Part 2.

16:40:15.0715509 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0717070 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0718147 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 24,576, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0724104 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009 16:40:15,
ChangeTime: 27/07/2009 16:40:15, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:15.0727019 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt NAME NOT FOUND
16:40:15.0729440 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS Desired Access: Generic
Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:15.0735419 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS
16:40:15.0739037 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS Desired Access: Generic
Write, Read Attributes, Disposition: Open, Options: Synchronous IO Non-Alert,
Non-Directory File, Attributes: NCI, ShareMode: None, AllocationSize: n/a,
OpenResult: Opened
16:40:15.0741202 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google[1].txt SUCCESS
AllocationSize: 0
16:40:15.0743442 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS Offset: 0, Length: 267
16:40:15.0745902 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt FAST IO DISALLOWED Offset: 267,
Length: 82
16:40:15.0747324 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS Offset: 267, Length: 82
16:40:15.0749129 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt FAST IO DISALLOWED Offset: 349,
Length: 82
16:40:15.0750524 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS Offset: 349, Length: 82
16:40:15.0752668 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS
16:40:15.0764238 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google[1].txt SUCCESS CreationTime: 27/07/2009
16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009
16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 432, EndOfFile:
431, FileAttributes: ANCI
16:40:15.0767983 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS CreationTime: 27/07/2009
16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009
16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 352, EndOfFile:
349, FileAttributes: ANCI
16:40:15.0771723 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:15.0775082 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@google[2].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:15.0777358 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google[2].txt SUCCESS Delete:
True
16:40:15.0780368 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google[2].txt SUCCESS
16:40:15.0783753 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0785344 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.0786510 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 24,576, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.2010024 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009 16:40:15,
ChangeTime: 27/07/2009 16:40:15, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:15.2013885 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt NAME NOT FOUND
16:40:15.2016451 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:15.2025830 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
16:40:15.2032816 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: None,
AllocationSize: n/a, OpenResult: Opened
16:40:15.2036645 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
AllocationSize: 0
16:40:15.2039263 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS Offset: 0, Length: 108
16:40:15.2041826 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
16:40:15.2054570 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 112,
EndOfFile: 108, FileAttributes: ANCI
16:40:15.2058072 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 392,
EndOfFile: 388, FileAttributes: ANCI
16:40:15.2061615 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:15.2064948 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:15.2067294 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS
Delete: True
16:40:15.2070077 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS
16:40:15.2073360 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.2074912 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.2076105 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 24,576, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.2081497 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009 16:40:15,
ChangeTime: 27/07/2009 16:40:15, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:15.2084499 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 112,
EndOfFile: 108, FileAttributes: ANCI
16:40:15.2087403 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt NAME NOT FOUND
16:40:15.2089837 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:15.2096716 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS
16:40:15.2103826 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: None,
AllocationSize: n/a, OpenResult: Opened
16:40:15.2109386 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS
AllocationSize: 0
16:40:15.2112659 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS Offset: 0, Length: 108
16:40:15.2115514 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt FAST IO DISALLOWED Offset:
108, Length: 285
16:40:15.2117768 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS Offset: 108, Length:
285
16:40:15.2120149 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS
16:40:15.2131738 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[2].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 400,
EndOfFile: 393, FileAttributes: ANCI
16:40:15.2135201 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 112,
EndOfFile: 108, FileAttributes: ANCI
16:40:15.2138696 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:15.2142243 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:15.2144699 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
Delete: True
16:40:15.2147418 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@www.google[1].txt SUCCESS
16:40:15.2150851 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.2152544 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.2153694 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 28,672, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.2171815 IEXPLORE.EXE 2188 QueryOpen C:\Temp IE\Temporary
Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm NAME NOT FOUND
16:40:15.2176051 IEXPLORE.EXE 2188 CreateFile C:\Temp IE\Temporary
Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm SUCCESS Desired
Access: Generic Write, Read Attributes, Disposition: Create, Options:
Synchronous IO Non-Alert, Non-Directory File, Attributes: NCI, ShareMode:
Read, Write, Delete, AllocationSize: 0, OpenResult: Created
16:40:15.2319096 IEXPLORE.EXE 2188 WriteFile C:\Temp IE\Temporary
Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm SUCCESS Offset: 0,
Length: 1,220
16:40:15.2323170 IEXPLORE.EXE 2188 QueryBasicInformationFile
C:\Temp IE\Temporary Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm
FAST IO DISALLOWED
16:40:15.2325154 IEXPLORE.EXE 2188 QueryBasicInformationFile
C:\Temp IE\Temporary Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm
SUCCESS CreationTime: 27/07/2009 16:40:15, LastAccessTime: 27/07/2009
16:40:15, LastWriteTime: 27/07/2009 16:40:15, ChangeTime: 27/07/2009
16:40:15, FileAttributes: ANCI
16:40:15.2327257 IEXPLORE.EXE 2188 CloseFile C:\Temp IE\Temporary
Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm SUCCESS
16:40:15.2352935 IEXPLORE.EXE 2188 CreateFile C:\Temp IE\Temporary
Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm SUCCESS Desired
Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert,
Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize:
n/a, OpenResult: Opened
16:40:15.4012074 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009 16:40:15,
ChangeTime: 27/07/2009 16:40:15, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:15.4015082 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS CreationTime:
27/07/2009 16:40:03, LastAccessTime: 27/07/2009 16:40:03, LastWriteTime:
27/07/2009 16:40:03, ChangeTime: 27/07/2009 16:40:03, AllocationSize: 136,
EndOfFile: 133, FileAttributes: ANCI
16:40:15.4017272 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt NAME NOT FOUND
16:40:15.4019634 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:15.4027817 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS
16:40:15.4032052 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: None,
AllocationSize: n/a, OpenResult: Opened
16:40:15.4034274 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS
AllocationSize: 0
16:40:15.4036541 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS Offset: 0, Length: 133
16:40:15.4039039 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt FAST IO DISALLOWED Offset:
133, Length: 269
16:40:15.4040455 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS Offset: 133, Length:
269
16:40:15.4042388 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS
16:40:15.4055082 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 408,
EndOfFile: 402, FileAttributes: ANCI
16:40:15.4058681 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS CreationTime:
27/07/2009 16:40:03, LastAccessTime: 27/07/2009 16:40:03, LastWriteTime:
27/07/2009 16:40:03, ChangeTime: 27/07/2009 16:40:03, AllocationSize: 136,
EndOfFile: 133, FileAttributes: ANCI
16:40:15.4062172 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:15.4065675 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:15.4068003 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS
Delete: True
16:40:15.4070864 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS
16:40:15.4074701 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.4076257 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.4077471 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 24,576, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.4083205 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies SUCCESS CreationTime: 14/07/2005 16:35:28,
LastAccessTime: 27/07/2009 16:40:15, LastWriteTime: 27/07/2009 16:40:15,
ChangeTime: 27/07/2009 16:40:15, AllocationSize: 0, EndOfFile: 0,
FileAttributes: HSDNCI
16:40:15.4085940 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt NAME NOT FOUND
16:40:15.4088344 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Create, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: Read, Write,
Delete, AllocationSize: 0, OpenResult: Created
16:40:15.4094436 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS
16:40:15.4097793 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS Desired Access:
Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO
Non-Alert, Non-Directory File, Attributes: NCI, ShareMode: None,
AllocationSize: n/a, OpenResult: Opened
16:40:15.4099927 IEXPLORE.EXE 2188 SetAllInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS
AllocationSize: 0
16:40:15.4105695 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS Offset: 0, Length: 133
16:40:15.4108394 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt FAST IO DISALLOWED Offset:
133, Length: 269
16:40:15.4110679 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS Offset: 133, Length:
269
16:40:15.4113215 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt FAST IO DISALLOWED Offset:
402, Length: 84
16:40:15.4115063 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS Offset: 402, Length: 84
16:40:15.4116970 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS
16:40:15.4143024 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[1].txt SUCCESS CreationTime:
27/07/2009 16:40:03, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 488,
EndOfFile: 486, FileAttributes: ANCI
16:40:15.4146465 IEXPLORE.EXE 2188 QueryOpen E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS CreationTime:
27/07/2009 16:40:15, LastAccessTime: 27/07/2009 16:40:15, LastWriteTime:
27/07/2009 16:40:15, ChangeTime: 27/07/2009 16:40:15, AllocationSize: 408,
EndOfFile: 402, FileAttributes: ANCI
16:40:15.4149933 IEXPLORE.EXE 2188 CreateFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS Desired Access: Read
Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open
Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:15.4153945 IEXPLORE.EXE 2188 QueryAttributeTagFile
E:\Documents and Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:15.4156307 IEXPLORE.EXE 2188 SetDispositionInformationFile
E:\Documents and Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS
Delete: True
16:40:15.4159242 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\mike@google.co[2].txt SUCCESS
16:40:15.4162749 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 0, Length: 4,096, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.4164361 IEXPLORE.EXE 2188 WriteFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS Offset: 16,384, Length: 8,192, I/O
Flags: Non-cached, Paging I/O, Synchronous Paging I/O
16:40:15.5429965 IEXPLORE.EXE 2188 CloseFile C:\Temp IE\Temporary
Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm SUCCESS
16:40:15.5433521 IEXPLORE.EXE 2188 CreateFile C:\Temp IE\Temporary
Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm SUCCESS Desired
Access: Read Attributes, Delete, Disposition: Open, Options: Non-Directory
File, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete,
AllocationSize: n/a, OpenResult: Opened
16:40:15.5436323 IEXPLORE.EXE 2188 QueryAttributeTagFile C:\Temp
IE\Temporary Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm SUCCESS
Attributes: ANCI, ReparseTag: 0x0
16:40:15.5438427 IEXPLORE.EXE 2188 SetDispositionInformationFile
C:\Temp IE\Temporary Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm
SUCCESS Delete: True
16:40:15.5440863 IEXPLORE.EXE 2188 CloseFile C:\Temp IE\Temporary
Internet Files\Content.IE5\GI3TA1DV\CheckCookie[1].htm SUCCESS
16:40:43.3625802 IEXPLORE.EXE 2188 CloseFile E:\Documents and
Settings\Mike\Cookies\index.dat SUCCESS

NEWS

I took the plunge and removed mswsock32.dll! had to use the file assassin on
hijack this to do it.
Zipped it up just in case first.

Guess what?

My cookies are now staying put!!!!!!!!!!!!!!!!!

After I removed the file I ran LSP again and this time it had it in the
right hand window to remove its place holder.

So it really would seem that mswsock32.dll located in system32 folder is a
virus of some kind!

Might I suggest that if you have this cookie issue and the delay when pressing
the return button when filling in forms then check and see if you have this
file!

I am quite annoyed that all my scanners never found it, despite there being
quite a bit on line about it!

Is this matter resolved?

Let us see.

Oh, link for LSP here: http://www.cexx.org/lspfix.htm

> So it really would seem that mswsock32.dll located in system32 folder is a
> virus of some kind!

Well, it's a file dropped by one of innumerable Trojans and it's highly
likely that your computer remains infected.

The presence of such an infection suggests that your computer is not fully
patched at Windows Update and that Automatic Updates hasn't been working for
6+ months or so.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002


Mike wrote:
> NEWS
>
> I took the plunge and removed mswsock32.dll! had to use the file assassin
> on
> hijack this to do it.
> Zipped it up just in case first.
>
> Guess what?
>
> My cookies are now staying put!!!!!!!!!!!!!!!!!
>
> After I removed the file I ran LSP again and this time it had it in the
> right hand window to remove its place holder.
>
> So it really would seem that mswsock32.dll located in system32 folder is a
> virus of some kind!
>
> Might I suggest that if you have this cookie issue and the delay when
> pressing the return button when filling in forms then check and see if you
> have this file!
>
> I am quite annoyed that all my scanners never found it, despite there
> being
> quite a bit on line about it!
>
> Is this matter resolved?
>
> Let us see.
>
> Oh, link for LSP here: http://www.cexx.org/lspfix.htm

"PA Bear [MS MVP]" wrote:

> > So it really would seem that mswsock32.dll located in system32 folder is a
> > virus of some kind!
>
> Well, it's a file dropped by one of innumerable Trojans and it's highly
> likely that your computer remains infected.
>
> The presence of such an infection suggests that your computer is not fully
> patched at Windows Update and that Automatic Updates hasn't been working for
> 6+ months or so.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Client - since 2002
>
>

Hi Robear

:-( just when I thought I was getting on top of it all!

What really angers me is no scanner detected it!

If I run update now will it patch everything us ok?

I have been installing all the regular updates that come in.

Cheers

Mike

Mike wrote:
> "PA Bear [MS MVP]" wrote:
>
>>> So it really would seem that mswsock32.dll located in system32 folder is
>>> a
>>> virus of some kind!
>>
>> Well, it's a file dropped by one of innumerable Trojans and it's highly
>> likely that your computer remains infected.
>>
>> The presence of such an infection suggests that your computer is not
>> fully
>> patched at Windows Update and that Automatic Updates hasn't been working
>> for 6+ months or so.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>
>>
>
> Hi Robear
>
> :-( just when I thought I was getting on top of it all!
>
> What really angers me is no scanner detected it!
>
> If I run update now will it patch everything us ok?

You should find out soon enough!

Security Research & Defense: Overview of the out-of-band release
http://blogs.technet.com/srd/archive...d-release.aspx

Mike,

I ran a system wide search for this file, as well as simply looking in the
Windows/System32 folder, and there's no sign of this file "mswsock32.dll" on
my Vista x64 system.

I've been reading around the web about this file. Some say it's
malware/trojan, others say it's a Windows file. I'm tempted to side with it
being malware of some sort, though I don't seem to have it.

How has the LSP fix worked out for you so far? And do you have any other
input about this since you seemed to have fixed your issue?

Thanx




"Mike" wrote:

> NEWS
>
> I took the plunge and removed mswsock32.dll! had to use the file assassin on
> hijack this to do it.
> Zipped it up just in case first.
>
> Guess what?
>
> My cookies are now staying put!!!!!!!!!!!!!!!!!
>
> After I removed the file I ran LSP again and this time it had it in the
> right hand window to remove its place holder.
>
> So it really would seem that mswsock32.dll located in system32 folder is a
> virus of some kind!
>
> Might I suggest that if you have this cookie issue and the delay when pressing
> the return button when filling in forms then check and see if you have this
> file!
>
> I am quite annoyed that all my scanners never found it, despite there being
> quite a bit on line about it!
>
> Is this matter resolved?
>
> Let us see.
>
> Oh, link for LSP here: http://www.cexx.org/lspfix.htm
>

Hi James

Everything is now working fine :-) log in cookies now stay, the browser is
faster and I can enter text into forms at real time speed.
Kaspersky is adding the file to its detection list next update so they seem
convinced its bad!

LSP initially did not find anything wrong, then I used the file assasin of
hijackthis to kill the file, ran LSP and it found the place holder and asked
to remove it which I did.

So this ones seems to have slipped past the nets of every AV and mailware
scanner.
Poor show indeed.
Are you sure its not on your system, hideen in some way?

"James2008" wrote:

> Mike,
>
> I ran a system wide search for this file, as well as simply looking in the
> Windows/System32 folder, and there's no sign of this file "mswsock32.dll" on
> my Vista x64 system.
>
> I've been reading around the web about this file. Some say it's
> malware/trojan, others say it's a Windows file. I'm tempted to side with it
> being malware of some sort, though I don't seem to have it.
>
> How has the LSP fix worked out for you so far? And do you have any other
> input about this since you seemed to have fixed your issue?
>
> Thanx
>
>
>
>
> "Mike" wrote:
>
> > NEWS
> >
> > I took the plunge and removed mswsock32.dll! had to use the file assassin on
> > hijack this to do it.
> > Zipped it up just in case first.
> >
> > Guess what?
> >
> > My cookies are now staying put!!!!!!!!!!!!!!!!!
> >
> > After I removed the file I ran LSP again and this time it had it in the
> > right hand window to remove its place holder.
> >
> > So it really would seem that mswsock32.dll located in system32 folder is a
> > virus of some kind!
> >
> > Might I suggest that if you have this cookie issue and the delay when pressing
> > the return button when filling in forms then check and see if you have this
> > file!
> >
> > I am quite annoyed that all my scanners never found it, despite there being
> > quite a bit on line about it!
> >
> > Is this matter resolved?
> >
> > Let us see.
> >
> > Oh, link for LSP here: http://www.cexx.org/lspfix.htm
> >

Hi Mike,

I've searched for the file every way I know how, but no luck. The closest
match I've found is file "mswsock.dll". As far as I can see, file
"mswsock32.dll" doesn't exist on my end.

Yet oddly, I'm experiencing some of the other symptoms you've noted, such as
IE slowdowns/hesitations, etc., in addition to the main issue of lost
settings. For example, on many sites, IE will seem to freeze for several
seconds during rendering/loading of the site, then unfreeze and is fine.

But I haven't had any issues with inputting to forms.

Any suggestions?


"Mike" wrote:

> Hi James
>
> Everything is now working fine :-) log in cookies now stay, the browser is
> faster and I can enter text into forms at real time speed.
> Kaspersky is adding the file to its detection list next update so they seem
> convinced its bad!
>
> LSP initially did not find anything wrong, then I used the file assasin of
> hijackthis to kill the file, ran LSP and it found the place holder and asked
> to remove it which I did.
>
> So this ones seems to have slipped past the nets of every AV and mailware
> scanner.
> Poor show indeed.
> Are you sure its not on your system, hideen in some way?
>
> "James2008" wrote:
>
> > Mike,
> >
> > I ran a system wide search for this file, as well as simply looking in the
> > Windows/System32 folder, and there's no sign of this file "mswsock32.dll" on
> > my Vista x64 system.
> >
> > I've been reading around the web about this file. Some say it's
> > malware/trojan, others say it's a Windows file. I'm tempted to side with it
> > being malware of some sort, though I don't seem to have it.
> >
> > How has the LSP fix worked out for you so far? And do you have any other
> > input about this since you seemed to have fixed your issue?
> >
> > Thanx
> >
> >
> >
> >
> > "Mike" wrote:
> >
> > > NEWS
> > >
> > > I took the plunge and removed mswsock32.dll! had to use the file assassin on
> > > hijack this to do it.
> > > Zipped it up just in case first.
> > >
> > > Guess what?
> > >
> > > My cookies are now staying put!!!!!!!!!!!!!!!!!
> > >
> > > After I removed the file I ran LSP again and this time it had it in the
> > > right hand window to remove its place holder.
> > >
> > > So it really would seem that mswsock32.dll located in system32 folder is a
> > > virus of some kind!
> > >
> > > Might I suggest that if you have this cookie issue and the delay when pressing
> > > the return button when filling in forms then check and see if you have this
> > > file!
> > >
> > > I am quite annoyed that all my scanners never found it, despite there being
> > > quite a bit on line about it!
> > >
> > > Is this matter resolved?
> > >
> > > Let us see.
> > >
> > > Oh, link for LSP here: http://www.cexx.org/lspfix.htm
> > >

Hi James

The trojan behind mine was 'Trojan.Win32.Agent.aykf'

Maybe have a dig and see what its payload was. I think it specifically
attachs FireFox but the effects are felt in IE as well.

Good luck


"James2008" wrote:

> Hi Mike,
>
> I've searched for the file every way I know how, but no luck. The closest
> match I've found is file "mswsock.dll". As far as I can see, file
> "mswsock32.dll" doesn't exist on my end.
>
> Yet oddly, I'm experiencing some of the other symptoms you've noted, such as
> IE slowdowns/hesitations, etc., in addition to the main issue of lost
> settings. For example, on many sites, IE will seem to freeze for several
> seconds during rendering/loading of the site, then unfreeze and is fine.
>
> But I haven't had any issues with inputting to forms.
>
> Any suggestions?
>
>
> "Mike" wrote:
>
> > Hi James
> >
> > Everything is now working fine :-) log in cookies now stay, the browser is
> > faster and I can enter text into forms at real time speed.
> > Kaspersky is adding the file to its detection list next update so they seem
> > convinced its bad!
> >
> > LSP initially did not find anything wrong, then I used the file assasin of
> > hijackthis to kill the file, ran LSP and it found the place holder and asked
> > to remove it which I did.
> >
> > So this ones seems to have slipped past the nets of every AV and mailware
> > scanner.
> > Poor show indeed.
> > Are you sure its not on your system, hideen in some way?
> >
> > "James2008" wrote:
> >
> > > Mike,
> > >
> > > I ran a system wide search for this file, as well as simply looking in the
> > > Windows/System32 folder, and there's no sign of this file "mswsock32.dll" on
> > > my Vista x64 system.
> > >
> > > I've been reading around the web about this file. Some say it's
> > > malware/trojan, others say it's a Windows file. I'm tempted to side with it
> > > being malware of some sort, though I don't seem to have it.
> > >
> > > How has the LSP fix worked out for you so far? And do you have any other
> > > input about this since you seemed to have fixed your issue?
> > >
> > > Thanx
> > >
> > >
> > >
> > >
> > > "Mike" wrote:
> > >
> > > > NEWS
> > > >
> > > > I took the plunge and removed mswsock32.dll! had to use the file assassin on
> > > > hijack this to do it.
> > > > Zipped it up just in case first.
> > > >
> > > > Guess what?
> > > >
> > > > My cookies are now staying put!!!!!!!!!!!!!!!!!
> > > >
> > > > After I removed the file I ran LSP again and this time it had it in the
> > > > right hand window to remove its place holder.
> > > >
> > > > So it really would seem that mswsock32.dll located in system32 folder is a
> > > > virus of some kind!
> > > >
> > > > Might I suggest that if you have this cookie issue and the delay when pressing
> > > > the return button when filling in forms then check and see if you have this
> > > > file!
> > > >
> > > > I am quite annoyed that all my scanners never found it, despite there being
> > > > quite a bit on line about it!
> > > >
> > > > Is this matter resolved?
> > > >
> > > > Let us see.
> > > >
> > > > Oh, link for LSP here: http://www.cexx.org/lspfix.htm
> > > >