Deleted tracking cookies reappear while disconnected from internet?!

I was referred to this forum for help by TimW after he determined that my laptop is malware-free. (Thanks, Tim! )

My thread in the Malware Removal forum:
http://forums.majorgeeks.com/showthread.php?p=1400357

I have a Dell Studio 15 laptop on which I am running Vista 32-bit. Several weeks ago, I was cleaning the house and found a stack of old cds from many years ago. I figured I’d put the files on the laptop, sort through them, and get rid of the cds.

In retrospect, I learned that two of the cds from a friend had a cracked version of Age of Empires on them, but I didn’t know that at the time. I unwittingly copied the file onto the laptop twice because it was on two different cds.

Later during a routine scan, Spybot picked up several tracking cookies, which I removed, but when I checked the cookies list in Firefox they were still there.

I tried deleting them, but they remained. I clicked delete again, and they disappeared. However, when I reopened the menu, they reappeared. I ran Spybot and AdAware, which both found nothing.

I booted in safe mode with no internet connection: Spybot picked up the tracking cookies again, and AdAware picked up two instances of Win32TrojanAgent. It traced them to the two Age of Empires files from the cds, which I quarantined and removed. (I haven't seen any trace of Win32TrojanAgent since.)

I ran full scans of AdAware and Spybot again. AdAware's scan was clean, but Spybot picked up the following tracking cookies:

AdRevolver
Adviva
Blue Streak
BurstMedia
CasaleMedia
CoreMetrics
DoubleClick
FastClick
Mediaplex
Right Media
Tradedoubler
WebTrends live
Zedo

I used Spybot to remove the cookies and ran another scan that came up clean. I rebooted in safe mode (still with no internet connection) and ran Spybot again: clean.

I opened Firefox and went to "show cookies" in Tools>Options>Privacy. A huge list of cookies that were all obviously trackers appeared. It included many more cookies than the ones Spybot detected, and seemed to be a longer list than last time (though I'm not certain). I clicked "remove all cookies," and the list dwindled somewhat. I clicked it again, and the list was empty.

Upon closing and re-opening the menu, the same huge list of tracking cookies appeared, and I went through the same routine: try to delete them, it doesn't fully work, then it seems to work, then I check again and they reappear.

I rebooted in safe mode with no internet and ran Spybot again. It identified the same tracking cookies listed above (possibly triggered by me trying to delete them in Firefox?). I have gone through this entire routine several times while disconnected from the internet, but the cookies keep reappearing.

I checked the cookies folders to see if I could delete them manually and was surprised that the cookies weren't there.

The following files were in the administrator folder (C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies):

• desktop.ini
• username(at)updates.digitalpersona[2].txt
• index.dat
• a folder named "Low" that was empty

The following files were in the guest folder (C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies):

• guest(at)updates.digitalpersona[2].txt
• index.dat
• a folder named "Low" that contained another file named index.dat

The default folder was empty (C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies).

(Note: I believe that the DigitalPersona files might be associated with the fingerprint reader on my laptop (which I keep disabled), so they could be legitimate.)

I know that the general consensus on this site is that it's not worth stressing about tracking cookies. But I'm worried because they reappear after deletion even when I'm not connected to the internet, which seems like it shouldn't be possible!

What could be causing this?

 

Open hidden files and folders in safe mode, then open (C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies delete from that folder also check the local and roaming within AppData whist in safe mode, if any relate to the cookies your wanting rid of, delete them too, re-run a scan whilst still in safe mode, reboot and see what happens then !

 

Let's see the cookies files for FF are in different folder than MSIE. It would be in ...Roaming\Mozilla\Firefox\Profiles\xxx.default

So close FF and go to that folder. If you are using FF 3.x than the two files would be cookies.sqlite and cookie.sqlite-journal. Both can be safely deleted but

which shouldn't make a difference since you have already deleted all cookies so you are not worried about having to sign back into websites. I would try it.
I find it unlikely that a several year old CD could be hijacking these files in FF since it only changed over to them about a year ago. Do you have any other cookie files such as cookie.txt in that folder xxxx.default?

 

Thanks to both of you for your suggestions!

I completely agree and think they are separate issues that happened to be discovered at the same time. However, I figured I'd include that info in the off-chance that it was relevant.

Whoops! I had done a search to find where Vista's elusive cookies are stored and was only checking the Microsoft folder instead of Firefox. Thanks for pointing that out.

The only cookies-related file in that folder was cookies.sqlite. I closed Firefox, deleted the file, emptied the recycle bin, and reopened Firefox. Didn't help: the cookies.sqlite file reappeared, and the tracking cookies were still listed in Firefox.

I booted in safe mode, and a second cookies file appeared for a total of two: cookies.sqlite and cookie.sqlite-journal. I closed Firefox, deleted both, emptied the recycle bin, and reopened Firefox. That didn't help either.

I went through the same routine with a reboot between deleting the files and opening Firefox, and had no luck there either.

Finally, I did a clean uninstall of Firefox and reinstalled. The cookies seem to be gone(!), and a Spybot scan came back clean in safe mode. I'm currently running a full AdAware scan in safe mode, which will take a few hours. But I am very hopeful that the problem is solved. <fingers crossed>

As a side note, what's the deal with cookies being bundled into an unreadable *.sqlite file? I liked being able to delete individual cookies manually in previous operating systems.

 

I glad things look OK. I was hoping that those CD put a cookies.txt in the FF folder and FF was picking up that list of cookies so the fix would have been to just delete the old fashioned cookies.txt. I'm still wondering where the list of cookies that Spybot saw was stored.

You've got me! :confused I suppose it's a speed issue but FF will never be a fast browser. Too many add-ons and it has always chewed up memory. They did the same thing with the bookmarks. I didn't see any speed increase with FF 3.xx and doubt cookies or bookmarks were ever a factor in FF performance. But it is free and nicely customizable! So a headache once or twice a year is a small price to pay for a browser that can be made to work the way I want.

 

Mystery solved!

The cookies were put in place by a Firefox add-on called TACO (Targeted Advertising Cookie Opt-Out).

According to their website,

So it pretty much puts "dummy" tracking cookies on your computer so real ones aren't downloaded instead.

I didn't make the connection until I was rebuilding my Firefox extensions. After the extensions went in, the tracking cookies reappeared. But this time, I realized they were from TACO!

Apparently, when they say the cookies are "permanent," they really mean it. I don't like not having control over what's on my system, so I uninstalled the add-on.

 

Thanks for posting back. It's good to know that it wasn't anything malevolent.