Where are my tracking coolies coming from!?

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

bassetman

Thread Starter
Moderator (deceased) - Gone but never forgotten
Joined
Jun 7, 2001
Messages
47,973
My mouse got all jerky and PC was slow today again. Even crashed when overloaded. I shut down re-booted, still slow and jerky. I ran spybot and found five tracking cookies. I deleted them and was fine. The only web site I visited after that was here. Again slow and jerky. Ran spybot again, there they are again!
If I am not getting them from ads here, where the hell are they coming from?
I am running ZA and SpywareGuard also. :mad:

John
 

Del

Joined
Aug 31, 2001
Messages
3,452
Hi John,
Were they the same 5 cookies you removed before?
 

bassetman

Thread Starter
Moderator (deceased) - Gone but never forgotten
Joined
Jun 7, 2001
Messages
47,973
I hadn't made a note, but yes, I think they were.

John
 
Joined
Dec 27, 2002
Messages
362
There are several tracking cookies that are on a very large percentage of websites, like doubleclick, hitbox, advertising.com,
bfast, mediaplex, valueclick and probably some others I didn't think of. Everytime I run Spybot those same cookies are there.

One option is to set Internet Explorer to block cookies, or certain cookies. Also Zone Alarm Pro can block cookies. You can get cookie management software also.

This article on spywareinfo.com has great info for how to block cookies with your browser and links to download cookie managers.

http://www.spywareinfo.com/articles/cookies/

I don't know if cookies slow down your surfing though - it might be something else. Do you empty your browser cache regularly? I like to run Spybot and run disk cleanup almost every day to clear out the junk :p

Hope this helps.
 

Del

Joined
Aug 31, 2001
Messages
3,452
Have to agree with Suzi there, very seldom delete any cookies and have no problems at all.
 

bassetman

Thread Starter
Moderator (deceased) - Gone but never forgotten
Joined
Jun 7, 2001
Messages
47,973
I always speed up after I delete those "buggers"!
I can't delete all of them, 'cuz I am taking an online course now and that keeps track of my progress. :-(

Thanks
John
 

pyritechips

Jim
Gone but Never Forgotten
Joined
Jun 2, 2002
Messages
26,907
Hiya John, sorry I missed you in chat the other night!:rolleyes:

I don't see any way a few cookies would mess up your system like that. I'm glad you got that course started!:) But have you installed any software for it? Is it an online course? Maybe it's running something on your system. Have you checked your startup list lately? And if it is an online course, Is there some kind of updater installed for th ecourse that's trying to contacted the course server?

Also for those cookies, go right into C:\Windows\Cookies and take a close look at them to see their source. For example, I have one called "[email protected][1]". Hmm...wonder where I got that from?

:D
 

bassetman

Thread Starter
Moderator (deceased) - Gone but never forgotten
Joined
Jun 7, 2001
Messages
47,973
Thx Jim, I just figgered you were shunning me again! ;-)
The thing about the course is, I didn't DL the software for that till after I had this prob 2X's.

Oh well.

John
 

pyritechips

Jim
Gone but Never Forgotten
Joined
Jun 2, 2002
Messages
26,907
Hiya John:

Why not run Startuplist just for the Hell of it? Couldn't hurt.

Just tonight I browsed 1 webpage. I got a failed popup attempt and I couldn't close the button on the taskbar nor could I maximise it. when I read the button I swore: http://xupiter.com/downloads/installer or some such URL! I ran spybot right away but I was clean: just last week I installed spywareblaster!
 

bassetman

Thread Starter
Moderator (deceased) - Gone but never forgotten
Joined
Jun 7, 2001
Messages
47,973
Here ya go! Have at it buddy!

StartupList report, 02/05/2003, 2:48:13 AM
StartupList version: 1.51
Started from : C:\STARTUP LIST\STARTUPLIST\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v5.51 SP2 (5.51.4807.2300)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SPYWAREGUARDCP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE
C:\PROGRAM FILES\ANALOGX\COOKIEWALL\COOKIE.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\EDITPAD\EDITPAD.EXE
C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\NETSCAPE.EXE
C:\JOHN\WS_FTP PRO\WS_FTP95.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\STARTUP LIST\STARTUPLIST\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
SpywareGuard Control Panel.lnk = C:\Program Files\SpywareGuard\spywareguardcp.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = c:\windows\scanregw.exe /autorun
SystemTray = SysTray.Exe
Norton Auto-Protect = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
EM_EXEC = C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
SpyBlocker = C:\PROGRAM FILES\SPYBLOCKER SOFTWARE\spyblocker.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Start WingMan Profiler =

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\AutoCADScript\shell\open\command

(Default) = C:\WINDOWS\NOTEPAD.EXE "%1"

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\Program Files\AnalogX\Script Defender\sdefend.exe %1 %*

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 10/1/2003, 12:58:46)

[rename]
NUL=C:\WINDOWS\DOWNLO~1\IEGATOR.DLL

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET BLASTER=A220 I7 D1 H5 P330 T6
SET CTSYN=C:\WINDOWS
C:\PROGRA~1\CREATIVE\SBLIVE\DOSDRV\SBEINIT.COM

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\URL ORGANIZER\URLORGIE.DLL - {C6CEAC32-D45C-11D4-94AF-0050BABD5FD6}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Windows Critical Update Notification.job
Norton AntiVirus Weekly Scan.job
Run LiveUpdate (for Norton AntiVirus).job
Run LiveUpdate (for Norton AntiVirus)(2).job

--------------------------------------------------

Enumerating Download Program Files:

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R1024/V31Controls/x86/w98/en/actsetup.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2002060602/housecall.antivirus.com/housecall/xscan53.cab

[sys Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPITSTOP.DLL
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[Microsoft Office Tools on the Web Control]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\OUTC.DLL
CODEBASE = http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37612.4500231482

--------------------------------------------------
End of report, 5,516 bytes
Report generated in 1.346 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
John
 

pyritechips

Jim
Gone but Never Forgotten
Joined
Jun 2, 2002
Messages
26,907
John, have you installed something called URL organizer? I am looking at this line:

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\URL ORGANIZER\URLORGIE.DLL - {C6CEAC32-D45C-11D4-94AF-0050BABD5FD6}

I got only 2 Google hits for it: your other thread in security with a startup list and this site:

http://www.urlorg.com/ReadMe.txt

If you didn't install this then I would say it was installed for you!
 

bassetman

Thread Starter
Moderator (deceased) - Gone but never forgotten
Joined
Jun 7, 2001
Messages
47,973
Thx, no I didn't install the damn thing! I dodn't look close enought to see if it included uninstall instructions! Arrrrgg!

John
 

pyritechips

Jim
Gone but Never Forgotten
Joined
Jun 2, 2002
Messages
26,907
Ok John, see if it's listed in control panel/add remove. See if it has a folder in C:\Program Files.

I hope it isn't conecting to the net and broadcasting back to the sire. Look at all the fun stuff it gathers from your computer:

Information stored:
* Internet bookmarks/favorites/favourites
* e-mail addresses
* newsgroup addresses
* application, folder and document shortcuts
* unlimited space for notes on each URL
* site log-in names
* time of last opening each URL

:eek:
 

bassetman

Thread Starter
Moderator (deceased) - Gone but never forgotten
Joined
Jun 7, 2001
Messages
47,973
SOBs! Mo Fo's, that just made it worse!, now it took over my start page! Now I bet I have a whole new load of their cr*p!

Where do these SOBs live! I want at 'em!

Arrrrrgggg!

I don't have time to de-bug my PC everyday for their profit!


John:mad:

PS ok, Aveanue A link is one that keeps showing up in spybot! I clicked on one link here, that is it!
Is it malicious visitors here?

John
 

bassetman

Thread Starter
Moderator (deceased) - Gone but never forgotten
Joined
Jun 7, 2001
Messages
47,973
Ok, after several scans and deletions I have my home page back! I will get these ppl! :mad:
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Members online

Top