***************
3:57 AM: |       Start of Session, Tuesday, October 07, 2008       |
3:57 AM: Spy Sweeper 5.5.7.103 started
3:57 AM: Spy Sweeper 5.5.7.103 started
3:58 AM: Spyware Definitions: 1300
3:58 AM: Shield States
           IE Tracking Cookies Shield: Off
           IE Hijack Shield: On
           System Services Shield: On
           Execution Shield: On
           File System Shield: On
           IE Favorites Shield: On
           ActiveX Shield: On
           Internet Communication Shield: On
           Hosts File Shield: On
           Common Ad Sites: Off
           Startup Shield: On
           Alternate Data Stream (ADS) Execution Shield: On
           IE Security Shield: On
           BHO Shield: On
3:58 AM: Informational: ShieldEmail: Start monitoring port 110 for mail activities
           E-mail Attachment: On
3:58 AM: Informational: ShieldEmail: Start monitoring port 25 for mail activities
           Keylogger: Off
3:59 AM: ApplicationMinimized - ENTER
3:59 AM: ApplicationMinimized - EXIT
4:07 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: 
         Operation: File Access
4:12 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
4:12 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
2:02 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
2:02 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
10:35 PM: Automated check for program update in progress.
10:35 PM: Your spyware definitions have been updated.
11:53 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
11:53 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
12:01 AM: ApplicationMinimized - ENTER
12:01 AM: ApplicationMinimized - EXIT
9:43 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
9:43 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
10:36 PM: Automated check for program update in progress.
10:37 PM: Your spyware definitions have been updated.
12:00 AM: ApplicationMinimized - ENTER
12:00 AM: ApplicationMinimized - EXIT
5:11 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
5:11 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
3:01 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
3:01 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
10:38 PM: Automated check for program update in progress.
10:38 PM: Your spyware definitions have been updated.
12:00 AM: ApplicationMinimized - ENTER
12:00 AM: ApplicationMinimized - EXIT
12:52 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
12:52 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
10:42 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
10:42 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
8:32 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
8:32 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
10:39 PM: Automated check for program update in progress.
10:40 PM: Your spyware definitions have been updated.
12:00 AM: ApplicationMinimized - ENTER
12:00 AM: ApplicationMinimized - EXIT
6:23 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
6:23 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
7:39 AM: Warning: MailShield: Failed to connect to mail server 55534a17:110. This may be caused by a firewall or the mail server may be down.
4:14 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
4:14 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
10:40 PM: Automated check for program update in progress.
10:40 PM: Your definitions are up to date.
12:00 AM: ApplicationMinimized - ENTER
12:00 AM: ApplicationMinimized - EXIT
2:05 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
2:05 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
3:38 AM: Warning: MailShield: Failed to connect to mail server d9d1de2c:110. This may be caused by a firewall or the mail server may be down.
4:01 AM: Warning: MailShield: Failed to connect to mail server d9d1de2c:110. This may be caused by a firewall or the mail server may be down.
10:41 PM: Automated check for program update in progress.
10:41 PM: Your definitions are up to date.
12:00 AM: ApplicationMinimized - ENTER
12:00 AM: ApplicationMinimized - EXIT
2:15 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
2:15 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
6:00 AM: Sweep initiated using definitions version 1304
6:00 AM: Start Scheduled Sweep
6:00 AM: Starting Memory Sweep
6:10 AM: Memory Sweep Complete, Elapsed Time: 00:09:58
6:10 AM: Starting Registry Sweep
6:10 AM: Registry Sweep Complete, Elapsed Time:00:00:44
6:10 AM: Starting Cookie Sweep
6:10 AM:   Found Spy Cookie: atlas dmt cookie
6:10 AM:   c:\users\owner\appdata\roaming\microsoft\windows\cookies\owner@atdmt[2].txt (ID = 2253)
6:10 AM:   Found Spy Cookie: bs.serving-sys cookie
6:10 AM:   c:\users\owner\appdata\roaming\microsoft\windows\cookies\owner@bs.serving-sys[2].txt (ID = 2330)
6:10 AM:   Found Spy Cookie: doubleclick cookie
6:10 AM:   c:\users\owner\appdata\roaming\microsoft\windows\cookies\owner@doubleclick[1].txt (ID = 17499)
6:10 AM:   Found Spy Cookie: serving-sys cookie
6:10 AM:   c:\users\owner\appdata\roaming\microsoft\windows\cookies\owner@serving-sys[1].txt (ID = 3343)
6:10 AM: Cookie Sweep Complete, Elapsed Time: 00:00:01
6:10 AM: Starting File Sweep
6:42 AM:   Warning: Failed to open file "c:\users\owner\ntuser.dat.log2". The operation completed successfully
6:42 AM:   Warning: Failed to open file "c:\windows\serviceprofiles\localservice\ntuser.dat.log2". The operation completed successfully
6:42 AM:   Warning: Failed to open file "c:\windows\serviceprofiles\networkservice\ntuser.dat.log2". The operation completed successfully
6:42 AM:   Warning: Failed to open file "c:\windows\system32\config\components.log2". The operation completed successfully
6:42 AM:   Warning: Failed to open file "c:\windows\system32\config\default.log2". The operation completed successfully
6:42 AM:   Warning: Failed to open file "c:\windows\system32\config\sam.log2". The operation completed successfully
6:42 AM:   Warning: Failed to open file "c:\windows\system32\config\security.log2". The operation completed successfully
6:44 AM:   Warning: Failed to open file "c:\windows\system32\config\systemprofile\appdata\roaming\webroot\spy sweeper\temp\ssms0fc08db0-77c1-4d46-ace2-088662719dee.tmp". The operation completed successfully
6:44 AM:   Warning: Failed to open file "c:\windows\system32\config\systemprofile\appdata\roaming\webroot\spy sweeper\temp\ssmsd4875b97-488d-496f-bda6-0ddd56882462.tmp". The operation completed successfully
6:44 AM:   Warning: Failed to open file "c:\windows\system32\config\systemprofile\appdata\roaming\webroot\spy sweeper\temp\ssms699a54ee-6995-4218-903f-ddd8a93279ee.tmp". The operation completed successfully
6:44 AM:   Warning: Failed to open file "c:\windows\system32\config\systemprofile\appdata\roaming\webroot\spy sweeper\temp\ssmscefe2590-3ce2-45dd-a487-d0667b77d8f7.tmp". The operation completed successfully
6:44 AM:   Warning: Failed to open file "c:\windows\system32\config\systemprofile\appdata\roaming\webroot\spy sweeper\temp\ssms1f8c2398-e834-4c3b-9f60-419c2756de31.tmp". The operation completed successfully
6:44 AM:   Warning: Failed to open file "c:\windows\system32\config\systemprofile\appdata\roaming\webroot\spy sweeper\temp\ssmsab51e362-2693-45fe-8de2-2699266c66a6.tmp". The operation completed successfully
6:44 AM:   Warning: Failed to open file "c:\windows\system32\logfiles\wmi\rtbackup\etwrtmsmppssession.etl". The operation completed successfully
6:44 AM:   Warning: Failed to open file "c:\windows\temp\jet1afe.tmp". The operation completed successfully
6:44 AM:   Warning: Failed to open file "c:\users\owner\appdata\roaming\skype\vance_serori\chat4096.dbb". The operation completed successfully
6:44 AM:   Warning: SweepDirectories: Cannot find directory "d:". This directory was not added to the list of paths to be scanned.
6:44 AM:   Warning: SweepDirectories: Cannot find directory "e:". This directory was not added to the list of paths to be scanned.
6:44 AM:   Warning: SweepDirectories: Cannot find directory "f:". This directory was not added to the list of paths to be scanned.
6:50 AM: File Sweep Complete, Elapsed Time: 00:39:26
6:50 AM: Scheduled Sweep has completed.  Elapsed time 00:50:20
6:50 AM: Traces Found: 4
12:05 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
12:05 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
4:35 PM: Removal process initiated
4:35 PM:   Quarantining All Traces: atlas dmt cookie
4:35 PM:   Quarantining All Traces: bs.serving-sys cookie
4:35 PM:   Quarantining All Traces: doubleclick cookie
4:35 PM:   Quarantining All Traces: serving-sys cookie
4:35 PM: Removal process completed.  Elapsed time 00:00:15
4:36 PM: ApplicationMinimized - ENTER
4:36 PM: ApplicationMinimized - EXIT
9:58 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
9:58 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
10:42 PM: Automated check for program update in progress.
10:43 PM: Your spyware definitions have been updated.
12:00 AM: ApplicationMinimized - ENTER
12:00 AM: ApplicationMinimized - EXIT
7:49 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
7:49 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
5:39 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
5:39 PM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access
10:43 PM: Automated check for program update in progress.
10:44 PM: Your spyware definitions have been updated.
12:00 AM: ApplicationMinimized - ENTER
12:00 AM: ApplicationMinimized - EXIT
3:30 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSHRMD\
         Operation: Registry Access
3:30 AM: Tamper Detection
         Source: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
         Target: \SYSTEM\ControlSet001\Enum\Root\LEGACY_SSIDRV\
         Operation: Registry Access