700  PosDot:
4028  1700  search;google;yahoo;msn;click;banner;microsoft;live;www.castingaudition.com;
3956  3960  Checking:
3956  3960  search.aol.com
3956  3960  StartCheck
3956  3960  Word:
3956  3960  search
3956  3960  TmpDomainName:
3956  3960  google;yahoo;msn;click;banner;microsoft;live;
3956  3960  PosDot:
3956  3960  search;google;yahoo;msn;click;banner;microsoft;live;
1284  2104  Checking:
1284  2104  aim.search.aol.com
1284  2104  StartCheck
1284  2104  Word:
1284  2104  search
1284  2104  TmpDomainName:
1284  2104  google;yahoo;msn;click;banner;microsoft;live;
1284  2104  PosDot:
1284  2104  search;google;yahoo;msn;click;banner;microsoft;live;
3640  3876  Checking:
3640  3876  ad.doubleclick.net
3640  3876  StartCheck
3640  3876  Word:
3640  3876  search
3640  3876  TmpDomainName:
3640  3876  google;yahoo;msn;click;banner;microsoft;live;
3640  3876  PosDot:
3640  3876  Word:
3640  3876  google
3640  3876  TmpDomainName:
3640  3876  yahoo;msn;click;banner;microsoft;live;
3640  3876  PosDot:
3640  3876  Word:
3640  3876  yahoo
3640  3876  TmpDomainName:
3640  3876  msn;click;banner;microsoft;live;
3640  3876  PosDot:
3640  3876  Word:
3640  3876  msn
3640  3876  TmpDomainName:
3640  3876  click;banner;microsoft;live;
3640  3876  PosDot:
3640  3876  Word:
3640  3876  click
3640  3876  TmpDomainName:
3640  3876  banner;microsoft;live;
3640  3876  PosDot:
3640  3876  search;google;yahoo;msn;click;banner;microsoft;live;
4040  2948  Checking:
4040  2948  m.www.yahoo.com
4040  2948  StartCheck
4040  2948  Word:
4040  2948  search
4040  2948  TmpDomainName:
4040  2948  google;yahoo;msn;click;banner;microsoft;live;
4040  2948  PosDot:
4040  2948  Word:
4040  2948  google
4040  2948  TmpDomainName:
4040  2948  yahoo;msn;click;banner;microsoft;live;
4040  2948  PosDot:
4040  2948  Word:
4040  2948  yahoo
4040  2948  TmpDomainName:
4040  2948  msn;click;banner;microsoft;live;
4040  2948  PosDot:
4040  2948  search;google;yahoo;msn;click;banner;microsoft;live;
4040  3592  Checking:
4040  3592  search.aol.com
4040  3592  StartCheck
4040  3592  Word:
4040  3592  search
4040  3592  TmpDomainName:
4040  3592  google;yahoo;msn;click;banner;microsoft;live;
4040  3592  PosDot:
4040  3592  search;google;yahoo;msn;click;banner;microsoft;live;
4040  2948  Checking:
4040  2948  slirsredirect.search.aol.com
4040  2948  StartCheck
4040  2948  Word:
4040  2948  search
4040  2948  TmpDomainName:
4040  2948  google;yahoo;msn;click;banner;microsoft;live;
4040  2948  PosDot:
4040  2948  search;google;yahoo;msn;click;banner;microsoft;live;
3640  2940  Checking:
3640  2940  aim.search.aol.com
3640  2940  StartCheck
3640  2940  Word:
3640  2940  search
3640  2940  TmpDomainName:
3640  2940  google;yahoo;msn;click;banner;microsoft;live;
3640  2940  PosDot:
3640  2940  search;google;yahoo;msn;click;banner;microsoft;live;
3640  2940  Checking:
3640  2940  m.www.yahoo.com
3640  2940  StartCheck
3640  2940  Word:
3640  2940  search
3640  2940  TmpDomainName:
3640  2940  google;yahoo;msn;click;banner;microsoft;live;
3640  2940  PosDot:
3640  2940  Word:
3640  2940  google
3640  2940  TmpDomainName:
3640  2940  yahoo;msn;click;banner;microsoft;live;
3640  2940  PosDot:
3640  2940  Word:
3640  2940  yahoo
3640  2940  TmpDomainName:
3640  2940  msn;click;banner;microsoft;live;
3640  2940  PosDot:
3640  2940  search;google;yahoo;msn;click;banner;microsoft;live;
576  3528  Checking:
576  3528  cdn.i-dressup.com
576  3528  StartCheck
576  3528  Word:
576  3528  search
576  3528  TmpDomainName:
576  3528  google;yahoo;msn;click;banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  google
576  3528  TmpDomainName:
576  3528  yahoo;msn;click;banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  yahoo
576  3528  TmpDomainName:
576  3528  msn;click;banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  msn
576  3528  TmpDomainName:
576  3528  click;banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  click
576  3528  TmpDomainName:
576  3528  banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  banner
576  3528  TmpDomainName:
576  3528  microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  microsoft
576  3528  TmpDomainName:
576  3528  live;
576  3528  PosDot:
576  3528  Word:
576  3528  live
576  3528  TmpDomainName:
576  3528  
576  3528  PosDot:
576  3528  search;google;yahoo;msn;click;banner;microsoft;live;
576  3528  Checking:
576  3528  cdn.i-dressup.com
576  3528  StartCheck
576  3528  Word:
576  3528  search
576  3528  TmpDomainName:
576  3528  google;yahoo;msn;click;banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  google
576  3528  TmpDomainName:
576  3528  yahoo;msn;click;banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  yahoo
576  3528  TmpDomainName:
576  3528  msn;click;banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  msn
576  3528  TmpDomainName:
576  3528  click;banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  click
576  3528  TmpDomainName:
576  3528  banner;microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  banner
576  3528  TmpDomainName:
576  3528  microsoft;live;
576  3528  PosDot:
576  3528  Word:
576  3528  microsoft
576  3528  TmpDomainName:
576  3528  live;
576  3528  PosDot:
576  3528  Word:
576  3528  live
576  3528  TmpDomainName:
576  3528  
576  3528  PosDot:
576  3528  search;google;yahoo;msn;click;banner;microsoft;live;
576  2196  Checking:
576  2196  www.i-dressup.com
576  2196  StartCheck
576  2196  Word:
576  2196  search
576  2196  TmpDomainName:
576  2196  google;yahoo;msn;click;banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  google
576  2196  TmpDomainName:
576  2196  yahoo;msn;click;banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  yahoo
576  2196  TmpDomainName:
576  2196  msn;click;banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  msn
576  2196  TmpDomainName:
576  2196  click;banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  click
576  2196  TmpDomainName:
576  2196  banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  banner
576  2196  TmpDomainName:
576  2196  microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  microsoft
576  2196  TmpDomainName:
576  2196  live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  live
576  2196  TmpDomainName:
576  2196  cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  cdn.i-dressup.com
576  2196  TmpDomainName:
576  2196  
576  2196  PosDot:
576  2196  search;google;yahoo;msn;click;banner;microsoft;live;cdn.i-dressup.com;
576  2196  Checking:
576  2196  www.i-dressup.com
576  2196  StartCheck
576  2196  Word:
576  2196  search
576  2196  TmpDomainName:
576  2196  google;yahoo;msn;click;banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  google
576  2196  TmpDomainName:
576  2196  yahoo;msn;click;banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  yahoo
576  2196  TmpDomainName:
576  2196  msn;click;banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  msn
576  2196  TmpDomainName:
576  2196  click;banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  click
576  2196  TmpDomainName:
576  2196  banner;microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  banner
576  2196  TmpDomainName:
576  2196  microsoft;live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  microsoft
576  2196  TmpDomainName:
576  2196  live;cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  live
576  2196  TmpDomainName:
576  2196  cdn.i-dressup.com;
576  2196  PosDot:
576  2196  Word:
576  2196  cdn.i-dressup.com
576  2196  TmpDomainName:
576  2196  
576  2196  PosDot:
576  2196  search;google;yahoo;msn;click;banner;microsoft;live;cdn.i-dressup.com;
3356  2596  Checking:
3356  2596  www.patriotprintworks.com
3356  2596  StartCheck
3356  2596  Word:
3356  2596  search
3356  2596  TmpDomainName:
3356  2596  google;yahoo;msn;click;banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  google
3356  2596  TmpDomainName:
3356  2596  yahoo;msn;click;banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  yahoo
3356  2596  TmpDomainName:
3356  2596  msn;click;banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  msn
3356  2596  TmpDomainName:
3356  2596  click;banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  click
3356  2596  TmpDomainName:
3356  2596  banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  banner
3356  2596  TmpDomainName:
3356  2596  microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  microsoft
3356  2596  TmpDomainName:
3356  2596  live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  live
3356  2596  TmpDomainName:
3356  2596  
3356  2596  PosDot:
3356  2596  search;google;yahoo;msn;click;banner;microsoft;live;
3356  2596  Checking:
3356  2596  www.patriotprintworks.com
3356  2596  StartCheck
3356  2596  Word:
3356  2596  search
3356  2596  TmpDomainName:
3356  2596  google;yahoo;msn;click;banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  google
3356  2596  TmpDomainName:
3356  2596  yahoo;msn;click;banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  yahoo
3356  2596  TmpDomainName:
3356  2596  msn;click;banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  msn
3356  2596  TmpDomainName:
3356  2596  click;banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  click
3356  2596  TmpDomainName:
3356  2596  banner;microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  banner
3356  2596  TmpDomainName:
3356  2596  microsoft;live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  microsoft
3356  2596  TmpDomainName:
3356  2596  live;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  live
3356  2596  TmpDomainName:
3356  2596  
3356  2596  PosDot:
3356  2596  search;google;yahoo;msn;click;banner;microsoft;live;
3356  2596  Checking:
3356  2596  www.patriotprintworks.com
3356  2596  StartCheck
3356  2596  Word:
3356  2596  search
3356  2596  TmpDomainName:
3356  2596  google;yahoo;msn;click;banner;microsoft;live;www.patriotprintworks.com;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  google
3356  2596  TmpDomainName:
3356  2596  yahoo;msn;click;banner;microsoft;live;www.patriotprintworks.com;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  yahoo
3356  2596  TmpDomainName:
3356  2596  msn;click;banner;microsoft;live;www.patriotprintworks.com;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  msn
3356  2596  TmpDomainName:
3356  2596  click;banner;microsoft;live;www.patriotprintworks.com;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  click
3356  2596  TmpDomainName:
3356  2596  banner;microsoft;live;www.patriotprintworks.com;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  banner
3356  2596  TmpDomainName:
3356  2596  microsoft;live;www.patriotprintworks.com;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  microsoft
3356  2596  TmpDomainName:
3356  2596  live;www.patriotprintworks.com;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  live
3356  2596  TmpDomainName:
3356  2596  www.patriotprintworks.com;
3356  2596  PosDot:
3356  2596  Word:
3356  2596  www.patriotprintworks.com
3356  2596  TmpDomainName:
3356  2596  
3356  2596  PosDot:
3356  2596  search;google;yahoo;msn;click;banner;microsoft;live;www.patriotprintworks.com;
3964  2356  Checking:
3964  2356  www.yahoo.com
3964  2356  StartCheck
3964  2356  Word:
3964  2356  search
3964  2356  TmpDomainName:
3964  2356  google;yahoo;msn;click;banner;microsoft;live;
3964  2356  PosDot:
3964  2356  Word:
3964  2356  google
3964  2356  TmpDomainName:
3964  2356  yahoo;msn;click;banner;microsoft;live;
3964  2356  PosDot:
3964  2356  Word:
3964  2356  yahoo
3964  2356  TmpDomainName:
3964  2356  msn;click;banner;microsoft;live;
3964  2356  PosDot:
3964  2356  search;google;yahoo;msn;click;banner;microsoft;live;
3964  840  Checking:
3964  840  www.yahoo.com
3964  840  StartCheck
3964  840  Word:
3964  840  search
3964  840  TmpDomainName:
3964  840  google;yahoo;msn;click;banner;microsoft;live;
3964  840  PosDot:
3964  840  Word:
3964  840  google
3964  840  TmpDomainName:
3964  840  yahoo;msn;click;banner;microsoft;live;
3964  840  PosDot:
3964  840  Word:
3964  840  yahoo
3964  840  TmpDomainName:
3964  840  msn;click;banner;microsoft;live;
3964  840  PosDot:
3964  840  search;google;yahoo;msn;click;banner;microsoft;live;
1440  2908  Checking:
1440  2908  www.yahoo.com
1440  2908  StartCheck
1440  2908  Word:
1440  2908  search
1440  2908  TmpDomainName:
1440  2908  google;yahoo;msn;click;banner;microsoft;live;
1440  2908  PosDot:
1440  2908  Word:
1440  2908  google
1440  2908  TmpDomainName:
1440  2908  yahoo;msn;click;banner;microsoft;live;
1440  2908  PosDot:
1440  2908  Word:
1440  2908  yahoo
1440  2908  TmpDomainName:
1440  2908  msn;click;banner;microsoft;live;
1440  2908  PosDot:
1440  2908  search;google;yahoo;msn;click;banner;microsoft;live;
3964  3312  Checking:
3964  3312  l.yimg.com
3964  3312  StartCheck
3964  3312  Word:
3964  3312  search
3964  3312  TmpDomainName:
3964  3312  google;yahoo;msn;click;banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  google
3964  3312  TmpDomainName:
3964  3312  yahoo;msn;click;banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  yahoo
3964  3312  TmpDomainName:
3964  3312  msn;click;banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  msn
3964  3312  TmpDomainName:
3964  3312  click;banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  click
3964  3312  TmpDomainName:
3964  3312  banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  banner
3964  3312  TmpDomainName:
3964  3312  microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  microsoft
3964  3312  TmpDomainName:
3964  3312  live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  live
3964  3312  TmpDomainName:
3964  3312  
3964  3312  PosDot:
3964  3312  search;google;yahoo;msn;click;banner;microsoft;live;
3964  3312  Checking:
3964  3312  l.yimg.com
3964  3312  StartCheck
3964  3312  Word:
3964  3312  search
3964  3312  TmpDomainName:
3964  3312  google;yahoo;msn;click;banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  google
3964  3312  TmpDomainName:
3964  3312  yahoo;msn;click;banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  yahoo
3964  3312  TmpDomainName:
3964  3312  msn;click;banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  msn
3964  3312  TmpDomainName:
3964  3312  click;banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  click
3964  3312  TmpDomainName:
3964  3312  banner;microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  banner
3964  3312  TmpDomainName:
3964  3312  microsoft;live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  microsoft
3964  3312  TmpDomainName:
3964  3312  live;
3964  3312  PosDot:
3964  3312  Word:
3964  3312  live
3964  3312  TmpDomainName:
3964  3312  
3964  3312  PosDot:
3964  3312  search;google;yahoo;msn;click;banner;microsoft;live;
1440  748  Checking:
1488  3028  Word:
1488  3028  Word:
1440  748  google;yahoo;msn;click;banner;microsoft;live;
1488  3028  google
1440  748  PosDot:
1488  3028  TmpDomainName:
1440  748  Word:
1488  3028  yahoo;msn;click;banner;microsoft;live;
1440  748  google
1488  3028  PosDot:
1440  748  TmpDomainName:
1488  3028  Word:
1440  748  yahoo;msn;click;banner;microsoft;live;
1440  748  msn;click;banner;microsoft;live;
1488  3028  msn
1440  748  PosDot:
1488  3028  TmpDomainName:
1440  748  Word:
1488  3028  click;banner;microsoft;live;
1440  748  msn
1488  3028  PosDot:
1440  748  TmpDomainName:
1488  3028  Word:
1440  748  click;banner;microsoft;live;
1488  3028  click
1440  748  PosDot:
1488  3028  TmpDomainName:
1440  748  Word:
1488  3028  banner;microsoft;live;
1440  748  TmpDomainName:
1488  3028  PosDot:
1440  748  banner;microsoft;live;
1488  3028  Word:
1440  748  PosDot:
1488  3028  banner
1440  748  Word:
1488  3028  TmpDomainName:
1440  748  banner
1440  748  TmpDomainName:
1488  3028  PosDot:
1440  748  
1440  748  PosDot:
1440  748  search;google;yahoo;msn;click;banner;microsoft;live;
1488  3028  Checking:
1488  3028  ad.wsod.com
1440  748  Checking:
1488  3028  StartCheck
1440  748  ad.wsod.com
1488  3028  Word:
1440  748  StartCheck
1488  3028  search
1440  748  Word:
1488  3028  TmpDomainName:
1440  748  search
1488  3028  google;yahoo;msn;click;banner;microsoft;live;
1440  748  TmpDomainName:
1488  3028  PosDot:
1440  748  google;yahoo;msn;click;banner;microsoft;live;
1488  3028  Word:
1440  748  PosDot:
1488  3028  google
1440  748  Word:
1488  3028  TmpDomainName:
1440  748  msn
1488  3028  msn;click;banner;microsoft;live;
1440  748  TmpDomainName:
1488  3028  PosDot:
1440  748  click;banner;microsoft;live;
1488  3028  Word:
1440  748  PosDot:
1488  3028  msn
1440  748  Word:
1488  3028  TmpDomainName:
1440  748  click
1488  3028  click;banner;microsoft;live;
1440  748  TmpDomainName:
1488  3028  PosDot:
1440  748  banner;microsoft;live;
1488  3028  Word:
1440  748  PosDot:
1488  3028  click
1440  748  Word:
1488  3028  TmpDomainName:
1440  748  banner
1488  3028  banner;microsoft;live;
1440  748  TmpDomainName:
1488  3028  PosDot:
1440  748  microsoft;live;
1488  3028  Word:
1440  748  PosDot:
1488  3028  banner
1440  748  Word:
1488  3028  TmpDomainName:
1440  748  microsoft
1488  3028  PosDot:
1488  3028  Word:
1488  3028  live
1488  3028  TmpDomainName:
1488  3028  
1488  3028  PosDot:
1488  3028  search;google;yahoo;msn;click;banner;microsoft;live;
2088  2768  Checking:
2088  2768  toolbar.google.com
2088  2768  StartCheck
2088  2768  Word:
2088  2768  search
2088  2768  TmpDomainName:
2088  2768  google;yahoo;msn;click;banner;microsoft;live;
2088  2768  PosDot:
2088  2768  Word:
2088  2768  google
2088  2768  TmpDomainName:
2088  2768  yahoo;msn;click;banner;microsoft;live;
2088  2768  PosDot:
2088  2768  search;google;yahoo;msn;click;banner;microsoft;live;
2088  2792  Checking:
2088  2792  ad.wsod.com
2088  2792  StartCheck
2088  2792  Word:
2088  2792  search
2088  2792  TmpDomainName:
2088  2792  google;yahoo;msn;click;banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  google
2088  2792  TmpDomainName:
2088  2792  yahoo;msn;click;banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  yahoo
2088  2792  TmpDomainName:
2088  2792  msn;click;banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  msn
2088  2792  TmpDomainName:
2088  2792  click;banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  click
2088  2792  TmpDomainName:
2088  2792  banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  banner
2088  2792  TmpDomainName:
2088  2792  microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  microsoft
2088  2792  TmpDomainName:
2088  2792  live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  live
2088  2792  TmpDomainName:
2088  2792  
2088  2792  PosDot:
2088  2792  search;google;yahoo;msn;click;banner;microsoft;live;
2088  2792  Checking:
2088  2792  ad.wsod.com
2088  2792  StartCheck
2088  2792  Word:
2088  2792  search
2088  2792  TmpDomainName:
2088  2792  google;yahoo;msn;click;banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  google
2088  2792  TmpDomainName:
2088  2792  yahoo;msn;click;banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  yahoo
2088  2792  TmpDomainName:
2088  2792  msn;click;banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  msn
2088  2792  TmpDomainName:
2088  2792  click;banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  click
2088  2792  TmpDomainName:
2088  2792  banner;microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  banner
2088  2792  TmpDomainName:
2088  2792  microsoft;live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  microsoft
2088  2792  TmpDomainName:
2088  2792  live;
2088  2792  PosDot:
2088  2792  Word:
2088  2792  live
2088  2792  TmpDomainName:
2088  2792  
2088  2792  PosDot:
2088  2792  search;google;yahoo;msn;click;banner;microsoft;live;
2492  1936  Checking:
2492  1936  l.yimg.com
2492  1936  StartCheck
2492  1936  Word:
2492  1936  search
2492  1936  TmpDomainName:
2492  1936  google;yahoo;msn;click;banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  google
2492  1936  TmpDomainName:
2492  1936  yahoo;msn;click;banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  yahoo
2492  1936  TmpDomainName:
2492  1936  msn;click;banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  msn
2492  1936  TmpDomainName:
2492  1936  click;banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  click
2492  1936  TmpDomainName:
2492  1936  banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  banner
2492  1936  TmpDomainName:
2492  1936  microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  microsoft
2492  1936  TmpDomainName:
2492  1936  live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  live
2492  1936  TmpDomainName:
2492  1936  
2492  1936  PosDot:
2492  1936  search;google;yahoo;msn;click;banner;microsoft;live;
2492  1936  Checking:
2492  1936  l.yimg.com
2492  1936  StartCheck
2492  1936  Word:
2492  1936  search
2492  1936  TmpDomainName:
2492  1936  google;yahoo;msn;click;banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  google
2492  1936  TmpDomainName:
2492  1936  yahoo;msn;click;banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  yahoo
2492  1936  TmpDomainName:
2492  1936  msn;click;banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  msn
2492  1936  TmpDomainName:
2492  1936  click;banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  click
2492  1936  TmpDomainName:
2492  1936  banner;microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  banner
2492  1936  TmpDomainName:
2492  1936  microsoft;live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  microsoft
2492  1936  TmpDomainName:
2492  1936  live;
2492  1936  PosDot:
2492  1936  Word:
2492  1936  live
2492  1936  TmpDomainName:
2492  1936  
2492  1936  PosDot:
2492  1936  search;google;yahoo;msn;click;banner;microsoft;live;
2084  3800  Checking:
2084  3800  www.mvps.org
2084  3800  StartCheck
2084  3800  Word:
2084  3800  search
2084  3800  TmpDomainName:
2084  3800  google;yahoo;msn;click;banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  google
2084  3800  TmpDomainName:
2084  3800  yahoo;msn;click;banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  yahoo
2084  3800  TmpDomainName:
2084  3800  msn;click;banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  msn
2084  3800  TmpDomainName:
2084  3800  click;banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  click
2084  3800  TmpDomainName:
2084  3800  banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  banner
2084  3800  TmpDomainName:
2084  3800  microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  microsoft
2084  3800  TmpDomainName:
2084  3800  live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  live
2084  3800  TmpDomainName:
2084  3800  
2084  3800  PosDot:
2084  3800  search;google;yahoo;msn;click;banner;microsoft;live;
2084  3800  Checking:
2084  3800  www.mvps.org
2084  3800  StartCheck
2084  3800  Word:
2084  3800  search
2084  3800  TmpDomainName:
2084  3800  google;yahoo;msn;click;banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  google
2084  3800  TmpDomainName:
2084  3800  yahoo;msn;click;banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  yahoo
2084  3800  TmpDomainName:
2084  3800  msn;click;banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  msn
2084  3800  TmpDomainName:
2084  3800  click;banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  click
2084  3800  TmpDomainName:
2084  3800  banner;microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  banner
2084  3800  TmpDomainName:
2084  3800  microsoft;live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  microsoft
2084  3800  TmpDomainName:
2084  3800  live;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  live
2084  3800  TmpDomainName:
2084  3800  
2084  3800  PosDot:
2084  3800  search;google;yahoo;msn;click;banner;microsoft;live;
2084  3800  Checking:
2084  3800  www.mvps.org
2084  3800  StartCheck
2084  3800  Word:
2084  3800  search
2084  3800  TmpDomainName:
2084  3800  google;yahoo;msn;click;banner;microsoft;live;www.mvps.org;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  google
2084  3800  TmpDomainName:
2084  3800  yahoo;msn;click;banner;microsoft;live;www.mvps.org;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  yahoo
2084  3800  TmpDomainName:
2084  3800  msn;click;banner;microsoft;live;www.mvps.org;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  msn
2084  3800  TmpDomainName:
2084  3800  click;banner;microsoft;live;www.mvps.org;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  click
2084  3800  TmpDomainName:
2084  3800  banner;microsoft;live;www.mvps.org;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  banner
2084  3800  TmpDomainName:
2084  3800  microsoft;live;www.mvps.org;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  microsoft
2084  3800  TmpDomainName:
2084  3800  live;www.mvps.org;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  live
2084  3800  TmpDomainName:
2084  3800  www.mvps.org;
2084  3800  PosDot:
2084  3800  Word:
2084  3800  www.mvps.org
2084  3800  TmpDomainName:
2084  3800  
2084  3800  PosDot:
2084  3800  search;google;yahoo;msn;click;banner;microsoft;live;www.mvps.org;
- ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~
xxx

Offline Blue55

  • Full Member
  • ***
  • Posts: 104
Re: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon
« Reply #16 on: January 30, 2011, 07:36:08 AM »
Corrine,
I'll try anything else you've got, I have only one idea.
In the past, during debugging, I have done well to limit restarts (unless it was specifically needed)
limit run time but also usage time (typing/commands),
and definitely limit time online (unless it was specifically needed).
The more of that that I could do, really helped in success.
Some little bits still in there can use those opportunities to repopulate, move around, download more friends, and dig back in between steps.

I have had these powered off and on more times than I would like between commands.
What if I put all of things that I have already done to this one, nose to tail,
    and did them all at once with only restarts or going online when specifically needed. One fell swoop.
What do you think ?
It can't hurt can it ?
Am I just getting tired and silly ?

Carol

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
Re: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon
« Reply #17 on: January 30, 2011, 02:55:22 PM »
Hi, Carol.

If C:/Qoobox is still on the computer, then there was not a clean removal of ComboFix.

For now, please do the following -- and only the following:

Scan with MBAM again:
  • Launch Malwarebytes' Anti-Malware then click the Update tab and "Check for Updates
  • Once the update has been installed and the program has loaded, select Quick scan
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, EXCEPT items in System Restore as shown in this sample:

  • Click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See the Note below)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Please post contents of that file in your next reply.
** Note **

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline Blue55

  • Full Member
  • ***
  • Posts: 104
Re: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon
« Reply #18 on: January 31, 2011, 01:15:58 AM »
Launched MalwareBytes
Provided internet connection
Checked for updates ... Successful
Removed internet connection
QuickScanned - Found Nothing  Log follows:

Running slooooww, slooowwwer....

- ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5643

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

1/30/2011 8:57:38 PM
mbam-log-2011-01-30 (20-57-38).txt

Scan type: Quick scan
Objects scanned: 131617
Time elapsed: 7 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
xxxxxxx

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
Re: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon
« Reply #19 on: January 31, 2011, 01:42:15 AM »
Please go here and run an on-line scan with the F-Secure scanner.
  • Use IE (Internet Explorer), accept the license terms, and allow the Active-X controls to load.
  • Click Full System Scan and allow the components to download and the scan to complete.
  • If malware is found during the scan, check Submit samples to F-Secure and Automatic cleaning.
  • When the scan has finished, click the Show Report button and copy and paste the entire report in your next reply.
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline Blue55

  • Full Member
  • ***
  • Posts: 104
Re: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon
« Reply #20 on: January 31, 2011, 07:19:24 AM »
F-Secure log follows

Note
I had copied a list (from the first HJT) of the bad sites that were praying on it.
I intended (and have) added them to my hosts along with a few dozen others that I have hated from the past,
  and viewpoint just because I hate that one so much.
That might be what it picked up on in my 2011 folders. ...Or was there actually a bug amongst my text files ?
Since I'm done customizing my new hosts file, I don't need any of that anymore.
What F-Secure didn't delete, I did, along with a bunch of old logs and such which have long since been posted here.
I cleaned it up and just left some tools that might still get used (again) and some new versions of programs that will get put on later, Secunia and such.
Sorry 'bout that.

It seems perkier but that might not last again, we'll see.
What next?
- ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~ - ~
Scanning Report
Monday, January 31, 2011 22:17:11 - 02:27:15

Computer name: XPHOMELAPTOP
Scanning type: Scan system for malware, spyware and rootkits
Target: C:\
11 malware found
TrackingCookie.Adinterax (spyware)

    * System (Disinfected)

TrackingCookie.Revsci (spyware)

    * System (Disinfected)

TrackingCookie.Specificclick (spyware)

    * System (Disinfected)

TrackingCookie.Adrevolver (spyware)

    * System (Disinfected)

TrackingCookie.Adbrite (spyware)

    * System (Disinfected)

TrackingCookie.Webtrends (spyware)

    * System (Disinfected)

TrackingCookie.Liveperson (spyware)

    * System (Disinfected)

TrackingCookie.Atwola (spyware)

    * System (Disinfected)

TrackingCookie.Yieldmanager (spyware)

    * System (Disinfected)

Trojan.Qhost.LXE (virus)

    * C:\2011 ONLINE SCANS -\HOSTS REMOVED -BAD\HOSTS (Renamed & Submitted)

Trojan.Script.409415 (virus)

    * C:\2011 - LOGS\HOSTS - HIJACKED (Renamed & Submitted)

Statistics
Scanned:

    * Files: 89310
    * System: 2734
    * Not scanned: 8

Actions:

    * Disinfected: 9
    * Renamed: 2
    * Deleted: 0
    * Not cleaned: 0
    * Submitted: 2

Files not scanned:

    * C:\PAGEFILE.SYS
    * C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
    * C:\WINDOWS\SYSTEM32\CONFIG\SAM
    * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
    * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
    * C:\DOCUMENTS AND SETTINGS\FLAVIO\LOCAL SETTINGS\TEMP\HSPERFDATA_FLAVIO\2224
    * C:\DOCUMENTS AND SETTINGS\FLAVIO\LOCAL SETTINGS\TEMP\HSPERFDATA_FLAVIO\284

Options
Scanning engines:

Scanning options:

    * Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
    * Use advanced heuristics
xxxxxx

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
Re: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon
« Reply #21 on: January 31, 2011, 03:12:07 PM »
Hi, Carol.

This computer had a rogue on it.  There is at least one new rogue every day added to Malwarebytes' Anti-Malware.  Each uses different IP addresses.  Many rogues are from websites that have been compromised.  I have a friend who works in security for a major company.  Believe me when I say the computer being used was properly secured.  However, when the friend clicked on a link in search results for technical information, it resulted in a malicious script to begin running.  Fortunately, the friend immediately recognized what was happening and immediately "pulled the plug".  You cannot begin to block every malicious IP on the Internet.  It was your files that were detected by MSE and F-Secure. 

    * C:\2011 ONLINE SCANS -\HOSTS REMOVED -BAD\HOSTS (Renamed & Submitted)
    * C:\2011 - LOGS\HOSTS - HIJACKED (Renamed & Submitted)

You would do better to get your friend to purchase a license (one-time fee) to Malwarebytes' Anti-Malware and be sure the website blocking feature is enabled.  It will block website IP addresses that are in it's database of malware-serving websites.

This computer will not be "snappy".  From an earlier log:  Total RAM: 254 MB (33% free). 

How Much RAM Do I Need:
Quote
Casual users want to browse the Internet using Internet Explorer or Mozilla Firefox. They want to check their e-mails using Microsoft Outlook and listen to music using Winamp. Such casual users need about 512 MB (megabytes) to 1 GB (gigabyte) of RAM.

How much RAM do I need?:
Quote
Ask the typical PC expert "how much memory do I need?" and they'll probably tell you to "get 4GB, it's very cheap these days and you're short-changing yourself with anything less".

And this isn't an unreasonable answer. The less RAM you have, the more likely Windows will have to start swapping out pages of memory to your hard drive, drastically cutting your system's performance

,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline Blue55

  • Full Member
  • ***
  • Posts: 104
Re: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon
« Reply #22 on: January 31, 2011, 03:49:38 PM »
Aha!  I KNEW I saw it somewhere. It was on this one.

Quote
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
What can I do about this ?
...

Apparently this is the kids' computer and they get what they get for speed. It actually isn't too bad when it is working right. I'm going to take this one around the block for a while just to see if it stays clean for even a few hours of real use. I'll know because the switch to totally bogged down turtle is quite fast and dramatic.
(these are 2 totally different machines now. Thank you sooooo much.)
...

Malwarebytes' Anti-Malware for the most current IP addresses. That will be good.
....

Anything else for this one, assuming it behaves ?  I've stayed off it on purpose but I'll try it now, well tonight maybe.

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
Re: Laptop- Windows Protection Suite Tip of the day and Red castle wall icon
« Reply #23 on: January 31, 2011, 04:26:14 PM »
Hi, Carol.

That is not the Windows Messenger Service. It is the older Messenger. It is up to the parents to decide if they want their children to use instant messaging.  If they do, the current version is available from http://explore.live.com/windows-live-Messenger-XP. The current version of AIM is 7.5, although I do not know anything about whether it is compatible with XP.

,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.