- Joined
- May 1, 2012
- Messages
- 107 (0.02/day)
Hey guys I just recovered from a problem I was having. My email account was hacked and I had to recover it. I BSOD on a reboot after that, I was worried that something had gone wrong. I scanned my computer with AVG, SuperAntiSpyware and Malware Bytes. SAS found a virus.funlove with I was able to remove, and it also found the usual 80-90 adware.tracking cookie. I removed the virus as well as all the cookies, I then scanned a 2nd time to check and it found a group of 12 adware.tracking cookie. I removed those, rebooted and scanned again, and those same 12 came back again. I've also manually deleted them and rebooted and again, they keep re-appearing. The cookies are located in a Microsoft\Windows folder, are they normal and re-created every time windows is booted? The scan log is below.
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 07/07/2012 at 09:07 PM
Application Version : 5.1.1002
Core Rules Database Version : 8862
Trace Rules Database Version: 6674
Scan type : Quick Scan
Total Scan Time : 00:00:51
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator
Memory items scanned : 639
Memory threats detected : 0
Registry items scanned : 54355
Registry threats detected : 0
File items scanned : 10542
File threats detected : 12
Adware.Tracking Cookie
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\XKKAX1R1.txt [ /at.atwola.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\4EMTT8PI.txt [ /advertising.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\0KZNSXPR.txt [ /cdn.at.atwola.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\QCYPZTM5.txt [ /atwola.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\SBO9NX7J.txt [ /tacoda.at.atwola.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\Y6MH5R1U.txt [ /ar.atwola.com ]
C:\USERS\ANTHONY\AppData\Roaming\Microsoft\Windows\Cookies\D3R0KB0T.txt [ Cookie:anthony@adsonar.com/adserving ]
C:\USERS\ANTHONY\Cookies\XKKAX1R1.txt [ Cookie:anthony@at.atwola.com/ ]
C:\USERS\ANTHONY\Cookies\4EMTT8PI.txt [ Cookie:anthony@advertising.com/ ]
C:\USERS\ANTHONY\Cookies\0KZNSXPR.txt [ Cookie:anthony@cdn.at.atwola.com/ ]
C:\USERS\ANTHONY\Cookies\SBO9NX7J.txt [ Cookie:anthony@tacoda.at.atwola.com/ ]
C:\USERS\ANTHONY\Cookies\D3R0KB0T.txt [ Cookie:anthony@adsonar.com/adserving ]
I just want to make sure these are not any part of the virus that I've removed and would like to clarify if these seem to be normal or not. No matter what I do, they keep coming back everytime I boot into windows. Looking for a helpful response, thanks guys!
Doing a little research I found that atwola.com is linked to all AOL products. Everytime I boot into windows, AOL Instant Messenger is automatically loaded. That would explain why these cookies are created everytime I scan after a reboot. They must be coming from that
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 07/07/2012 at 09:07 PM
Application Version : 5.1.1002
Core Rules Database Version : 8862
Trace Rules Database Version: 6674
Scan type : Quick Scan
Total Scan Time : 00:00:51
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator
Memory items scanned : 639
Memory threats detected : 0
Registry items scanned : 54355
Registry threats detected : 0
File items scanned : 10542
File threats detected : 12
Adware.Tracking Cookie
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\XKKAX1R1.txt [ /at.atwola.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\4EMTT8PI.txt [ /advertising.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\0KZNSXPR.txt [ /cdn.at.atwola.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\QCYPZTM5.txt [ /atwola.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\SBO9NX7J.txt [ /tacoda.at.atwola.com ]
C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Cookies\Y6MH5R1U.txt [ /ar.atwola.com ]
C:\USERS\ANTHONY\AppData\Roaming\Microsoft\Windows\Cookies\D3R0KB0T.txt [ Cookie:anthony@adsonar.com/adserving ]
C:\USERS\ANTHONY\Cookies\XKKAX1R1.txt [ Cookie:anthony@at.atwola.com/ ]
C:\USERS\ANTHONY\Cookies\4EMTT8PI.txt [ Cookie:anthony@advertising.com/ ]
C:\USERS\ANTHONY\Cookies\0KZNSXPR.txt [ Cookie:anthony@cdn.at.atwola.com/ ]
C:\USERS\ANTHONY\Cookies\SBO9NX7J.txt [ Cookie:anthony@tacoda.at.atwola.com/ ]
C:\USERS\ANTHONY\Cookies\D3R0KB0T.txt [ Cookie:anthony@adsonar.com/adserving ]
I just want to make sure these are not any part of the virus that I've removed and would like to clarify if these seem to be normal or not. No matter what I do, they keep coming back everytime I boot into windows. Looking for a helpful response, thanks guys!

Doing a little research I found that atwola.com is linked to all AOL products. Everytime I boot into windows, AOL Instant Messenger is automatically loaded. That would explain why these cookies are created everytime I scan after a reboot. They must be coming from that

Last edited: