The point I was trying to make is that this issue seems unrelated to O/S
version or security software, but related to IE7, perhaps due to a recent
update (which is facilitated through Windows Update, not a Windows update,
since we're on different O/S's).

I've also posted in the Windows forum, but I'll check here occassionally to
see if someone has useful input.

"PA Bear [MS MVP]" wrote:

> You do not have the same issue as you're running Vista SP1 and the OP's
> running WinXP SP3.
>
> If a Windows or IE update were causing the behavior, there'd be thousands of
> posts here about it: There aren't.
>
> To avoid confusion, please begin a new thread about your specific problems.
> State your IE version and full Windows version (e.g., WinXP SP3; Vista SP2)
> in your first post.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Client - since 2002
>
>
> James2008 wrote:
> > I'm having the same issue. For the past week or so, none of my login info
> > or
> > preferences are holding in IE7. Nothing new has been installed or changed,
> > except for the regular updates through Windows Update
> >
> > I don't think this is a security software issue and believe it to be a
> > Windows Update/IE7 update caused specific issue involving access to
> > cookies.
> > I have not messed with any IE settings in about a year, since everything
> > has
> > been running perfect before this issue occurred.
> >
> > Specific Issue: When I go to a website, like Bing, Google, various forums,
> > Windows Live, TVGuide.com, etc., where login info and website preferences
> > can be set and stored, I'm having to re-input or re-set the info when I
> > visit them. Prior to this issue, everything worked perfectly, like we're
> > used to.
> >
> > Example 1: When I go to Bing, I have to reset my preferences such as "Open
> > results in new window", turn off filtering, etc. The site then works
> > properly. But after a certain amount of time, or a reboot/sleep mode, all
> > settings are lost again.
> >
> > Example 2: Sites that are logged into, like Wiindows Live and various
> > non-Microsoft forums, I have "Remember Me" set to remember Username. After
> > a
> > period of time or a reboot/sleep mode, I have to reinput my username and
> > reset all preferences.
> >
> > Example 3: On TVGuide.com, I can set my region, cable system, and other
> > preferences so that the proper listings show. But after a period of time
> > or
> > a reboot/sleep mode, all settings are lost and I have to reset them.
> >
> > Does anyone have any idea what's causing this and how to solve it?
> > Microsoft's KB has nothing on this and even Bing/Google don't show
> > anything.
> >
> > System:
> > Vista Ultimate x64, SP1
> > IE7
> > All Windows Updates current
> > Trend Micro Internet Security, latest updates
> <snip>
>
>

Update

I was running Zone Alarm, Avira AV, Spybot and Lavasoft adaware.
However partly due to this problem and because of a good free offer via my
bank I now use Kaspersky 8 and have removed Spybot and Lavasoft.
Clearly ZA and Avira have gone also.

The problem persists.

My security is now:

Kaspersky 8.
SpywareGuard
SpywareBlaster
SupderAntiSpyware 4.
Malwarebytes' Anti-Malware

Apart from the changes with Kaspersky my system had been stable and well for
over two years.

No scanner finds any infection.


So what could be responsible?

Here then is a hijack this log in case anyone can spot the problem.
Note that the symantec ref is just for Norton Ghost and that all other
Norton applications and left overs have been well removed.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:45:01, on 17/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\GEARSec.exe
E:\Program Files\iolo\common\lib\ioloServiceManager.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\Program Files\Norton Ghost\Agent\VProSvc.exe
E:\WINDOWS\system32\nvsvc32.exe
E:\WINDOWS\system32\PGPsdkServ.exe
E:\WINDOWS\system32\IoctlSvc.exe
E:\Program Files\CyberLink\Shared Files\RichVideo.exe
E:\WINDOWS\system32\tcpsvcs.exe
E:\WINDOWS\System32\snmp.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\SOUNDMAN.EXE
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2 a.exe
E:\WINDOWS\system32\RUNDLL32.EXE
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Microsoft IntelliType Pro\itype.exe
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H 2.EXE
E:\WINDOWS\system32\rundll32.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\Program Files\Norton Ghost\Agent\GhostTray.exe
E:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
E:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
E:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
E:\Program Files\SpywareGuard\sgmain.exe
E:\Program Files\SpywareGuard\sgbhp.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Program Files\Password Safe\pwsafe.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper -
{4A368E80-174F-4872-96B5-0B27DDD11DB2} - E:\Program
Files\SpywareGuard\dlprotect.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - E:\Program
Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Encarta Web Companion Helper Object -
{955BE0B8-BC85-4CAF-856E-8E0D8B610560} - E:\Program Files\Common
Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper -
{DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program
Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer -
{E5A1691B-D188-4419-AD02-90002030B8EE} - E:\PROGRA~1\FlashFXP\IEFlash.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -
E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4}
- E:\Program Files\Common Files\Microsoft Shared\Encarta Web
Companion\ENCWCBAR.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v2]
"E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis 2a.exe" /source=HKLM
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
E:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [itype] "E:\Program Files\Microsoft IntelliType
Pro\itype.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series]
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H 2.EXE /P30 "EPSON Stylus
Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe
bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "E:\Program Files\Norton
Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [AVP] "E:\Program Files\Kaspersky Lab\Kaspersky Internet
Security 2009\avp.exe"
O4 - HKLM\..\Run: [SmartDefrag] "E:\Program Files\IObit\IObit
SmartDefrag\IObit SmartDefrag.exe" /StartUp
O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program
Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User
'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User
'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User
'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User
'Default user')
O4 - S-1-5-18 Startup: SpywareGuard.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: SpywareGuard.lnk = ? (User 'Default user')
O4 - Startup: SpywareGuard.lnk = ?
O4 - Global Startup: Device Detector 3.lnk = ?
O8 - Extra context menu item: Add to Banner Ad Blocker - E:\Program
Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
E:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program
Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} -
E:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Gears Settings -
{09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - E:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} -
E:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell -
{0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - E:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} -
E:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options -
{1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - E:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Web traffic protection statistics -
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky
Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} -
E:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack -
{36ECAF82-3300-8F84-092E-AFF36D6C7040} - E:\Program
Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -
E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network
Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: e:\windows\system32\mswsock32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.orange.co.uk
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 -
HKLM\System\CCS\Services\Tcpip\..\{A8F5FCA6-48BB-4538-8EE1-4BF55A385B87}:
NameServer = 192.168.90.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -
E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
E:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,E:\PROGRA ~1\KASPER~1\KASPER~1\mzvkbd3.dll,E:\PROGRA~1\KASPE R~1\KASPER~1\adialhk.dll,E:\PROGRA~1\KASPER~1\KASP ER~1\kloehk.dll
O20 - Winlogon Notify: !SASWinLogon - E:\Program
Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner -
E:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(file missing)
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab -
E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Firebird Server - MAGIX Instance
(FirebirdServerMAGIXInstance) - MAGIX® - E:\Program
Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: GEARSecurity - GEAR Software - E:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner
- E:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner -
E:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun
Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton Ghost - Symantec Corporation - E:\Program Files\Norton
Ghost\Agent\VProSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
E:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation -
E:\WINDOWS\system32\PGPsdkServ.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. -
E:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner
- E:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) -
CACE Technologies - E:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity
Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) -
file:///E:/WINDOWS/TEMP/msohtml1/01/clip_image002.gif

--
End of file - 10803 bytes


I have now spent several 100 hours trying to resolve this problem :-(

Hi Mike,

This issue persists with me also. A couple of weeks ago, I completely
uninstalled Trend Micro 2009 and installed Microsoft Security Essentials Beta
(Great software from Microsoft, by the way. Can't wait for the release
version).

Anyway, that didn't have any affect on the issue at all, just like in your
case. That pretty much eliminates a security software issue.

The cookies still exist and aren't vanishing, but the issue is that for some
reason there's a loss of IE7 to find them whenever it feels like it.

One oddity I've observed: The loss of cookie access doesn't seem to be tied
to any particular event and just happens whenever. I could be using the
computer all day without the issue, reboot, and everything is still ok. Or I
could be using the computer, go to websites where my settings work fine, then
come back later during the same computer session and the settings are all
gone and have to be reset. Settings can also persist for days or just hours.
There seems to be no rhyme to its reason.


"Mike" wrote:

> Update
>
> I was running Zone Alarm, Avira AV, Spybot and Lavasoft adaware.
> However partly due to this problem and because of a good free offer via my
> bank I now use Kaspersky 8 and have removed Spybot and Lavasoft.
> Clearly ZA and Avira have gone also.
>
> The problem persists.
>
> My security is now:
>
> Kaspersky 8.
> SpywareGuard
> SpywareBlaster
> SupderAntiSpyware 4.
> Malwarebytes' Anti-Malware
>
> Apart from the changes with Kaspersky my system had been stable and well for
> over two years.
>
> No scanner finds any infection.
>
>
> So what could be responsible?
>
> Here then is a hijack this log in case anyone can spot the problem.
> Note that the symantec ref is just for Norton Ghost and that all other
> Norton applications and left overs have been well removed.
>
> Logfile of Trend Micro HijackThis v2.0.2
> Scan saved at 21:45:01, on 17/07/2009
> Platform: Windows XP SP3 (WinNT 5.01.2600)
> MSIE: Internet Explorer v7.00 (7.00.6000.16850)
> Boot mode: Normal
>
> Running processes:
> E:\WINDOWS\System32\smss.exe
> E:\WINDOWS\system32\winlogon.exe
> E:\WINDOWS\system32\services.exe
> E:\WINDOWS\system32\lsass.exe
> E:\WINDOWS\system32\svchost.exe
> E:\WINDOWS\System32\svchost.exe
> E:\WINDOWS\system32\svchost.exe
> E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
> E:\WINDOWS\system32\spoolsv.exe
> E:\WINDOWS\System32\GEARSec.exe
> E:\Program Files\iolo\common\lib\ioloServiceManager.exe
> E:\Program Files\Java\jre6\bin\jqs.exe
> E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
> E:\Program Files\Norton Ghost\Agent\VProSvc.exe
> E:\WINDOWS\system32\nvsvc32.exe
> E:\WINDOWS\system32\PGPsdkServ.exe
> E:\WINDOWS\system32\IoctlSvc.exe
> E:\Program Files\CyberLink\Shared Files\RichVideo.exe
> E:\WINDOWS\system32\tcpsvcs.exe
> E:\WINDOWS\System32\snmp.exe
> E:\WINDOWS\system32\svchost.exe
> E:\WINDOWS\Explorer.EXE
> E:\WINDOWS\SOUNDMAN.EXE
> E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2 a.exe
> E:\WINDOWS\system32\RUNDLL32.EXE
> E:\WINDOWS\System32\svchost.exe
> E:\Program Files\Microsoft IntelliType Pro\itype.exe
> E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H 2.EXE
> E:\WINDOWS\system32\rundll32.exe
> E:\Program Files\Common Files\Symantec Shared\ccApp.exe
> E:\Program Files\Norton Ghost\Agent\GhostTray.exe
> E:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
> E:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
> E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
> E:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
> E:\Program Files\SpywareGuard\sgmain.exe
> E:\Program Files\SpywareGuard\sgbhp.exe
> E:\Program Files\Internet Explorer\IEXPLORE.EXE
> E:\Program Files\Password Safe\pwsafe.exe
> E:\Program Files\Trend Micro\HijackThis\HijackThis.exe
>
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
> http://go.microsoft.com/fwlink/?LinkId=54896
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> http://go.microsoft.com/fwlink/?LinkId=69157
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
> http://go.microsoft.com/fwlink/?LinkId=54896
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
> http://go.microsoft.com/fwlink/?LinkId=54896
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://go.microsoft.com/fwlink/?LinkId=69157
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
> O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper -
> {4A368E80-174F-4872-96B5-0B27DDD11DB2} - E:\Program
> Files\SpywareGuard\dlprotect.dll
> O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - E:\Program
> Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
> O2 - BHO: Encarta Web Companion Helper Object -
> {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - E:\Program Files\Common
> Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
> O2 - BHO: Java(tm) Plug-In 2 SSV Helper -
> {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program
> Files\Java\jre6\bin\jp2ssv.dll
> O2 - BHO: FlashFXP Helper for Internet Explorer -
> {E5A1691B-D188-4419-AD02-90002030B8EE} - E:\PROGRA~1\FlashFXP\IEFlash.dll
> O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -
> E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
> O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4}
> - E:\Program Files\Common Files\Microsoft Shared\Encarta Web
> Companion\ENCWCBAR.DLL
> O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
> O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v2]
> "E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis 2a.exe" /source=HKLM
> O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
> O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
> E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
> O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
> E:\WINDOWS\system32\NvCpl.dll,NvStartup
> O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
> O4 - HKLM\..\Run: [itype] "E:\Program Files\Microsoft IntelliType
> Pro\itype.exe"
> O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series]
> E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H 2.EXE /P30 "EPSON Stylus
> Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
> O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe
> bthprops.cpl,,BluetoothAuthenticationAgent
> O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec
> Shared\ccApp.exe"
> O4 - HKLM\..\Run: [Norton Ghost 10.0] "E:\Program Files\Norton
> Ghost\Agent\GhostTray.exe"
> O4 - HKLM\..\Run: [AVP] "E:\Program Files\Kaspersky Lab\Kaspersky Internet
> Security 2009\avp.exe"
> O4 - HKLM\..\Run: [SmartDefrag] "E:\Program Files\IObit\IObit
> SmartDefrag\IObit SmartDefrag.exe" /StartUp
> O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program
> Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
> O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User
> 'LOCAL SERVICE')
> O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User
> 'NETWORK SERVICE')
> O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User
> 'SYSTEM')
> O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User
> 'Default user')
> O4 - S-1-5-18 Startup: SpywareGuard.lnk = ? (User 'SYSTEM')
> O4 - .DEFAULT Startup: SpywareGuard.lnk = ? (User 'Default user')
> O4 - Startup: SpywareGuard.lnk = ?
> O4 - Global Startup: Device Detector 3.lnk = ?
> O8 - Extra context menu item: Add to Banner Ad Blocker - E:\Program
> Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
> O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
> E:\Program Files\Java\jre6\bin\jp2iexp.dll
> O9 - Extra 'Tools' menuitem: Sun Java Console -
> {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program
> Files\Java\jre6\bin\jp2iexp.dll
> O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} -
> E:\WINDOWS\system32\shdocvw.dll
> O9 - Extra 'Tools' menuitem: &Gears Settings -
> {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - E:\WINDOWS\system32\shdocvw.dll
> O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} -
> E:\Program Files\ieSpell\iespell.dll
> O9 - Extra 'Tools' menuitem: ieSpell -
> {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - E:\Program Files\ieSpell\iespell.dll
> O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} -
> E:\Program Files\ieSpell\iespell.dll
> O9 - Extra 'Tools' menuitem: ieSpell Options -
> {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - E:\Program Files\ieSpell\iespell.dll
> O9 - Extra button: Web traffic protection statistics -
> {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky
> Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
> O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} -
> E:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
> O9 - Extra 'Tools' menuitem: Launch WinHTTrack -
> {36ECAF82-3300-8F84-092E-AFF36D6C7040} - E:\Program
> Files\WinHTTrack\WinHTTrackIEBar.dll
> O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
> E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
> O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -
> E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
> O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
> {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network
> Diagnostic\xpnetdiag.exe
> O10 - Unknown file in Winsock LSP: e:\windows\system32\mswsock32.dll
> O14 - IERESET.INF: START_PAGE_URL=http://www.orange.co.uk
> O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -
> http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
> O17 -
> HKLM\System\CCS\Services\Tcpip\..\{A8F5FCA6-48BB-4538-8EE1-4BF55A385B87}:
> NameServer = 192.168.90.1
> O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -
> E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
> O20 - AppInit_DLLs:
> E:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,E:\PROGRA ~1\KASPER~1\KASPER~1\mzvkbd3.dll,E:\PROGRA~1\KASPE R~1\KASPER~1\adialhk.dll,E:\PROGRA~1\KASPER~1\KASP ER~1\kloehk.dll
> O20 - Winlogon Notify: !SASWinLogon - E:\Program
> Files\SUPERAntiSpyware\SASWINLO.dll
> O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner -
> E:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
> (file missing)
> O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab -
> E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
> O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
> E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
> Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
> O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
> E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
> O23 - Service: Firebird Server - MAGIX Instance
> (FirebirdServerMAGIXInstance) - MAGIX® - E:\Program
> Files\MAGIX\Common\Database\bin\fbserver.exe
> O23 - Service: GEARSecurity - GEAR Software - E:\WINDOWS\System32\GEARSec.exe
> O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
> Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel
> 32\IDriverT.exe
> O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner
> - E:\Program Files\iolo\common\lib\ioloServiceManager.exe
> O23 - Service: iolo System Service (ioloSystemService) - Unknown owner -
> E:\Program Files\iolo\common\lib\ioloServiceManager.exe
> O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun
> Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
> O23 - Service: Norton Ghost - Symantec Corporation - E:\Program Files\Norton
> Ghost\Agent\VProSvc.exe
> O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
> E:\WINDOWS\system32\nvsvc32.exe
> O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation -
> E:\WINDOWS\system32\PGPsdkServ.exe
> O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. -
> E:\WINDOWS\system32\IoctlSvc.exe
> O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner
> - E:\Program Files\CyberLink\Shared Files\RichVideo.exe
> O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) -
> CACE Technologies - E:\Program Files\WinPcap\rpcapd.exe
> O23 - Service: ServiceLayer - Nokia. - E:\Program Files\PC Connectivity
> Solution\ServiceLayer.exe
> O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program
> Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
> O24 - Desktop Component 0: (no name) -
> file:///E:/WINDOWS/TEMP/msohtml1/01/clip_image002.gif
>
> --
> End of file - 10803 bytes
>
>
> I have now spent several 100 hours trying to resolve this problem :-(

Hi James

Mine occurs if I log out of IE then go back in again (sometimes)
If you open the files location and look you will see the cookies with expiry
date set for some long future date.
If you double click them they will run so you can see what is inside.
However, if you then log out and back in you will still find them in the
list but if you try and run them you get a path not found error.
Does this mean they are being removed from cookie.dat?
What ever it is it is really annoying.

Thread history:
http://groups.google.com/group/micro...e9544e47e65655

> So what could be responsible?

Injudicious use of Registry Mechanic, for one. If you think your Registry
needs to be "cleaned" or "repaired," read
http://aumha.net/viewtopic.php?t=28099 and draw your own conclusions.

Mike, if I'd been having such problems for well over a month (as you have),
I would have backed up my personal data, formatted & done a Clean Install of
WinXP by now.

Good luck!


Mike wrote:
> Update
>
> I was running Zone Alarm, Avira AV, Spybot and Lavasoft adaware.
> However partly due to this problem and because of a good free offer via my
> bank I now use Kaspersky 8 and have removed Spybot and Lavasoft.
> Clearly ZA and Avira have gone also.
>
> The problem persists.
>
> My security is now:
>
> Kaspersky 8.
> SpywareGuard
> SpywareBlaster
> SupderAntiSpyware 4.
> Malwarebytes' Anti-Malware
>
> Apart from the changes with Kaspersky my system had been stable and well
> for
> over two years.
>
> No scanner finds any infection.
>
>
> So what could be responsible?

I had this problem with the ccleaner forum. If I logged on then read the
forum and then closed the forum without logging off, things were fine. I
could open the forum and I was still logged in. If I closed IE6, then open
IE6, and opened ccleaner forum, I had to log in again.

I did a google search and tried a number of things but nothing worked. Then
I posted the problem to the ccleaner forum and by magic, it now works. No
one said what they did. Also, that site was to only one that caused me a
problem.

I know this is frustrating and there does not seem to be any help. Good
Luck, David


"Mike" <Mike@discussions.microsoft.com> wrote in message
news:74189423-C369-4D67-9CCF-B91C8C27E97F@microsoft.com...
> Hi James
>
> Mine occurs if I log out of IE then go back in again (sometimes)
> If you open the files location and look you will see the cookies with
> expiry
> date set for some long future date.
> If you double click them they will run so you can see what is inside.
> However, if you then log out and back in you will still find them in the
> list but if you try and run them you get a path not found error.
> Does this mean they are being removed from cookie.dat?
> What ever it is it is really annoying.

[I suspect you may have upgraded CCleaner and didn't configure it to run at
Startup this time around.]

David wrote:
> I had this problem with the ccleaner forum. If I logged on then read the
> forum and then closed the forum without logging off, things were fine. I
> could open the forum and I was still logged in. If I closed IE6, then
> open
> IE6, and opened ccleaner forum, I had to log in again.
>
> I did a google search and tried a number of things but nothing worked.
> Then
> I posted the problem to the ccleaner forum and by magic, it now works. No
> one said what they did. Also, that site was to only one that caused me a
> problem.
>
> I know this is frustrating and there does not seem to be any help. Good
> Luck, David
>
>
> "Mike" <Mike@discussions.microsoft.com> wrote in message
> news:74189423-C369-4D67-9CCF-B91C8C27E97F@microsoft.com...
>> Hi James
>>
>> Mine occurs if I log out of IE then go back in again (sometimes)
>> If you open the files location and look you will see the cookies with
>> expiry
>> date set for some long future date.
>> If you double click them they will run so you can see what is inside.
>> However, if you then log out and back in you will still find them in the
>> list but if you try and run them you get a path not found error.
>> Does this mean they are being removed from cookie.dat?
>> What ever it is it is really annoying.

No and I did not make any changes after my posting. A week later, it
started working. I have never had ccleaner run at startup.

David

"PA Bear [MS MVP]" <PABearMVP******.com> wrote in message
news:OwacBjICKHA.3732@TK2MSFTNGP02.phx.gbl...
> [I suspect you may have upgraded CCleaner and didn't configure it to run
> at Startup this time around.]
>
> David wrote:
>> I had this problem with the ccleaner forum. If I logged on then read the
>> forum and then closed the forum without logging off, things were fine. I
>> could open the forum and I was still logged in. If I closed IE6, then
>> open
>> IE6, and opened ccleaner forum, I had to log in again.
>>
>> I did a google search and tried a number of things but nothing worked.
>> Then
>> I posted the problem to the ccleaner forum and by magic, it now works.
>> No
>> one said what they did. Also, that site was to only one that caused me a
>> problem.
>>
>> I know this is frustrating and there does not seem to be any help. Good
>> Luck, David
>>
>>
>> "Mike" <Mike@discussions.microsoft.com> wrote in message
>> news:74189423-C369-4D67-9CCF-B91C8C27E97F@microsoft.com...
>>> Hi James
>>>
>>> Mine occurs if I log out of IE then go back in again (sometimes)
>>> If you open the files location and look you will see the cookies with
>>> expiry
>>> date set for some long future date.
>>> If you double click them they will run so you can see what is inside.
>>> However, if you then log out and back in you will still find them in the
>>> list but if you try and run them you get a path not found error.
>>> Does this mean they are being removed from cookie.dat?
>>> What ever it is it is really annoying.
>

What CCleaner version is installed? Does CCleaner run at start-up now? Did
it do so a few weeks ago?

David wrote:
> No and I did not make any changes after my posting. A week later, it
> started working. I have never had ccleaner run at startup.
>
> David
>
> "PA Bear [MS MVP]" <PABearMVP******.com> wrote in message
> news:OwacBjICKHA.3732@TK2MSFTNGP02.phx.gbl...
>> [I suspect you may have upgraded CCleaner and didn't configure it to run
>> at Startup this time around.]
>>
>> David wrote:
>>> I had this problem with the ccleaner forum. If I logged on then read
>>> the
>>> forum and then closed the forum without logging off, things were fine.
>>> I
>>> could open the forum and I was still logged in. If I closed IE6, then
>>> open
>>> IE6, and opened ccleaner forum, I had to log in again.
>>>
>>> I did a google search and tried a number of things but nothing worked.
>>> Then
>>> I posted the problem to the ccleaner forum and by magic, it now works.
>>> No
>>> one said what they did. Also, that site was to only one that caused me
>>> a
>>> problem.
>>>
>>> I know this is frustrating and there does not seem to be any help. Good
>>> Luck, David
>>>
>>>
>>> "Mike" <Mike@discussions.microsoft.com> wrote in message
>>> news:74189423-C369-4D67-9CCF-B91C8C27E97F@microsoft.com...
>>>> Hi James
>>>>
>>>> Mine occurs if I log out of IE then go back in again (sometimes)
>>>> If you open the files location and look you will see the cookies with
>>>> expiry
>>>> date set for some long future date.
>>>> If you double click them they will run so you can see what is inside.
>>>> However, if you then log out and back in you will still find them in
>>>> the
>>>> list but if you try and run them you get a path not found error.
>>>> Does this mean they are being removed from cookie.dat?
>>>> What ever it is it is really annoying.

I updated ccleaner last night so I do not know the old version number. This
problem was about several months ago and I spent several weeks searching to
find out the answer before I gave up and made the post to the forum.

I do not run ccleaner at startup now or in the past. About once a week, I
open it and click on fix.

I do not understand what running at startup or the ccleaner version has to
do with logging into the ccleaner forum. To me, they are separate issues.
I have never had a ccleaner problem, only a ccleaner forum staying logged in
issue. My initial post discussed the ccleaner form issue, not a ccleaner
problem.

David


"PA Bear [MS MVP]" <PABearMVP******.com> wrote in message
news:OfEgoVJCKHA.1376@TK2MSFTNGP02.phx.gbl...
> What CCleaner version is installed? Does CCleaner run at start-up now?
> Did it do so a few weeks ago?
>
> David wrote:
>> No and I did not make any changes after my posting. A week later, it
>> started working. I have never had ccleaner run at startup.
>>
>> David
>>
>> "PA Bear [MS MVP]" <PABearMVP******.com> wrote in message
>> news:OwacBjICKHA.3732@TK2MSFTNGP02.phx.gbl...
>>> [I suspect you may have upgraded CCleaner and didn't configure it to run
>>> at Startup this time around.]
>>>
>>> David wrote:
>>>> I had this problem with the ccleaner forum. If I logged on then read
>>>> the
>>>> forum and then closed the forum without logging off, things were fine.
>>>> I
>>>> could open the forum and I was still logged in. If I closed IE6, then
>>>> open
>>>> IE6, and opened ccleaner forum, I had to log in again.
>>>>
>>>> I did a google search and tried a number of things but nothing worked.
>>>> Then
>>>> I posted the problem to the ccleaner forum and by magic, it now works.
>>>> No
>>>> one said what they did. Also, that site was to only one that caused me
>>>> a
>>>> problem.
>>>>
>>>> I know this is frustrating and there does not seem to be any help.
>>>> Good
>>>> Luck, David
>>>>
>>>>
>>>> "Mike" <Mike@discussions.microsoft.com> wrote in message
>>>> news:74189423-C369-4D67-9CCF-B91C8C27E97F@microsoft.com...
>>>>> Hi James
>>>>>
>>>>> Mine occurs if I log out of IE then go back in again (sometimes)
>>>>> If you open the files location and look you will see the cookies with
>>>>> expiry
>>>>> date set for some long future date.
>>>>> If you double click them they will run so you can see what is inside.
>>>>> However, if you then log out and back in you will still find them in
>>>>> the
>>>>> list but if you try and run them you get a path not found error.
>>>>> Does this mean they are being removed from cookie.dat?
>>>>> What ever it is it is really annoying.
>

"Mike" <Mike@discussions.microsoft.com> wrote in message news:74189423-C369-4D67-9CCF-B91C8C27E97F@microsoft.com...
> Hi James
>
> Mine occurs if I log out of IE then go back in again (sometimes)
> If you open the files location and look you will see the cookies with expiry
> date set for some long future date.
> If you double click them they will run so you can see what is inside.
> However, if you then log out and back in you will still find them in the
> list

> but if you try and run them you get a path not found error.
> Does this mean they are being removed from cookie.dat?


It would help if you explained what you meant by "run them".
E.g. if you are doing this in the TIF Viewer the reason they
would be displayed in there is because they are in the
Cookies index.dat. So the "not found" symptom would then
probably be an indication that the .txt file has been deleted
from the cache and then that could be a sign that something
is deleting files in the Cookies directory but not using the proper
API which would also get the entry out of the Cookies index.dat.

I would try running ProcMon to check on that hypothesis. ; )
Another diagnostic that I would try concurrently is Fiddler2
because my impression is that it happens mostly with sites
that do a lot of redirection, so I have been wondering if the
Cookie sometimes gets saved using one alias but needs to be
presented by another, etc. ProcMon might help clarify that too.


> What ever it is it is really annoying.

FWIW I think I have also been seeing this symptom on Vista
but I don't use Vista often enough to have been sufficiently
annoyed to try to do anything about it. Diagnosing it on XP
would be simpler I suspect. ; )


Good luck

Robert Aldwinckle
---

Hi

Sorry for some reason reply notification failed!

I have installed ProcMon.

Can you tell me what to look for and how to set it up please?

Just out of interest.

Today I tried setting my cookie folder to read only (this is the filde that
holds the text viewable cookies) this made no differance.
I then set index dat to read only, again cookies were lost.

Cheers

Mike

"Robert Aldwinckle" wrote:

>
> "Mike" <Mike@discussions.microsoft.com> wrote in message news:74189423-C369-4D67-9CCF-B91C8C27E97F@microsoft.com...
> > Hi James
> >
> > Mine occurs if I log out of IE then go back in again (sometimes)
> > If you open the files location and look you will see the cookies with expiry
> > date set for some long future date.
> > If you double click them they will run so you can see what is inside.
> > However, if you then log out and back in you will still find them in the
> > list
>
> > but if you try and run them you get a path not found error.
> > Does this mean they are being removed from cookie.dat?
>
>
> It would help if you explained what you meant by "run them".
> E.g. if you are doing this in the TIF Viewer the reason they
> would be displayed in there is because they are in the
> Cookies index.dat. So the "not found" symptom would then
> probably be an indication that the .txt file has been deleted
> from the cache and then that could be a sign that something
> is deleting files in the Cookies directory but not using the proper
> API which would also get the entry out of the Cookies index.dat.
>
> I would try running ProcMon to check on that hypothesis. ; )
> Another diagnostic that I would try concurrently is Fiddler2
> because my impression is that it happens mostly with sites
> that do a lot of redirection, so I have been wondering if the
> Cookie sometimes gets saved using one alias but needs to be
> presented by another, etc. ProcMon might help clarify that too.
>
>
> > What ever it is it is really annoying.
>
> FWIW I think I have also been seeing this symptom on Vista
> but I don't use Vista often enough to have been sufficiently
> annoyed to try to do anything about it. Diagnosing it on XP
> would be simpler I suspect. ; )
>
>
> Good luck
>
> Robert Aldwinckle
> ---
>
>
>

Hi

Just been looking at the registry of this machine (with problem) and that of
my laptop running almost the same software but without the problem.

Here is what I found.

Problem machine first:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet
Settings\5.0\Cache\Cookies]
"PerUserItem"=dword:00000001

Laptop

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Internet
Settings\5.0\Cache\Cookies]
"CachePrefix"="Cookie:"
"CacheLimit"=dword:00002000


Note there seems to be a significant difference!

"Mike" <Mike@discussions.microsoft.com> wrote in message news:2E14597E-B205-4631-A4D6-D6204FE84C4C@microsoft.com...
> Hi
>
> Sorry for some reason reply notification failed!
>
> I have installed ProcMon.
>
> Can you tell me what to look for and how to set it up please?


I'd try filtering on Process Name is iexplore.exe (Include)
and Path contains Cookie (Include). And probably try
highlighting Operation is WriteFile. Etc.


---


>
> Just out of interest.
>
> Today I tried setting my cookie folder to read only (this is the filde that
> holds the text viewable cookies) this made no differance.
> I then set index dat to read only, again cookies were lost.
>
> Cheers
>
> Mike
>
> "Robert Aldwinckle" wrote:
>
>>
>> "Mike" <Mike@discussions.microsoft.com> wrote in message news:74189423-C369-4D67-9CCF-B91C8C27E97F@microsoft.com...
>> > Hi James
>> >
>> > Mine occurs if I log out of IE then go back in again (sometimes)
>> > If you open the files location and look you will see the cookies with expiry
>> > date set for some long future date.
>> > If you double click them they will run so you can see what is inside.
>> > However, if you then log out and back in you will still find them in the
>> > list
>>
>> > but if you try and run them you get a path not found error.
>> > Does this mean they are being removed from cookie.dat?
>>
>>
>> It would help if you explained what you meant by "run them".
>> E.g. if you are doing this in the TIF Viewer the reason they
>> would be displayed in there is because they are in the
>> Cookies index.dat. So the "not found" symptom would then
>> probably be an indication that the .txt file has been deleted
>> from the cache and then that could be a sign that something
>> is deleting files in the Cookies directory but not using the proper
>> API which would also get the entry out of the Cookies index.dat.
>>
>> I would try running ProcMon to check on that hypothesis. ; )
>> Another diagnostic that I would try concurrently is Fiddler2
>> because my impression is that it happens mostly with sites
>> that do a lot of redirection, so I have been wondering if the
>> Cookie sometimes gets saved using one alias but needs to be
>> presented by another, etc. ProcMon might help clarify that too.
>>
>>
>> > What ever it is it is really annoying.
>>
>> FWIW I think I have also been seeing this symptom on Vista
>> but I don't use Vista often enough to have been sufficiently
>> annoyed to try to do anything about it. Diagnosing it on XP
>> would be simpler I suspect. ; )
>>
>>
>> Good luck
>>
>> Robert Aldwinckle
>> ---
>>
>>
>>

Hi Robert
I set up ProcMon as you said.
I then started it, started IE and logged into Google then shut down IE.
Below you will see the results. (over two posts)

I note there is two refs to 'delete'

16:39:11.9859328 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies SUCCESS Desired Access: Read Data/List Directory,
Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert,
Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:39:11.9862019 IEXPLORE.EXE 2188 QueryDirectory E:\Documents and
Settings\Mike\Cookies SUCCESS 0: ., 1: .., 2: index.dat, 3:
mike@bs.serving-sys[1].txt, 4: mike@facebook[1].txt, 5:
mike@serving-sys[2].txt
16:39:11.9866567 IEXPLORE.EXE 2188 QueryDirectory E:\Documents and
Settings\Mike\Cookies NO MORE FILES
16:39:11.9869059 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies SUCCESS
16:39:12.0559218 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Desired Access: Read Data/List
Directory, Read Attributes, Disposition: Open, Options: Non-Directory File,
Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a,
OpenResult: Opened
16:39:12.0561796 IEXPLORE.EXE 2188 CreateFileMapping E:\Documents
and Settings\Mike\Cookies\index.dat SUCCESS SyncType:
SyncTypeCreateSection, PageProtection: PAGE_READWRITE
16:39:12.0569863 IEXPLORE.EXE 2188 QueryStandardInformationFile
E:\Documents and Settings\Mike\Cookies\index.dat SUCCESS AllocationSize:
65,536, EndOfFile: 65,536, NumberOfLinks: 1, DeletePending: False, Directory:
False
16:39:12.0576483 IEXPLORE.EXE 2188 CreateFileMapping E:\Documents
and Settings\Mike\Cookies\index.dat SUCCESS SyncType: SyncTypeOther
16:39:12.0909036 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS
16:39:12.9218078 IEXPLORE.EXE 2188 RegOpenKey
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\5.0\Cache\Cookies SUCCESS Desired Access: Query Value, Set Value,
Create Sub Key, Enumerate Sub Keys
16:39:12.9218588 IEXPLORE.EXE 2188 RegQueryValue
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\5.0\Cache\Cookies\PerUserItem SUCCESS Type: REG_DWORD, Length: 4,
Data: 1
16:39:12.9219950 IEXPLORE.EXE 2188 RegCloseKey
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\5.0\Cache\Cookies SUCCESS
16:39:12.9220456 IEXPLORE.EXE 2188 RegOpenKey
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\5.0\Cache\Cookies SUCCESS Desired Access: Query Value, Set Value,
Create Sub Key, Enumerate Sub Keys
16:39:12.9222068 IEXPLORE.EXE 2188 RegQueryValue
HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\User Shell
Folders\Cookies SUCCESS Type: REG_EXPAND_SZ, Length: 44, Data:
%USERPROFILE%\Cookies
16:39:12.9226505 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:36:34, LastWriteTime: 27/07/2009 16:36:34,
ChangeTime: 27/07/2009 16:36:34, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:39:12.9228095 IEXPLORE.EXE 2188 RegSetValue
HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Shell Folders\Cookies
SUCCESS Type: REG_SZ, Length: 78, Data: E:\Documents and
Settings\Mike\Cookies
16:39:12.9235041 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:36:34, LastWriteTime: 27/07/2009 16:36:34,
ChangeTime: 27/07/2009 16:36:34, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:39:12.9235444 IEXPLORE.EXE 2188 RegQueryValue
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\5.0\Cache\Cookies\CachePrefix SUCCESS Type: REG_SZ, Length: 16,
Data: Cookie:
16:39:12.9236269 IEXPLORE.EXE 2188 RegQueryValue
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\5.0\Cache\Cookies\CachePrefix SUCCESS Type: REG_SZ, Length: 16,
Data: Cookie:
16:39:12.9236945 IEXPLORE.EXE 2188 RegQueryValue
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\5.0\Cache\Cookies\CacheLimit SUCCESS Type: REG_DWORD, Length: 4,
Data: 8192
16:39:12.9239411 IEXPLORE.EXE 2188 RegCloseKey
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\5.0\Cache\Cookies SUCCESS
16:39:12.9361799 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:36:34, LastWriteTime: 27/07/2009 16:36:34,
ChangeTime: 27/07/2009 16:36:34, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:39:12.9365287 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies SUCCESS Desired Access: Write Attributes, Synchronize,
Disposition: Open, Options: Synchronous IO Non-Alert, Open Reparse Point,
Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a,
OpenResult: Opened
16:39:12.9368575 IEXPLORE.EXE 2188 SetBasicInformationFile
E:\Documents and Settings\Mike\Cookies SUCCESS CreationTime: 01/01/1601
01:00:00, LastAccessTime: 01/01/1601 01:00:00, LastWriteTime: 01/01/1601
01:00:00, ChangeTime: 01/01/1601 01:00:00, FileAttributes: HSNNCI
16:39:12.9373846 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies SUCCESS
16:39:12.9379195 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Desired Access: Generic
Read/Write, Disposition: OpenIf, Options: Synchronous IO Non-Alert,
Non-Directory File, Random Access, Attributes: HSNCI, ShareMode: Read, Write,
AllocationSize: 0, OpenResult: Opened
16:39:12.9386175 IEXPLORE.EXE 2188 SetBasicInformationFile
E:\Documents and Settings\Mike\Cookies\index.dat SUCCESS CreationTime:
01/01/1601 01:00:00, LastAccessTime: 01/01/1601 01:00:00, LastWriteTime:
27/07/2009 16:39:12, ChangeTime: 01/01/1601 01:00:00, FileAttributes: n/a
16:39:12.9391550 IEXPLORE.EXE 2188 QueryStandardInformationFile
E:\Documents and Settings\Mike\Cookies\index.dat SUCCESS AllocationSize:
65,536, EndOfFile: 65,536, NumberOfLinks: 1, DeletePending: False, Directory:
False
16:39:12.9891336 IEXPLORE.EXE 2188 RegQueryValue
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\PerUserCookies NAME NOT FOUND Length: 144
16:39:12.9891862 IEXPLORE.EXE 2188 RegQueryValue
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\LeashLegacyCookies NAME NOT FOUND Length: 144
16:40:00.6855435 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[3].txt NAME NOT FOUND Desired
Access: Generic Read, Disposition: Open, Options: Sequential Access,
Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read,
Delete, AllocationSize: n/a
16:40:00.6858552 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[3].txt NAME NOT FOUND
16:40:00.8690293 IEXPLORE.EXE 2188 RegOpenKey
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet
Settings\Cache\Special Paths\Cookies SUCCESS Desired Access: Read
16:40:00.8691263 IEXPLORE.EXE 2188 RegQueryValue
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet
Settings\Cache\Special Paths\Cookies\Directory SUCCESS Type: REG_EXPAND_SZ,
Length: 44, Data: %USERPROFILE%\Cookies
16:40:00.8692169 IEXPLORE.EXE 2188 RegQueryValue
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet
Settings\Cache\Special Paths\Cookies\Directory SUCCESS Type: REG_EXPAND_SZ,
Length: 44, Data: %USERPROFILE%\Cookies
16:40:00.8692816 IEXPLORE.EXE 2188 RegCloseKey
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet
Settings\Cache\Special Paths\Cookies SUCCESS
16:40:00.8695438 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies SUCCESS Desired Access: Read Data/List Directory,
Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert,
Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult:
Opened
16:40:00.8697506 IEXPLORE.EXE 2188 QueryDirectory E:\Documents and
Settings\Mike\Cookies\* SUCCESS Filter: *, 1: .
16:40:00.8699252 IEXPLORE.EXE 2188 QueryDirectory E:\Documents and
Settings\Mike\Cookies SUCCESS 0: .., 1: index.dat, 2:
mike@bs.serving-sys[1].txt, 3: mike@facebook[1].txt, 4:
mike@serving-sys[2].txt
16:40:00.8702292 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\index.dat SHARING VIOLATION Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a
16:40:00.8704998 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@bs.serving-sys[1].txt SUCCESS Desired Access:
Read Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:00.8707084 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@bs.serving-sys[1].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:00.8708588 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@bs.serving-sys[1].txt SUCCESS
Delete: True
16:40:00.8710417 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@bs.serving-sys[1].txt SUCCESS
16:40:00.8716033 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@facebook[1].txt SUCCESS Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:00.8718218 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@facebook[1].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:00.8719744 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@facebook[1].txt SUCCESS Delete:
True
16:40:00.8721522 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@facebook[1].txt SUCCESS
16:40:00.8726583 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@serving-sys[2].txt SUCCESS Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:00.8728754 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@serving-sys[2].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:00.8730439 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@serving-sys[2].txt SUCCESS
Delete: True
16:40:00.8733482 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@serving-sys[2].txt SUCCESS
16:40:00.8737262 IEXPLORE.EXE 2188 QueryDirectory E:\Documents and
Settings\Mike\Cookies NO MORE FILES
16:40:00.8738859 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies SUCCESS
16:40:03.0365875 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt NAME NOT FOUND Desired
Access: Generic Read, Disposition: Open, Options: Sequential Access,
Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read,
Delete, AllocationSize: n/a
16:40:03.0368904 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt NAME NOT FOUND
16:40:03.0371703 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:00, LastWriteTime: 27/07/2009 16:40:00,
ChangeTime: 27/07/2009 16:40:00, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:03.0373865 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt NAME NOT FOUND
16:40:03.0376084 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:03.0383722 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS
16:40:03.0387363 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: None,
AllocationSize: n/a, OpenResult: Opened
16:40:03.0389585 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS
AllocationSize: 0
16:40:03.0392234 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS Offset: 0, Length: 133
16:40:03.0397049 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS
16:40:03.0418451 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS CreationTime:
27/07/2009 16:40:03, LastAccessTime: 27/07/2009 16:40:03, LastWriteTime:
27/07/2009 16:40:03, ChangeTime: 27/07/2009 16:40:03, AllocationSize: 136,
EndOfFile: 133, FileAttributes: ANCI
16:40:03.0419415 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:03.0422871 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 12,288,
I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0434864 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:03, LastWriteTime: 27/07/2009 16:40:03,
ChangeTime: 27/07/2009 16:40:03, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:15.0438438 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt NAME NOT FOUND
16:40:15.0441139 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS Desired Access: Generic
Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:15.0447789 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS
16:40:15.0452327 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS Desired Access: Generic
Write, Read Attributes, Disposition: Open, Options: Synchronous IO Non-Alert,
Non-Directory File, Attributes: NCI, ShareMode: None, AllocationSize: n/a,
OpenResult: Opened
16:40:15.0455227 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google[1].txt SUCCESS
AllocationSize: 0
16:40:15.0457821 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS Offset: 0, Length: 267
16:40:15.0460302 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS
16:40:15.0471656 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS CreationTime: 27/07/2009
16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009
16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 272, EndOfFile:
267, FileAttributes: ANCI
16:40:15.0472678 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0474264 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0475451 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 24,576, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0481742 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009 16:40:15,
ChangeTime: 27/07/2009 16:40:15, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:15.0484989 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt NAME NOT FOUND
16:40:15.0488853 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:15.0498601 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
16:40:15.0502901 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: None,
AllocationSize: n/a, OpenResult: Opened
16:40:15.0505235 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
AllocationSize: 0
16:40:15.0507525 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS Offset: 0, Length: 280
16:40:15.0509996 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
16:40:15.0521557 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 280,
EndOfFile: 280, FileAttributes: ANCI
16:40:15.0522839 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0525311 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0526550 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 24,576, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0532093 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009 16:40:15,
ChangeTime: 27/07/2009 16:40:15, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:15.0535507 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 280,
EndOfFile: 280, FileAttributes: ANCI
16:40:15.0538796 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt NAME NOT FOUND
16:40:15.0542378 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:15.0553988 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS
16:40:15.0561874 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: None,
AllocationSize: n/a, OpenResult: Opened
16:40:15.0564697 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS
AllocationSize: 0
16:40:15.0567099 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS Offset: 0, Length: 280
16:40:15.0569648 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt FAST IO DISALLOWED Offset:
280, Length: 108
16:40:15.0571091 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS Offset: 280, Length:
108
16:40:15.0573056 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS
16:40:15.0584709 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 392,
EndOfFile: 388, FileAttributes: ANCI
16:40:15.0588350 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 280,
EndOfFile: 280, FileAttributes: ANCI
16:40:15.0591843 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:15.0595162 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:15.0597695 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
Delete: True
16:40:15.0600495 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
16:40:15.0603789 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0605415 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0606676 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 28,672, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0612536 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009 16:40:15,
ChangeTime: 27/07/2009 16:40:15, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:15.0616037 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS CreationTime: 27/07/2009
16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009
16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 272, EndOfFile:
267, FileAttributes: ANCI
16:40:15.0618294 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt NAME NOT FOUND
16:40:15.0620654 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS Desired Access: Generic
Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:15.0626917 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS
16:40:15.0630298 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS Desired Access: Generic
Write, Read Attributes, Disposition: Open, Options: Synchronous IO Non-Alert,
Non-Directory File, Attributes: NCI, ShareMode: None, AllocationSize: n/a,
OpenResult: Opened
16:40:15.0632451 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google[2].txt SUCCESS
AllocationSize: 0
16:40:15.0635284 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS Offset: 0, Length: 267
16:40:15.0637830 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt FAST IO DISALLOWED Offset: 267,
Length: 82
16:40:15.0639244 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS Offset: 267, Length: 82
16:40:15.0641034 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS
16:40:15.0653658 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS CreationTime: 27/07/2009
16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009
16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 352, EndOfFile:
349, FileAttributes: ANCI
16:40:15.0657805 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS CreationTime: 27/07/2009
16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009
16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 272, EndOfFile:
267, FileAttributes: ANCI
16:40:15.0674805 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:15.0678493 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@google[1].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:15.0705256 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google[1].txt SUCCESS Delete:
True
16:40:15.0711351 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS