Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hjt Log, Possible Virtumundo, Winantivirus.com


  • Please log in to reply
14 replies to this topic

#1 Vorbis

Vorbis

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 04 September 2007 - 04:12 AM

Hi, I found this virus/malware on my Uncles PC ironically several days after I instaled and configured AVG+Kerio antivirus/firewall on his pc due to his old Norton being several years out of date. I believe it to be some varient of winfixer/virtumundo/etc as it is very similar to viruses I've previously fixed on other computers with VirtumundoBeGone and VundoFix. I have run VBG/VF on this computer as well as Spybot, Ad-Aware, McAffee Stinger and generally cleaned the computer but unfortunately the problem keeps returning even though AVG/VBG/VF seem to think the computer is now 'clean'.

The "Windows Security Alert" dialogue box that the virus pops up every 10-15 minutes says:

"Warning! Potential Spyware Operation!

Your computer is making unauthroized copies of your system and Internet files. Fun full scan now to pervent any unathorised access to your files! Click YES to download spyware remover ..."

Note: 'pervent' and 'unathorised' are typos in the virus and not my mistake. Pressing No will remove the message but it returns and pressing yes points to http://winantivirus.com/download/2007/ which is obviously the cause of the problem not the solution.

I noticed that the control panel was removed from the start menu and although I managed to get it to return via spybot but after reboot I still get the following message on windows after loading the desktop "This operation has been cancelled due to restrictions in effect on the computer. Please contact your system administrator." which is repeated when I try to use the control panel tools. Regedit etc seem to be automatically disabled on boot by the virus.

From what I understand from extensive Google searching if VBG/VF don't work my last option is to manually remove it but I don't know how to stop it returning. C:\WINDOWS\system32\iifdaww.dll appears to be the randomly named virus file but I suspect there is something else lurking in the background to reinstall the virus. Afaik the computer was simply infected via IE through a website.

In addition I have the problem that if I press F8 at boot I have the option of Safe Mode but I cannot select it due to the USB keyboard arrow keys not working, I believe this to be an unrelated problem but there is no other keyboard available and it may make fixing this virus much harder.



Thanks in advance for any help and advice you may be able to give me.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:53:55 AM, on 9/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Garmin\gStart.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PDUiP6000DTskbr] C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
O4 - HKLM\..\Run: [PDUiP6000DMon] C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [_Windows] C:\WINDOWS\WinSecurity\services.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WinAVX] C:\WINDOWS\system32\WinAvXX.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: system.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: autorun.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://www.walmartphotocentre.ca/activex/PCAXSetup.cab?
O20 - AppInit_DLLs: C:\WINDOWS\system32\systems.txt
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Canon PIXMA iP6000D Memory Card Manager (PDUiP6000DMemCrdMgr) - CANON INC. - C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O24 - Desktop Component 0: (no name) - http://www.nasports.com/images_main/hrm.gif

--
End of file - 9143 bytes



-------------------------------------------------------------------------------------



[09/03/2007, 23:52:04] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\David\Desktop\VirtumundoBeGone.exe" )
[09/03/2007, 23:52:12] - Detected System Information:
[09/03/2007, 23:52:12] - Windows Version: 5.1.2600, Service Pack 2
[09/03/2007, 23:52:12] - Current Username: David (Admin)
[09/03/2007, 23:52:12] - Windows is in NORMAL mode.
[09/03/2007, 23:52:12] - Searching for Browser Helper Objects:
[09/03/2007, 23:52:12] - BHO 1: {4AA7B12D-AB2C-4D16-BCFB-704945A98FDD} ()
[09/03/2007, 23:52:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[09/03/2007, 23:52:12] - Checking for HKLM\...\Winlogon\Notify\iifdaww
[09/03/2007, 23:52:12] - Found: HKLM\...\Winlogon\Notify\iifdaww - This is probably Virtumundo.
[09/03/2007, 23:52:12] - Assigning {4AA7B12D-AB2C-4D16-BCFB-704945A98FDD} MSEvents Object
[09/03/2007, 23:52:12] - BHO list has been changed! Starting over...
[09/03/2007, 23:52:12] - BHO 1: {4AA7B12D-AB2C-4D16-BCFB-704945A98FDD} (MSEvents Object)
[09/03/2007, 23:52:12] - ALERT: Found MSEvents Object!
[09/03/2007, 23:52:12] - Finished Searching Browser Helper Objects
[09/03/2007, 23:52:12] - *** Detected MSEvents Object
[09/03/2007, 23:52:12] - Trying to remove MSEvents Object...
[09/03/2007, 23:52:13] - Terminating Process: IEXPLORE.EXE
[09/03/2007, 23:52:14] - Terminating Process: RUNDLL32.EXE
[09/03/2007, 23:52:15] - Disabling Automatic Shell Restart
[09/03/2007, 23:52:15] - Terminating Process: EXPLORER.EXE
[09/03/2007, 23:52:15] - Suspending the NT Session Manager System Service
[09/03/2007, 23:52:15] - Terminating Windows NT Logon/Logoff Manager
[09/03/2007, 23:52:16] - Re-enabling Automatic Shell Restart
[09/03/2007, 23:52:16] - File to disable: C:\WINDOWS\system32\iifdaww.dll
[09/03/2007, 23:52:16] - Renaming C:\WINDOWS\system32\iifdaww.dll -> C:\WINDOWS\system32\iifdaww.dll.vir
[09/03/2007, 23:52:16] - ! File rename was unsucessful.
[09/03/2007, 23:52:16] - Attempting to Deny Access to C:\WINDOWS\system32\iifdaww.dll
[09/03/2007, 23:52:16] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[09/03/2007, 23:52:17] - processed file: C:\WINDOWS\system32\iifdaww.dll

[09/03/2007, 23:52:17] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[09/03/2007, 23:52:17] - Removing HKLM\...\Browser Helper Objects\{4AA7B12D-AB2C-4D16-BCFB-704945A98FDD}
[09/03/2007, 23:52:17] - Removing HKCR\CLSID\{4AA7B12D-AB2C-4D16-BCFB-704945A98FDD}
[09/03/2007, 23:52:17] - Adding Kill Bit for ActiveX for GUID: {4AA7B12D-AB2C-4D16-BCFB-704945A98FDD}
[09/03/2007, 23:52:17] - Deleting ATLEvents/MSEvents Registry entries
[09/03/2007, 23:52:17] - Removing HKLM\...\Winlogon\Notify\iifdaww
[09/03/2007, 23:52:17] - Searching for Browser Helper Objects:
[09/03/2007, 23:52:17] - Finished Searching Browser Helper Objects
[09/03/2007, 23:52:17] - Finishing up...
[09/03/2007, 23:52:17] - A restart is needed.
[09/03/2007, 23:52:24] - Attempting to Restart via STOP error (Blue Screen!)

[09/03/2007, 23:54:41] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\David\Desktop\VirtumundoBeGone.exe" )
[09/03/2007, 23:54:44] - Detected System Information:
[09/03/2007, 23:54:44] - Windows Version: 5.1.2600, Service Pack 2
[09/03/2007, 23:54:44] - Current Username: David (Admin)
[09/03/2007, 23:54:44] - Windows is in NORMAL mode.
[09/03/2007, 23:54:44] - Searching for Browser Helper Objects:
[09/03/2007, 23:54:44] - Finished Searching Browser Helper Objects
[09/03/2007, 23:54:44] - Finishing up...
[09/03/2007, 23:54:44] - Nothing found! Exiting...

[09/04/2007, 0:00:25] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\David\Desktop\VirtumundoBeGone.exe" )
[09/04/2007, 0:00:27] - Detected System Information:
[09/04/2007, 0:00:27] - Windows Version: 5.1.2600, Service Pack 2
[09/04/2007, 0:00:27] - Current Username: David (Admin)
[09/04/2007, 0:00:28] - Windows is in NORMAL mode.
[09/04/2007, 0:00:28] - Searching for Browser Helper Objects:
[09/04/2007, 0:00:28] - Finished Searching Browser Helper Objects
[09/04/2007, 0:00:28] - Finishing up...
[09/04/2007, 0:00:28] - Nothing found! Exiting...

[09/04/2007, 0:43:01] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\David\Desktop\VirtumundoBeGone.exe" )
[09/04/2007, 0:43:06] - Detected System Information:
[09/04/2007, 0:43:06] - Windows Version: 5.1.2600, Service Pack 2
[09/04/2007, 0:43:06] - Current Username: David (Admin)
[09/04/2007, 0:43:06] - Windows is in NORMAL mode.
[09/04/2007, 0:43:06] - Searching for Browser Helper Objects:
[09/04/2007, 0:43:06] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[09/04/2007, 0:43:06] - Finished Searching Browser Helper Objects
[09/04/2007, 0:43:06] - Finishing up...
[09/04/2007, 0:43:06] - Nothing found! Exiting...

BC AdBot (Login to Remove)

 


#2 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:29 AM

Posted 04 September 2007 - 09:54 AM

Hello and welcome aboard :thumbsup:

Your PC is infected with the W32.Sober.X@mm worm. This worm is a mass-mailer. It spreads and lowers security settings.

It spreads by sending itself as a attachment from the compromised (in this case yours) to the addresses it collects from the PC.

More info here.

You should plug the PC from the internet, or at least warn all your contacts. If you do take the PC offline, then hopefully you have another to download and transfer the fix tools from? If not, then it's probably best to either hope;

a ) Warning your contacts does the trick
b ) Do a complete reformat for the PC.

Have you completely uninstalled Norton? I can see few services running there, if you don't have an active Symantec product running we'll remove those leftovers manually then.

Then let's get to the cleaning (if you do want to clean this, if not, please let me know what you've decided to do) :flowers:

Please download Combofix to your desktop:
  • Double-click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply.
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Hi there, stranger!

#3 Vorbis

Vorbis
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 04 September 2007 - 11:05 AM

Thanks for the help Rawe.

Unfortunately another PC is not available, I'm actually on holiday at my Uncle's and my own pc is four and a half thousand miles away. Since there is neither another pc or enough DVDs available to back up everything I'd like to avoid a complete reformat. Norton failed repeatedly when I was uninstalling it before although the main program did claim to be removed and it was I believe the updater program that was the problem, after installing and updating AVG the problem was detected as a virus within a norton file as I-Worm/Generic.AYK. This would seem to be the W32.Sober.X@mm worm although I'm not sure if there is more than one virus at work here because in a full virus scan this morning AVG has detected Win32/PEPatch infection in about 6 different startup programs (normally harmless ones) and unfortunately doesn't seem to be able to heal the files.



ComboFix may have had problems due to Spybot's registry protection tool denying changes (although it was hopefully slowing down the spread of the virus too).




ComboFix 07-08-30.3 - "David" 2007-09-04 9:30:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.213 [GMT -6:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup.\autorun.exe
C:\DOCUME~1\David\Desktop\internet.lnk
C:\DOCUME~1\David\STARTM~1\Programs\Startup\system.exe
C:\WINDOWS\system32\iifdaww.dll
C:\WINDOWS\system32\O5B3COCm.exe
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\Tasks.\At1.job
C:\WINDOWS\Tasks.\At10.job
C:\WINDOWS\Tasks.\At11.job
C:\WINDOWS\Tasks.\At12.job
C:\WINDOWS\Tasks.\At13.job
C:\WINDOWS\Tasks.\At14.job
C:\WINDOWS\Tasks.\At15.job
C:\WINDOWS\Tasks.\At16.job
C:\WINDOWS\Tasks.\At17.job
C:\WINDOWS\Tasks.\At18.job
C:\WINDOWS\Tasks.\At19.job
C:\WINDOWS\Tasks.\At2.job
C:\WINDOWS\Tasks.\At20.job
C:\WINDOWS\Tasks.\At21.job
C:\WINDOWS\Tasks.\At22.job
C:\WINDOWS\Tasks.\At23.job
C:\WINDOWS\Tasks.\At24.job
C:\WINDOWS\Tasks.\At3.job
C:\WINDOWS\Tasks.\At4.job
C:\WINDOWS\Tasks.\At5.job
C:\WINDOWS\Tasks.\At6.job
C:\WINDOWS\Tasks.\At7.job
C:\WINDOWS\Tasks.\At8.job
C:\WINDOWS\Tasks.\At9.job


((((((((((((((((((((((((( Files Created from 2007-08-04 to 2007-09-04 )))))))))))))))))))))))))))))))


2007-09-04 09:28 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-09-04 03:21 0 --a------ C:\WINDOWS\nsreg.dat
2007-09-04 00:39 <DIR> d-------- C:\VundoFix Backups
2007-09-04 00:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-04 00:09 <DIR> d-------- C:\Program Files\Safer Networking
2007-09-03 23:31 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-03 23:11 39,424 --a------ C:\WINDOWS\system32\vtr.dll
2007-09-03 23:11 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\WinRAR
2007-09-03 13:45 <DIR> d-------- C:\Program Files\Winamp
2007-09-03 10:08 <DIR> d-------- C:\Program Files\Real Alternative
2007-09-03 10:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
2007-09-03 09:46 <DIR> d-------- C:\Program Files\QuickTime Alternative
2007-09-02 19:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-09-02 18:12 <DIR> d-------- C:\Program Files\Bonjour
2007-09-02 17:13 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-09-02 14:25 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Media Player Classic
2007-09-02 13:24 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2007-09-02 13:13 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Ahead
2007-09-02 13:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-09-02 13:05 <DIR> d-------- C:\Program Files\Nero
2007-09-02 13:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-09-02 12:21 <DIR> d-------- C:\Program Files\uTorrent
2007-09-02 12:21 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\uTorrent
2007-09-02 11:57 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-08-29 21:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\vsosdk
2007-08-20 01:52 87,608 --a------ C:\DOCUME~1\David\APPLIC~1\inst.exe
2007-08-20 01:52 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-08-20 01:52 47,360 --a------ C:\DOCUME~1\David\APPLIC~1\pcouffin.sys
2007-08-20 01:52 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2007-08-20 01:52 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2007-08-20 01:52 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2007-08-20 01:52 <DIR> d-------- C:\Program Files\VSO
2007-08-20 01:52 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Vso
2007-08-19 18:08 <DIR> d-------- C:\WINDOWS\pss


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-04 02:50 --------- d-------- C:\DOCUME~1\David\APPLIC~1\U3
2007-09-03 10:06 --------- d-------- C:\Program Files\Common Files\Real
2007-09-03 10:06 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Real
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Apple Computer
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-09-03 05:30 5393 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-09-02 16:33 --------- d-------- C:\DOCUME~1\David\APPLIC~1\AdobeUM
2007-09-02 14:55 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Webshots
2007-09-02 13:10 --------- d-------- C:\Program Files\Common Files\Ahead
2007-09-02 12:20 --------- d-------- C:\Program Files\Azureus
2007-09-02 12:19 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Azureus
2007-09-02 11:54 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-02 11:37 --------- d-------- C:\Program Files\Symantec
2007-09-02 11:37 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-09-02 11:35 --------- d-------- C:\Program Files\Ahead
2007-08-07 21:37 --------- d-------- C:\Program Files\Logitech
2007-08-03 14:30 --------- d-------- C:\DOCUME~1\David\APPLIC~1\NewspaperDirect
2007-07-21 23:46 --------- d-------- C:\Program Files\The_Pussycat_Dolls_-_PCD-[HwC]
2007-07-03 19:10 132904 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2007-07-03 19:10 11304 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2007-06-26 14:12 972072 --a------ C:\WINDOWS\UNNeroVision.exe
2007-01-25 00:50 3508069 --a------ C:\Program Files\Adobe Illustrator - Teach Yourself Illustrator in 24 hours - Sam' s (eBook).pdf
2007-01-22 00:50 9795648 --a------ C:\Program Files\Azureus_2.5.0.2_Win32.setup.exe
2006-12-09 13:11 0 --a------ C:\Program Files\AdbeRdrUpd707_all_incr.exe
2006-09-05 16:50 27136 --a------ C:\WINDOWS\Fonts.\Afiutil.exe
2004-10-18 17:04 16706160 --a------ C:\Program Files\AdbeRdr60_enu_full.exe
2004-10-18 17:02 6811656 --a------ C:\Program Files\psa201se_us.exe
2004-10-01 16:00 40960 --a------ C:\Program Files\Uninstall_CDS.exe
2001-11-22 22:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" []
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" []
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-13 19:10]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" []
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 03:50 C:\WINDOWS\LOGI_MWX.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 21:24]
"PDUiP6000DTskbr"="C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe" []
"PDUiP6000DMon"="C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-02 11:59]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" []
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-09-02 14:44]
"@"="" []
"WinAVX"="C:\WINDOWS\system32\WinAvXX.exe" []
"combofix"="C:\WINDOWS\system32\cmd.exe" [2004-08-03 19:07]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2005-08-30 14:22]
"_Windows"="C:\WINDOWS\WinSecurity\services.exe" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-08-07 20:46]
"gStart"="C:\Garmin\gStart.exe" [2005-07-25 09:05]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"combofix"=C:\WINDOWS\system32\cmd.exe /c C:\ComboFix\Combobatch.bat

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Symantec NetDriver Warning"=C:\PROGRA~1\SYMNET~1\SNDWarn.exe

C:\DOCUME~1\David\STARTM~1\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="Explorer.exe C:\WINDOWS\system32\printer.exe"

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys


Contents of the 'Scheduled Tasks' folder
2007-09-03 21:38:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-09-04 11:47:01 C:\WINDOWS\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-04 09:40:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-04 9:42:56 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-04 09:42

--- E O F ---

#4 Vorbis

Vorbis
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 04 September 2007 - 11:52 AM

List of AVG Quarantined files as well as the latest ComboFix and HJT logs. Apart from programs quarantined by AVG failing to load like they would normally I haven't noticed any popups for winantivirus or any other strange behaviour. Control Panel and Regedit seem to be functioning normally atm.


Virus found Win32/PEPatch C:\WINDOWS\system32\igfxtray.exe 9/4/2007 9:40:32 AM igfxtray.exe 160 KB
Virus found Win32/PEPatch C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe 9/4/2007 9:40:52 AM PDUiP6000DTskbr.exe 76 KB
Virus found Win32/PEPatch C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe 9/4/2007 9:41:03 AM NeroCheck.exe 157.55 KB
Virus found Win32/PEPatch C:\Program Files\Logitech\iTouch\iTouch.exe 9/4/2007 9:41:14 AM iTouch.exe 880 KB
Virus found Win32/PEPatch C:\WINDOWS\system32\hkcmd.exe 9/4/2007 9:41:20 AM hkcmd.exe 120 KB
Virus found Win32/PEPatch C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe 9/4/2007 9:41:53 AM PDUiP6000DMon.exe 64 KB
Virus identified I-Worm/Generic.AYK C:\System Volume Information\_restore{AB7F3F4E-B328-41D2-973C-23AF082E28B3}\RP570\A0059042.exe 9/4/2007 5:08:53 AM A0059042.exe 54 KB
Virus identified I-Worm/Generic.AYK C:\System Volume Information\_restore{AB7F3F4E-B328-41D2-973C-23AF082E28B3}\RP570\A0059043.EXE 9/4/2007 5:08:53 AM A0059043.EXE 54 KB
Virus identified I-Worm/Generic.AYK C:\System Volume Information\_restore{AB7F3F4E-B328-41D2-973C-23AF082E28B3}\RP570\A0059044.exe 9/4/2007 5:08:53 AM A0059044.exe 54 KB
Virus identified I-Worm/Generic.AYK C:\System Volume Information\_restore{AB7F3F4E-B328-41D2-973C-23AF082E28B3}\RP570\A0059045.exe 9/4/2007 5:08:54 AM A0059045.exe 54 KB
Virus found Win32/PEPatch C:\WINDOWS\system32\WinAvXX.exe 9/4/2007 9:19:49 AM WinAvXX.exe 15.5 KB





ComboFix 07-08-30.3 - "David" 2007-09-04 10:25:18.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.216 [GMT -6:00]


((((((((((((((((((((((((( Files Created from 2007-08-04 to 2007-09-04 )))))))))))))))))))))))))))))))


2007-09-04 09:28 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-09-04 03:21 0 --a------ C:\WINDOWS\nsreg.dat
2007-09-04 00:39 <DIR> d-------- C:\VundoFix Backups
2007-09-04 00:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-04 00:09 <DIR> d-------- C:\Program Files\Safer Networking
2007-09-03 23:31 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-03 23:11 39,424 --a------ C:\WINDOWS\system32\vtr.dll
2007-09-03 23:11 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\WinRAR
2007-09-03 13:45 <DIR> d-------- C:\Program Files\Winamp
2007-09-03 10:08 <DIR> d-------- C:\Program Files\Real Alternative
2007-09-03 10:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
2007-09-03 09:46 <DIR> d-------- C:\Program Files\QuickTime Alternative
2007-09-02 19:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-09-02 18:12 <DIR> d-------- C:\Program Files\Bonjour
2007-09-02 17:13 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-09-02 14:25 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Media Player Classic
2007-09-02 13:24 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2007-09-02 13:13 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Ahead
2007-09-02 13:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-09-02 13:05 <DIR> d-------- C:\Program Files\Nero
2007-09-02 13:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-09-02 12:21 <DIR> d-------- C:\Program Files\uTorrent
2007-09-02 12:21 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\uTorrent
2007-09-02 11:57 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-08-29 21:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\vsosdk
2007-08-20 01:52 87,608 --a------ C:\DOCUME~1\David\APPLIC~1\inst.exe
2007-08-20 01:52 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-08-20 01:52 47,360 --a------ C:\DOCUME~1\David\APPLIC~1\pcouffin.sys
2007-08-20 01:52 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2007-08-20 01:52 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2007-08-20 01:52 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2007-08-20 01:52 <DIR> d-------- C:\Program Files\VSO
2007-08-20 01:52 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Vso
2007-08-19 18:08 <DIR> d-------- C:\WINDOWS\pss


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-04 10:22 --------- d-------- C:\DOCUME~1\David\APPLIC~1\U3
2007-09-03 10:06 --------- d-------- C:\Program Files\Common Files\Real
2007-09-03 10:06 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Real
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Apple Computer
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-09-03 05:30 5393 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-09-02 16:33 --------- d-------- C:\DOCUME~1\David\APPLIC~1\AdobeUM
2007-09-02 14:55 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Webshots
2007-09-02 13:10 --------- d-------- C:\Program Files\Common Files\Ahead
2007-09-02 12:20 --------- d-------- C:\Program Files\Azureus
2007-09-02 12:19 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Azureus
2007-09-02 11:54 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-02 11:37 --------- d-------- C:\Program Files\Symantec
2007-09-02 11:37 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-09-02 11:35 --------- d-------- C:\Program Files\Ahead
2007-08-07 21:37 --------- d-------- C:\Program Files\Logitech
2007-08-03 14:30 --------- d-------- C:\DOCUME~1\David\APPLIC~1\NewspaperDirect
2007-07-21 23:46 --------- d-------- C:\Program Files\The_Pussycat_Dolls_-_PCD-[HwC]
2007-07-03 19:10 132904 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2007-07-03 19:10 11304 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2007-06-26 14:12 972072 --a------ C:\WINDOWS\UNNeroVision.exe
2007-01-25 00:50 3508069 --a------ C:\Program Files\Adobe Illustrator - Teach Yourself Illustrator in 24 hours - Sam' s (eBook).pdf
2007-01-22 00:50 9795648 --a------ C:\Program Files\Azureus_2.5.0.2_Win32.setup.exe
2006-12-09 13:11 0 --a------ C:\Program Files\AdbeRdrUpd707_all_incr.exe
2006-09-05 16:50 27136 --a------ C:\WINDOWS\Fonts.\Afiutil.exe
2004-10-18 17:04 16706160 --a------ C:\Program Files\AdbeRdr60_enu_full.exe
2004-10-18 17:02 6811656 --a------ C:\Program Files\psa201se_us.exe
2004-10-01 16:00 40960 --a------ C:\Program Files\Uninstall_CDS.exe
2001-11-22 22:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" []
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" []
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-13 19:10]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" []
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 03:50 C:\WINDOWS\LOGI_MWX.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 21:24]
"PDUiP6000DTskbr"="C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe" []
"PDUiP6000DMon"="C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-02 11:59]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" []
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-09-02 14:44]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2005-08-30 14:22]
"_Windows"="C:\WINDOWS\WinSecurity\services.exe" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-08-07 20:46]
"gStart"="C:\Garmin\gStart.exe" [2005-07-25 09:05]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Symantec NetDriver Warning"=C:\PROGRA~1\SYMNET~1\SNDWarn.exe

C:\DOCUME~1\David\STARTM~1\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50]

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys


Contents of the 'Scheduled Tasks' folder
2007-09-03 21:38:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-09-04 15:47:00 C:\WINDOWS\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-04 10:28:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

C:\WINDOWS\system32\cmd.exe [3520] 0x820612D0


scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-04 10:30:51
C:\ComboFix-quarantined-files.txt ... 2007-09-04 10:30
C:\ComboFix2.txt ... 2007-09-04 09:42

--- E O F ---






















Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:15 AM, on 9/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Garmin\gStart.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PDUiP6000DTskbr] C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
O4 - HKLM\..\Run: [PDUiP6000DMon] C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [_Windows] C:\WINDOWS\WinSecurity\services.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://www.walmartphotocentre.ca/activex/PCAXSetup.cab?
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Canon PIXMA iP6000D Memory Card Manager (PDUiP6000DMemCrdMgr) - CANON INC. - C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O24 - Desktop Component 0: (no name) - http://www.nasports.com/images_main/hrm.gif

--
End of file - 8256 bytes

#5 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:29 AM

Posted 05 September 2007 - 06:29 AM

Hi again :flowers:

Navigate to C:\Program Files\Trend Micro\HijackThis

Rename HijackThis.exe to Scanner.exe

-----

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
  • Open Spybot Search & Destroy.
  • In the Mode menu click "Advanced mode" if not already selected.
  • Choose "Yes" at the Warning prompt.
  • Expand the "Tools" menu.
  • Click "Resident".
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • In the File menu click "Exit" to exit Spybot Search & Destroy.
-------

Open notepad and copy/paste the text in the quotebox into it

File::
C:\WINDOWS\system32\vtr.dll
C:\WINDOWS\WinSecurity\services.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"_Windows"=-


Save it as CFScript.txt on your desktop.

Posted Image

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

---------

Download FindAWF.exe from here or here, and save it to your desktop.
  • Double-click on the FindAWF.exe file to run it.
  • It will open a command prompt and ask you to "Press any key to continue".
  • You will be presented with a Menu.

    1. Press 1 then Enter to scan for bak folders
    2. Press 2 then Enter to restore files from bak folders
    3. Press 3 then Enter to remove bak folders
    4. Press 4 then Enter to reset domain zones
    5. Press E then Enter to EXIT

  • Press 1, then press Enter
  • It may take a few minutes to complete so be patient.
  • When it is complete, it will open a text file in notepad called AWF.txt.
  • Please copy and paste the contents of the AWF.txt file in your next reply along with the ComboFix log, aswell as a fresh HijackThis log. :thumbsup:

Hi there, stranger!

#6 Vorbis

Vorbis
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 06 September 2007 - 12:01 AM

Unfortunately my uncle (who's computer I'm trying to fix) is not very computer literate and I will be flying 4500 miles home on Friday I won't be able to make any changes to his computer after that. To try to save time before I saw your latest reply I disabled TeaTime and ran combofix again then used spybot to disable useless and possibly malicious system startup entries such as Norton and sys32/WinAvXX.exe. Running Spybot/AVG/Combofix/etc I managed to stop any (noticable) symptoms and the computer seems to have run fine since. I have also done what you asked and the log files are below.

Due to the limited time I have left on this computer and the fact you're busy providing free help to a lot of people I don't think it matters if we remove all traces of everything (e.g. the 4.8mb of Norton files aren't important) as long as there is nothing malicious running in the background.


Thanks again for your help!




ComboFix 07-08-30.3 - "David" 2007-09-05 22:31:25.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.169 [GMT -6:00]
Command switches used :: C:\Documents and Settings\David\Desktop\CFScript.txt

FILE::
C:\WINDOWS\system32\vtr.dll
C:\WINDOWS\WinSecurity\services.exe


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\vtr.dll


((((((((((((((((((((((((( Files Created from 2007-08-06 to 2007-09-06 )))))))))))))))))))))))))))))))


2007-09-05 00:44 <DIR> d--h----- C:\BJPrinter
2007-09-04 09:28 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-09-04 03:21 0 --a------ C:\WINDOWS\nsreg.dat
2007-09-04 00:39 <DIR> d-------- C:\VundoFix Backups
2007-09-04 00:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-04 00:09 <DIR> d-------- C:\Program Files\Safer Networking
2007-09-03 23:31 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-03 23:11 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\WinRAR
2007-09-03 13:45 <DIR> d-------- C:\Program Files\Winamp
2007-09-03 10:08 <DIR> d-------- C:\Program Files\Real Alternative
2007-09-03 10:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
2007-09-03 09:46 <DIR> d-------- C:\Program Files\QuickTime Alternative
2007-09-02 19:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-09-02 18:12 <DIR> d-------- C:\Program Files\Bonjour
2007-09-02 17:13 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-09-02 14:25 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Media Player Classic
2007-09-02 13:24 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2007-09-02 13:13 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Ahead
2007-09-02 13:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-09-02 13:05 <DIR> d-------- C:\Program Files\Nero
2007-09-02 13:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-09-02 12:21 <DIR> d-------- C:\Program Files\uTorrent
2007-09-02 12:21 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\uTorrent
2007-09-02 11:57 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-08-29 21:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\vsosdk
2007-08-20 01:52 87,608 --a------ C:\DOCUME~1\David\APPLIC~1\inst.exe
2007-08-20 01:52 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-08-20 01:52 47,360 --a------ C:\DOCUME~1\David\APPLIC~1\pcouffin.sys
2007-08-20 01:52 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2007-08-20 01:52 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2007-08-20 01:52 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2007-08-20 01:52 <DIR> d-------- C:\Program Files\VSO
2007-08-20 01:52 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Vso
2007-08-19 18:08 <DIR> d-------- C:\WINDOWS\pss


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-04 22:46 --------- d-------- C:\Program Files\Canon
2007-09-04 22:27 --------- d-------- C:\Program Files\Logitech
2007-09-04 13:11 --------- d-------- C:\DOCUME~1\David\APPLIC~1\U3
2007-09-03 10:06 --------- d-------- C:\Program Files\Common Files\Real
2007-09-03 10:06 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Real
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Apple Computer
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-09-03 05:30 5393 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-09-02 16:33 --------- d-------- C:\DOCUME~1\David\APPLIC~1\AdobeUM
2007-09-02 14:55 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Webshots
2007-09-02 13:10 --------- d-------- C:\Program Files\Common Files\Ahead
2007-09-02 12:20 --------- d-------- C:\Program Files\Azureus
2007-09-02 12:19 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Azureus
2007-09-02 11:54 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-02 11:37 --------- d-------- C:\Program Files\Symantec
2007-09-02 11:37 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-09-02 11:35 --------- d-------- C:\Program Files\Ahead
2007-08-03 14:30 --------- d-------- C:\DOCUME~1\David\APPLIC~1\NewspaperDirect
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-21 23:46 --------- d-------- C:\Program Files\The_Pussycat_Dolls_-_PCD-[HwC]
2007-06-26 14:12 972072 --a------ C:\WINDOWS\UNNeroVision.exe
2007-01-25 00:50 3508069 --a------ C:\Program Files\Adobe Illustrator - Teach Yourself Illustrator in 24 hours - Sam' s (eBook).pdf
2007-01-22 00:50 9795648 --a------ C:\Program Files\Azureus_2.5.0.2_Win32.setup.exe
2006-12-09 13:11 0 --a------ C:\Program Files\AdbeRdrUpd707_all_incr.exe
2006-09-05 16:50 27136 --a------ C:\WINDOWS\Fonts.\Afiutil.exe
2004-10-18 17:04 16706160 --a------ C:\Program Files\AdbeRdr60_enu_full.exe
2004-10-18 17:02 6811656 --a------ C:\Program Files\psa201se_us.exe
2004-10-01 16:00 40960 --a------ C:\Program Files\Uninstall_CDS.exe
2001-11-22 22:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL


((((((((((((((((((((((((((((( snapshot_2007-09-04_ 94153.60 )))))))))))))))))))))))))))))))))))))))))

----a-w 86,016 2004-06-05 06:34:36 C:\WINDOWS\system32\CNMCP69.exe
----a-w 7,680 2004-06-07 20:00:00 C:\WINDOWS\system32\CNMVS69.DLL
----a-w 1,423,280 2007-09-05 04:48:41 C:\WINDOWS\system32\FNTCACHE.DAT
-c--a-w 92,504 2007-07-31 01:19:20 C:\WINDOWS\system32\dllcache\cdm.dll
-c--a-w 549,720 2007-07-31 01:19:36 C:\WINDOWS\system32\dllcache\wuapi.dll
-c--a-w 53,080 2007-07-31 01:19:16 C:\WINDOWS\system32\dllcache\wuauclt.exe
-c--a-w 1,712,984 2007-07-31 01:19:42 C:\WINDOWS\system32\dllcache\wuaueng.dll
-c--a-w 325,976 2007-07-31 01:19:32 C:\WINDOWS\system32\dllcache\wucltui.dll
-c--a-w 33,624 2007-07-31 01:18:40 C:\WINDOWS\system32\dllcache\wups.dll
-c--a-w 203,096 2007-07-31 01:19:46 C:\WINDOWS\system32\dllcache\wuweb.dll
----a-w 549,720 2007-07-31 01:19:36 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wuapi.dll\7.0.6000.381\wuapi.dll
----a-w 33,624 2007-07-31 01:18:40 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\wups.dll
----a-w 43,352 2007-07-31 01:19:12 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.0.6000.381\wups2.dll
----a-w 66,560 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMCP69.DLL
----a-w 153,600 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMD569.DLL
----a-w 397,824 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMDR69.DLL
----a-w 19,456 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMFU69.DLL
----a-w 15,872 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMOP69.DLL
----a-w 23,280 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP069.DAT
----a-w 27,140 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP169.DAT
----a-w 30,320 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP269.DAT
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPI69.DLL
----a-w 80,896 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV69.EXE
----a-w 863,744 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSB69.DLL
----a-w 8,704 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD69.EXE
----a-w 130,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM69.EXE
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ69.EXE
----a-w 110,592 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSR69.DLL
----a-w 322,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUI69.DLL
----a-w 219,648 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUR69.DLL
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMW369.DLL
----a-w 66,560 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMCP69.DLL
----a-w 153,600 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMD569.DLL
----a-w 397,824 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMDR69.DLL
----a-w 19,456 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMFU69.DLL
----a-w 15,872 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMOP69.DLL
----a-w 23,280 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP069.DAT
----a-w 27,140 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP169.DAT
----a-w 30,320 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP269.DAT
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPI69.DLL
----a-w 80,896 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPV69.EXE
----a-w 863,744 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSB69.DLL
----a-w 8,704 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSD69.EXE
----a-w 130,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSM69.EXE
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSQ69.EXE
----a-w 110,592 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSR69.DLL
----a-w 322,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUI69.DLL
----a-w 219,648 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUR69.DLL
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMW369.DLL
----a-w 54,272 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP69.DLL

----a-r 86,016 2004-06-04 15:34:36 C:\WINDOWS\system32\CNMCP69.exe
----a-w 7,680 2004-06-07 05:00:00 C:\WINDOWS\system32\CNMVS69.DLL
----a-w 1,423,360 2007-09-03 01:36:36 C:\WINDOWS\system32\FNTCACHE.DAT
-c--a-w 75,544 2005-05-26 10:16:24 C:\WINDOWS\system32\dllcache\cdm.dll
-c--a-w 465,176 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuapi.dll
-c--a-w 124,184 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuauclt.exe
-c--a-w 1,343,768 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuaueng.dll
-c--a-w 127,256 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wucltui.dll
-c--a-w 41,240 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wups.dll
-c--a-w 173,536 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuweb.dll
----a-w 66,560 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMCP69.DLL
----a-w 153,600 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMD569.DLL
----a-w 397,824 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMDR69.DLL
----a-w 19,456 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMFU69.DLL
----a-w 15,872 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMOP69.DLL
----a-w 23,280 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP069.DAT
----a-w 27,140 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP169.DAT
----a-w 30,320 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP269.DAT
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPI69.DLL
----a-w 80,896 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV69.EXE
----a-w 863,744 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSB69.DLL
----a-w 8,704 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD69.EXE
----a-w 130,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM69.EXE
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ69.EXE
----a-w 110,592 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSR69.DLL
----a-w 322,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUI69.DLL
----a-w 219,648 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUR69.DLL
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMW369.DLL
----a-w 66,560 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMCP69.DLL
----a-w 153,600 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMD569.DLL
----a-w 397,824 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMDR69.DLL
----a-w 19,456 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMFU69.DLL
----a-w 15,872 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMOP69.DLL
----a-w 23,280 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP069.DAT
----a-w 27,140 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP169.DAT
----a-w 30,320 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP269.DAT
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPI69.DLL
----a-w 80,896 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPV69.EXE
----a-w 863,744 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSB69.DLL
----a-w 8,704 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSD69.EXE
----a-w 130,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSM69.EXE
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSQ69.EXE
----a-w 110,592 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSR69.DLL
----a-w 322,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUI69.DLL
----a-w 219,648 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUR69.DLL
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMW369.DLL
----a-w 54,272 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP69.DLL

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-13 19:10]
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 03:50 C:\WINDOWS\LOGI_MWX.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-02 11:59]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-08-07 20:46]
"gStart"="C:\Garmin\gStart.exe" [2005-07-25 09:05]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Symantec NetDriver Monitor"=C:\PROGRA~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe
"<NO NAME>"=
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"PDUiP6000DMon"=C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
"PDUiP6000DTskbr"=C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
"WinAVX"=C:\WINDOWS\system32\WinAvXX.exe
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys


Contents of the 'Scheduled Tasks' folder
2007-09-03 21:38:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-09-06 03:47:00 C:\WINDOWS\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-05 22:37:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

C:\WINDOWS\system32\cmd.exe [1004] 0x818F2020


scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-05 22:39:34 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-05 22:39
C:\ComboFix2.txt ... 2007-09-04 10:30
C:\ComboFix3.txt ... 2007-09-04 09:42

--- E O F ---







Find AWF report by noahdfear 2006
Version 1.40

The current date is: Wed 09/05/2007
The current time is: 22:41:49.17


bak folders found
~~~~~~~~~~~



Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:44:48 PM, on 9/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Garmin\gStart.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1188967321984
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://www.walmartphotocentre.ca/activex/PCAXSetup.cab?
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O24 - Desktop Component 0: (no name) - http://www.nasports.com/images_main/hrm.gif

--
End of file - 7035 bytes

#7 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:29 AM

Posted 06 September 2007 - 03:57 AM

I don't know why AVG flags normally harmless files, some infection is messing with them probably.

Surf here and submit the following:

C:\WINDOWS\system32\igfxtray.exe

Wait for the scanners to finish, once done please paste the results here.

Open notepad (again) and copy/paste the text in the quotebox into it

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"<NO NAME>"=-
"WinAVX"=-


Save it as CFScript.txt on your desktop. (delete the earlier ones)

Posted Image

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply along with the VirusTotal results. :thumbsup:

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Hi there, stranger!

#8 Vorbis

Vorbis
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 06 September 2007 - 02:27 PM

Igfxtray.exe did not exist so I tried with igfxcfg.exe and the results came up negative. I appologise for forgetting to mention that I deleted all AVG quarantined files as they were not being used anyway (with the exception of the Canon files which were easily reinstalled). By the way am I correct in thinking that ComboFix re-enables System Restore even if it has previously been manually disabled?

File igfxcfg.exe received on 09.06.2007 21:08:40 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED


Result: 0/32 (0%)


ComboFix 07-08-30.3 - "David" 2007-09-06 13:23:48.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.191 [GMT -6:00]
Command switches used :: C:\Documents and Settings\David\Desktop\CFScript.txt
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-08-06 to 2007-09-06 )))))))))))))))))))))))))))))))


2007-09-05 00:44 <DIR> d--h----- C:\BJPrinter
2007-09-04 09:28 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-09-04 03:21 0 --a------ C:\WINDOWS\nsreg.dat
2007-09-04 00:39 <DIR> d-------- C:\VundoFix Backups
2007-09-04 00:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-04 00:09 <DIR> d-------- C:\Program Files\Safer Networking
2007-09-03 23:31 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-03 23:11 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\WinRAR
2007-09-03 13:45 <DIR> d-------- C:\Program Files\Winamp
2007-09-03 10:08 <DIR> d-------- C:\Program Files\Real Alternative
2007-09-03 10:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
2007-09-03 09:46 <DIR> d-------- C:\Program Files\QuickTime Alternative
2007-09-02 19:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-09-02 18:12 <DIR> d-------- C:\Program Files\Bonjour
2007-09-02 17:13 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-09-02 14:25 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Media Player Classic
2007-09-02 13:24 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2007-09-02 13:13 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Ahead
2007-09-02 13:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-09-02 13:05 <DIR> d-------- C:\Program Files\Nero
2007-09-02 13:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-09-02 12:21 <DIR> d-------- C:\Program Files\uTorrent
2007-09-02 12:21 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\uTorrent
2007-09-02 11:57 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-08-29 21:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\vsosdk
2007-08-20 01:52 87,608 --a------ C:\DOCUME~1\David\APPLIC~1\inst.exe
2007-08-20 01:52 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-08-20 01:52 47,360 --a------ C:\DOCUME~1\David\APPLIC~1\pcouffin.sys
2007-08-20 01:52 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2007-08-20 01:52 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2007-08-20 01:52 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2007-08-20 01:52 <DIR> d-------- C:\Program Files\VSO
2007-08-20 01:52 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Vso
2007-08-19 18:08 <DIR> d-------- C:\WINDOWS\pss


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-06 00:45 --------- d-------- C:\DOCUME~1\David\APPLIC~1\U3
2007-09-04 22:46 --------- d-------- C:\Program Files\Canon
2007-09-04 22:27 --------- d-------- C:\Program Files\Logitech
2007-09-03 10:06 --------- d-------- C:\Program Files\Common Files\Real
2007-09-03 10:06 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Real
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Apple Computer
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-09-03 05:30 5393 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-09-02 16:33 --------- d-------- C:\DOCUME~1\David\APPLIC~1\AdobeUM
2007-09-02 14:55 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Webshots
2007-09-02 13:10 --------- d-------- C:\Program Files\Common Files\Ahead
2007-09-02 12:20 --------- d-------- C:\Program Files\Azureus
2007-09-02 12:19 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Azureus
2007-09-02 11:54 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-02 11:37 --------- d-------- C:\Program Files\Symantec
2007-09-02 11:37 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-09-02 11:35 --------- d-------- C:\Program Files\Ahead
2007-08-03 14:30 --------- d-------- C:\DOCUME~1\David\APPLIC~1\NewspaperDirect
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-21 23:46 --------- d-------- C:\Program Files\The_Pussycat_Dolls_-_PCD-[HwC]
2007-06-26 14:12 972072 --a------ C:\WINDOWS\UNNeroVision.exe
2007-01-25 00:50 3508069 --a------ C:\Program Files\Adobe Illustrator - Teach Yourself Illustrator in 24 hours - Sam' s (eBook).pdf
2007-01-22 00:50 9795648 --a------ C:\Program Files\Azureus_2.5.0.2_Win32.setup.exe
2006-12-09 13:11 0 --a------ C:\Program Files\AdbeRdrUpd707_all_incr.exe
2006-09-05 16:50 27136 --a------ C:\WINDOWS\Fonts.\Afiutil.exe
2004-10-18 17:04 16706160 --a------ C:\Program Files\AdbeRdr60_enu_full.exe
2004-10-18 17:02 6811656 --a------ C:\Program Files\psa201se_us.exe
2004-10-01 16:00 40960 --a------ C:\Program Files\Uninstall_CDS.exe
2001-11-22 22:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL


((((((((((((((((((((((((((((( snapshot_2007-09-04_ 94153.60 )))))))))))))))))))))))))))))))))))))))))

----a-w 86,016 2004-06-05 06:34:36 C:\WINDOWS\system32\CNMCP69.exe
----a-w 7,680 2004-06-07 20:00:00 C:\WINDOWS\system32\CNMVS69.DLL
----a-w 1,423,280 2007-09-05 04:48:41 C:\WINDOWS\system32\FNTCACHE.DAT
-c--a-w 92,504 2007-07-31 01:19:20 C:\WINDOWS\system32\dllcache\cdm.dll
-c--a-w 549,720 2007-07-31 01:19:36 C:\WINDOWS\system32\dllcache\wuapi.dll
-c--a-w 53,080 2007-07-31 01:19:16 C:\WINDOWS\system32\dllcache\wuauclt.exe
-c--a-w 1,712,984 2007-07-31 01:19:42 C:\WINDOWS\system32\dllcache\wuaueng.dll
-c--a-w 325,976 2007-07-31 01:19:32 C:\WINDOWS\system32\dllcache\wucltui.dll
-c--a-w 33,624 2007-07-31 01:18:40 C:\WINDOWS\system32\dllcache\wups.dll
-c--a-w 203,096 2007-07-31 01:19:46 C:\WINDOWS\system32\dllcache\wuweb.dll
----a-w 549,720 2007-07-31 01:19:36 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wuapi.dll\7.0.6000.381\wuapi.dll
----a-w 33,624 2007-07-31 01:18:40 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\wups.dll
----a-w 43,352 2007-07-31 01:19:12 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.0.6000.381\wups2.dll
----a-w 66,560 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMCP69.DLL
----a-w 153,600 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMD569.DLL
----a-w 397,824 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMDR69.DLL
----a-w 19,456 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMFU69.DLL
----a-w 15,872 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMOP69.DLL
----a-w 23,280 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP069.DAT
----a-w 27,140 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP169.DAT
----a-w 30,320 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP269.DAT
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPI69.DLL
----a-w 80,896 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV69.EXE
----a-w 863,744 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSB69.DLL
----a-w 8,704 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD69.EXE
----a-w 130,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM69.EXE
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ69.EXE
----a-w 110,592 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSR69.DLL
----a-w 322,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUI69.DLL
----a-w 219,648 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUR69.DLL
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMW369.DLL
----a-w 66,560 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMCP69.DLL
----a-w 153,600 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMD569.DLL
----a-w 397,824 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMDR69.DLL
----a-w 19,456 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMFU69.DLL
----a-w 15,872 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMOP69.DLL
----a-w 23,280 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP069.DAT
----a-w 27,140 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP169.DAT
----a-w 30,320 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP269.DAT
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPI69.DLL
----a-w 80,896 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPV69.EXE
----a-w 863,744 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSB69.DLL
----a-w 8,704 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSD69.EXE
----a-w 130,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSM69.EXE
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSQ69.EXE
----a-w 110,592 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSR69.DLL
----a-w 322,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUI69.DLL
----a-w 219,648 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUR69.DLL
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMW369.DLL
----a-w 54,272 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP69.DLL

----a-r 86,016 2004-06-04 15:34:36 C:\WINDOWS\system32\CNMCP69.exe
----a-w 7,680 2004-06-07 05:00:00 C:\WINDOWS\system32\CNMVS69.DLL
----a-w 1,423,360 2007-09-03 01:36:36 C:\WINDOWS\system32\FNTCACHE.DAT
-c--a-w 75,544 2005-05-26 10:16:24 C:\WINDOWS\system32\dllcache\cdm.dll
-c--a-w 465,176 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuapi.dll
-c--a-w 124,184 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuauclt.exe
-c--a-w 1,343,768 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuaueng.dll
-c--a-w 127,256 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wucltui.dll
-c--a-w 41,240 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wups.dll
-c--a-w 173,536 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuweb.dll
----a-w 66,560 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMCP69.DLL
----a-w 153,600 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMD569.DLL
----a-w 397,824 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMDR69.DLL
----a-w 19,456 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMFU69.DLL
----a-w 15,872 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMOP69.DLL
----a-w 23,280 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP069.DAT
----a-w 27,140 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP169.DAT
----a-w 30,320 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP269.DAT
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPI69.DLL
----a-w 80,896 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV69.EXE
----a-w 863,744 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSB69.DLL
----a-w 8,704 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD69.EXE
----a-w 130,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM69.EXE
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ69.EXE
----a-w 110,592 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSR69.DLL
----a-w 322,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUI69.DLL
----a-w 219,648 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUR69.DLL
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMW369.DLL
----a-w 66,560 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMCP69.DLL
----a-w 153,600 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMD569.DLL
----a-w 397,824 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMDR69.DLL
----a-w 19,456 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMFU69.DLL
----a-w 15,872 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMOP69.DLL
----a-w 23,280 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP069.DAT
----a-w 27,140 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP169.DAT
----a-w 30,320 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP269.DAT
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPI69.DLL
----a-w 80,896 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPV69.EXE
----a-w 863,744 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSB69.DLL
----a-w 8,704 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSD69.EXE
----a-w 130,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSM69.EXE
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSQ69.EXE
----a-w 110,592 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSR69.DLL
----a-w 322,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUI69.DLL
----a-w 219,648 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUR69.DLL
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMW369.DLL
----a-w 54,272 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP69.DLL

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-13 19:10]
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 03:50 C:\WINDOWS\LOGI_MWX.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-02 11:59]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-08-07 20:46]
"gStart"="C:\Garmin\gStart.exe" [2005-07-25 09:05]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Symantec NetDriver Monitor"=C:\PROGRA~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe
"<NO NAME>"=
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"PDUiP6000DMon"=C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
"PDUiP6000DTskbr"=C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys


Contents of the 'Scheduled Tasks' folder
2007-09-03 21:38:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-09-06 15:47:01 C:\WINDOWS\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-06 13:27:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

C:\WINDOWS\system32\cmd.exe [2896] 0x81A91848


scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-06 13:29:20
C:\ComboFix-quarantined-files.txt ... 2007-09-06 13:29
C:\ComboFix2.txt ... 2007-09-05 22:39
C:\ComboFix3.txt ... 2007-09-04 10:30

--- E O F ---

Edited by Vorbis, 06 September 2007 - 02:29 PM.


#9 Vorbis

Vorbis
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 06 September 2007 - 08:09 PM

Kerio just stopped an intrusion of type code injection.

C:\WINDOWS\system32\T66xai1W.exe

I uploaded the file to VirusTotal then deleted it and no further problems have been noticed but I assume there is still something on this computer that is creating the randomly named .exe in \system32\.


Antivirus Version Last Update Result
AhnLab-V3 2007.9.5.0 2007.09.06 -
AntiVir 7.6.0.5 2007.09.06 TR/Crypt.ULPM.Gen
Authentium 4.93.8 2007.09.06 -
Avast 4.7.1029.0 2007.09.06 -
AVG 7.5.0.485 2007.09.06 -
BitDefender 7.2 2007.09.07 GenPack:Generic.Malware.Sdld.0AAA73C0
CAT-QuickHeal 9.00 2007.09.06 -
ClamAV 0.91.2 2007.09.06 -
DrWeb 4.33 2007.09.06 -
eSafe 7.0.15.0 2007.09.04 suspicious Trojan/Worm
eTrust-Vet 31.1.5116 2007.09.07 -
Ewido 4.0 2007.09.06 -
FileAdvisor 1 2007.09.07 -
Fortinet 3.11.0.0 2007.09.06 -
F-Prot 4.3.2.48 2007.09.06 -
F-Secure 6.70.13030.0 2007.09.07 -
Ikarus T3.1.1.12 2007.09.07 Backdoor.Win32.Agent.ark
Kaspersky 4.0.2.24 2007.09.07 -
McAfee 5114 2007.09.06 -
Microsoft 1.2803 2007.09.06 -
NOD32v2 2511 2007.09.07 a variant of Win32/Agent.ARK
Norman 5.80.02 2007.09.06 -
Panda 9.0.0.4 2007.09.06 Suspicious file
Prevx1 V2 2007.09.07 -
Rising 19.39.32.00 2007.09.06 -
Sophos 4.21.0 2007.09.07 Mal/HckPk-A
Sunbelt 2.2.907.0 2007.09.07 -
Symantec 10 2007.09.07 -
TheHacker 6.1.9.180 2007.09.07 -
VBA32 3.12.2.4 2007.09.06 -
VirusBuster 4.3.26:9 2007.09.06 -
Webwasher-Gateway 6.0.1 2007.09.07 Trojan.Crypt.ULPM.Gen
Additional information
File size: 23616 bytes
MD5: 44653e5bcc46d4b30e0b455cd91c6033
SHA1: abc286429f428ef9f61db56a2d4535714cad7bab
packers: UPX

#10 Vorbis

Vorbis
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 06 September 2007 - 08:19 PM

Uploading the last few most recently 'modified' files in \system32\ to VirusTotal has given the following logs. I have deleted these files.

File systems.txt received on 09.07.2007 03:09:58 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 10/32 (31.25%)
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 43 and 62 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2007.9.5.0 2007.09.06 -
AntiVir 7.6.0.5 2007.09.06 HEUR/Crypted
Authentium 4.93.8 2007.09.06 -
Avast 4.7.1029.0 2007.09.06 -
AVG 7.5.0.485 2007.09.06 -
BitDefender 7.2 2007.09.07 -
CAT-QuickHeal 9.00 2007.09.06 -
ClamAV 0.91.2 2007.09.06 -
DrWeb 4.33 2007.09.06 Trojan.Fakealert.305
eSafe 7.0.15.0 2007.09.04 -
eTrust-Vet 31.1.5116 2007.09.07 -
Ewido 4.0 2007.09.06 -
FileAdvisor 1 2007.09.07 -
Fortinet 3.11.0.0 2007.09.06 W32/LOWZONES.DD!tr
F-Prot 4.3.2.48 2007.09.06 -
F-Secure 6.70.13030.0 2007.09.07 not-virus:Hoax.Win32.Renos.jh
Ikarus T3.1.1.12 2007.09.07 not-a-virus:Hoax.Win32.Renos.jh
Kaspersky 4.0.2.24 2007.09.07 not-virus:Hoax.Win32.Renos.jh
McAfee 5114 2007.09.06 -
Microsoft 1.2803 2007.09.06 -
NOD32v2 2511 2007.09.07 -
Norman 5.80.02 2007.09.06 -
Panda 9.0.0.4 2007.09.06 Adware/WinAntiVirus2007
Prevx1 V2 2007.09.07 -
Rising 19.39.32.00 2007.09.06 -
Sophos 4.21.0 2007.09.07 Mal/EncPk-AV
Sunbelt 2.2.907.0 2007.09.07 -
Symantec 10 2007.09.07 Trojan.Perfcoo
TheHacker 6.1.9.180 2007.09.07 -
VBA32 3.12.2.4 2007.09.06 -
VirusBuster 4.3.26:9 2007.09.06 -
Webwasher-Gateway 6.0.1 2007.09.07 Heuristic.Crypted
Additional information
File size: 8192 bytes
MD5: c53e7177ad89116dad174f24f860bcb7
SHA1: 23f685b0b5a006fbf6fedc3b4de9f8ca0db0c827












File WinAvXX.ex_ received on 09.07.2007 03:15:09 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 11/32 (34.38%)
Loading server information...
Your file is queued in position: 5.
Estimated start time is between 56 and 81 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2007.9.5.0 2007.09.06 -
AntiVir 7.6.0.5 2007.09.06 TR/Crypt.ULPM.Gen
Authentium 4.93.8 2007.09.06 Possibly a new variant of W32/Fathom.3-based!Maximus
Avast 4.7.1029.0 2007.09.06 -
AVG 7.5.0.485 2007.09.06 -
BitDefender 7.2 2007.09.07 -
CAT-QuickHeal 9.00 2007.09.06 -
ClamAV 0.91.2 2007.09.06 -
DrWeb 4.33 2007.09.06 Trojan.Fakealert.305
eSafe 7.0.15.0 2007.09.04 suspicious Trojan/Worm
eTrust-Vet 31.1.5116 2007.09.07 -
Ewido 4.0 2007.09.06 -
FileAdvisor 1 2007.09.07 -
Fortinet 3.11.0.0 2007.09.06 -
F-Prot 4.3.2.48 2007.09.06 W32/Fathom.3-based!Maximus
F-Secure 6.70.13030.0 2007.09.07 -
Ikarus T3.1.1.12 2007.09.07 -
Kaspersky 4.0.2.24 2007.09.07 -
McAfee 5114 2007.09.06 New Malware.bc
Microsoft 1.2803 2007.09.06 Trojan:Win32/Startpage.gen!A
NOD32v2 2511 2007.09.07 -
Norman 5.80.02 2007.09.06 -
Panda 9.0.0.4 2007.09.06 Suspicious file
Prevx1 V2 2007.09.07 Spyware.WinAntiVirus
Rising 19.39.32.00 2007.09.06 -
Sophos 4.21.0 2007.09.07 Mal/EncPk-AV
Sunbelt 2.2.907.0 2007.09.07 -
Symantec 10 2007.09.07 -
TheHacker 6.1.9.180 2007.09.07 -
VBA32 3.12.2.4 2007.09.06 -
VirusBuster 4.3.26:9 2007.09.06 -
Webwasher-Gateway 6.0.1 2007.09.07 Trojan.Crypt.ULPM.Gen
Additional information
File size: 7680 bytes
MD5: 30fff2d0a51ec10f0fb4f935c16eeef7
SHA1: 2a5e6d5e912a167767c576815796ed486bd55d93
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5...27B93004D8F0F05

#11 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:29 AM

Posted 07 September 2007 - 02:37 AM

Please download SmitfraudFix © S!Ri to your desktop.

Double-click SmitFraudFix.exe.
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply. :thumbsup:

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
Hi there, stranger!

#12 Vorbis

Vorbis
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 07 September 2007 - 03:45 PM

Thanks again for your help, I'm flying home in about 6 hours so I'll have to email my uncle for further fixes.



SmitFraudFix v2.221

Scan done at 14:42:19.23, Fri 09/07/2007
Run from C:\Documents and Settings\David\Application Data\U3\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Garmin\gStart.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\David\Application Data\U3\0000060430080027\LaunchPad.exe
C:\Documents and Settings\David\Application Data\U3\0000060430080027\58EA136C-7E57-4416-B59E-394C46DD505B\Exec\trillian.exe
H:\System\Apps\3C9F7B3F-D55C-42cd-8537-B878518B73AF\Exec\firefox\firefox.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\WINDOWS\system32\cmd.exe

hosts

hosts file corrupted !

127.0.0.1 www.legal-at-spybot.info
127.0.0.1 legal-at-spybot.info

C:\


C:\WINDOWS

C:\WINDOWS\Tasks\At?.job FOUND !
C:\WINDOWS\Tasks\At??.job FOUND !

C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32


C:\WINDOWS\system32\LogFiles


C:\Documents and Settings\David


C:\Documents and Settings\David\Application Data


Start Menu


C:\DOCUME~1\David\FAVORI~1


Desktop


C:\Program Files


Corrupted keys


Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="http://www.nasports.com/images_main/hrm.gif"
"SubscribedURL"="http://www.nasports.com/images_main/hrm.gif"
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


Rustock



DNS

Description: Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler Miniport
DNS Server Search Order: 154.11.129.59
DNS Server Search Order: 154.11.129.187

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C25D7B0D-94AE-4A04-A4B4-FCED794C6A78}: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C25D7B0D-94AE-4A04-A4B4-FCED794C6A78}: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C25D7B0D-94AE-4A04-A4B4-FCED794C6A78}: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=154.11.129.59 154.11.129.187


Scanning for wininet.dll infection


End

#13 Vorbis

Vorbis
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 07 September 2007 - 05:59 PM

Last few scans before I head home.







SmitFraudFix v2.221

Scan done at 15:16:01.51, Fri 09/07/2007
Run from C:\Documents and Settings\David\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

Killing process


hosts

127.0.0.1 localhost
127.0.0.1 babe.the-killer.bz
127.0.0.1 www.babe.the-killer.bz
127.0.0.1 babe.k-lined.com
127.0.0.1 www.babe.k-lined.com
127.0.0.1 did.i-used.cc
127.0.0.1 www.did.i-used.cc
127.0.0.1 coolwwwsearch.com
127.0.0.1 www.coolwwwsearch.com
127.0.0.1 coolwebsearch.com
127.0.0.1 www.coolwebsearch.com
127.0.0.1 hi.studioaperto.net
127.0.0.1 www.hi.studioaperto.net
127.0.0.1 wazzupnet.com
127.0.0.1 www.wazzupnet.com
127.0.0.1 gueb.com
127.0.0.1 www.gueb.com
127.0.0.1 kabex.com
127.0.0.1 www.kabex.com
127.0.0.1 hityou.com
127.0.0.1 www.hityou.com
127.0.0.1 miosearch.com
127.0.0.1 www.miosearch.com
127.0.0.1 blue-elefant.com
127.0.0.1 www.blue-elefant.com
127.0.0.1 babeweb.de
127.0.0.1 www.babeweb.de
127.0.0.1 start-seite.com
127.0.0.1 www.start-seite.com
127.0.0.1 sexolymp.com
127.0.0.1 www.sexolymp.com
127.0.0.1 toriii.cc
127.0.0.1 www.toriii.cc
127.0.0.1 xtipp.de
127.0.0.1 www.xtipp.de
127.0.0.1 urawa.cool.ne.jp
127.0.0.1 777search.com
127.0.0.1 www.777search.com
127.0.0.1 ace-webmaster.com
127.0.0.1 www.ace-webmaster.com
127.0.0.1 aifind.info
127.0.0.1 www.aifind.info
127.0.0.1 amateurliveshow.com
127.0.0.1 www.amateurliveshow.com
127.0.0.1 anarchylolita.com
127.0.0.1 www.anarchylolita.com
127.0.0.1 anarchyporn.com
127.0.0.1 approvedlinks.com
127.0.0.1 www.approvedlinks.com
127.0.0.1 cantfind.com
127.0.0.1 www.cantfind.com
127.0.0.1 castingsamateur.com
127.0.0.1 www.castingsamateur.com
127.0.0.1 cyberrape.com
127.0.0.1 www.cyberrape.com
127.0.0.1 dialerclub.com
127.0.0.1 www.dialerclub.com
127.0.0.1 megago.com
127.0.0.1 exit.megago.com
127.0.0.1 www.megago.com
127.0.0.1 fastmetasearch.com
127.0.0.1 www.fastmetasearch.com
127.0.0.1 findwhatevernow.com
127.0.0.1 www.findwhatevernow.com
127.0.0.1 globesearch.com
127.0.0.1 www.globesearch.com
127.0.0.1 hotfreebies.com
127.0.0.1 www.hotfreebies.com
127.0.0.1 krankin.com
127.0.0.1 www.krankin.com
127.0.0.1 begin2search.com
127.0.0.1 www.begin2search.com
127.0.0.1 mainstreamdollars.com
127.0.0.1 www.mainstreamdollars.com
127.0.0.1 live.sex-explorer.com
127.0.0.1 www.live.sex-explorer.com
127.0.0.1 loveadot.com
127.0.0.1 www.loveadot.com
127.0.0.1 megaseek.net
127.0.0.1 www.megaseek.net
127.0.0.1 mixsearch.com
127.0.0.1 www.mixsearch.com
127.0.0.1 munky.com
127.0.0.1 www.munky.com
127.0.0.1 newtopsites.com
127.0.0.1 www.newtopsites.com
127.0.0.1 noblindlinks.com
127.0.0.1 www.noblindlinks.com
127.0.0.1 babenet.com
127.0.0.1 r.babenet.com
127.0.0.1 www.babenet.com
127.0.0.1 searchresult.net
127.0.0.1 www.searchresult.net
127.0.0.1 sexarena.org
127.0.0.1 www.sexarena.org
127.0.0.1 skeech.com
127.0.0.1 www.skeech.com
127.0.0.1 superwp.by.ru
127.0.0.1 sureseeker.com
127.0.0.1 www.sureseeker.com
127.0.0.1 wethere.com
127.0.0.1 www.wethere.com
127.0.0.1 wowsearch.org
127.0.0.1 www.wowsearch.org
127.0.0.1 xxx.com
127.0.0.1 www.xxx.com
127.0.0.1 art-xxx.com
127.0.0.1 websearch.com
127.0.0.1 www.websearch.com
127.0.0.1 firehunt.com
127.0.0.1 www.firehunt.com
127.0.0.1 partner23.firehunt.com
127.0.0.1 screensaver.it
127.0.0.1 www.screensaver.it
127.0.0.1 cliks.org
127.0.0.1 www.cliks.org
127.0.0.1 xads.cliks.org
127.0.0.1 xwebsearch.biz
127.0.0.1 www.xwebsearch.biz
127.0.0.1 znext.com
127.0.0.1 www.znext.com
127.0.0.1 rawtocash.net
127.0.0.1 www.rawtocash.net
127.0.0.1 7search.com
127.0.0.1 www.7search.com
127.0.0.1 zestyfind.com
127.0.0.1 www.zestyfind.com
127.0.0.1 ntcor.com
127.0.0.1 www.ntcor.com
127.0.0.1 dev.ntcor.com
127.0.0.1 xrenoder.com
127.0.0.1 www.xrenoder.com
127.0.0.1 search.xrenoder.com
127.0.0.1 allcybersearch.com
127.0.0.1 www.allcybersearch.com
127.0.0.1 tinybar.com
127.0.0.1 www.tinybar.com
127.0.0.1 topsite.us
127.0.0.1 www.topsite.us
127.0.0.1 topsites.us
127.0.0.1 www.topsites.us
127.0.0.1 topsitez.us
127.0.0.1 www.topsitez.us
127.0.0.1 true-counter.com
127.0.0.1 www.true-counter.com
127.0.0.1 out.true-counter.com
127.0.0.1 cnetadd.com
127.0.0.1 www.cnetadd.com
127.0.0.1 okmmm.com
127.0.0.1 www.okmmm.com
127.0.0.1 139mm.com
127.0.0.1 www.139mm.com
127.0.0.1 008k.com
127.0.0.1 www.008k.com
127.0.0.1 00hq.com
127.0.0.1 www.00hq.com
127.0.0.1 1-domains-registrations.com
127.0.0.1 www.1-domains-registrations.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 1sexparty.com
127.0.0.1 www.1sexparty.com
127.0.0.1 1stpagehere.com
127.0.0.1 www.1stpagehere.com
127.0.0.1 2020search.com
127.0.0.1 www.2020search.com
127.0.0.1 24teen.com
127.0.0.1 www.24teen.com
127.0.0.1 36site.com
127.0.0.1 www.36site.com
127.0.0.1 4corn.net
127.0.0.1 www.4corn.net
127.0.0.1 777top.com
127.0.0.1 www.777top.com
127.0.0.1 8ad.com
127.0.0.1 www.8ad.com
127.0.0.1 aboutclicker.com
127.0.0.1 www.aboutclicker.com
127.0.0.1 abrp.net
127.0.0.1 www.abrp.net
127.0.0.1 accessthefuture.net
127.0.0.1 www.accessthefuture.net
127.0.0.1 acemedic.com
127.0.0.1 www.acemedic.com
127.0.0.1 actionbreastcancer.org
127.0.0.1 www.actionbreastcancer.org
127.0.0.1 activexupdate.com
127.0.0.1 www.activexupdate.com
127.0.0.1 adamsupportgroup.org
127.0.0.1 www.adamsupportgroup.org
127.0.0.1 adasearch.com
127.0.0.1 www.adasearch.com
127.0.0.1 adipics.com
127.0.0.1 www.adipics.com
127.0.0.1 adspics.com
127.0.0.1 www.adspics.com
127.0.0.1 adult-engine-search.com
127.0.0.1 www.adult-engine-search.com
127.0.0.1 adult-erotic-guide.net
127.0.0.1 www.adult-erotic-guide.net
127.0.0.1 adult-friends-finder.net
127.0.0.1 www.adult-friends-finder.net
127.0.0.1 adulthyperlinks.com
127.0.0.1 www.adulthyperlinks.com
127.0.0.1 adulttds.com
127.0.0.1 www.adulttds.com
127.0.0.1 exaccess.ru
127.0.0.1 www.exaccess.ru
127.0.0.1 advert.exaccess.ru
127.0.0.1 agentstudio.com
127.0.0.1 africaspromise.org
127.0.0.1 akril.com
127.0.0.1 alcatel.ws
127.0.0.1 alfa-search.com
127.0.0.1 all-inet.com
127.0.0.1 allabtcars.com
127.0.0.1 allabtjeeps.com
127.0.0.1 allhyperlinks.com
127.0.0.1 allinternetbusiness.com
127.0.0.1 almarvideos.com
127.0.0.1 amandamountains.com
127.0.0.1 amigeek.com
127.0.0.1 amisbusiness.com
127.0.0.1 analmovi.com
127.0.0.1 anin.org
127.0.0.1 annaromeo.com
127.0.0.1 antrocity.com
127.0.0.1 anything4health.com
127.0.0.1 apsua.com
127.0.0.1 aregay.com
127.0.0.1 arheo.com
127.0.0.1 arizonaweb.org
127.0.0.1 armitageinn.com
127.0.0.1 art-func.com
127.0.0.1 artachnid.com
127.0.0.1 asiankingkong.com
127.0.0.1 ass-gals.com
127.0.0.1 athenrye.com
127.0.0.1 avian-ads.com
127.0.0.1 ayakawamura.com
127.0.0.1 ayumitaniguchi.com
127.0.0.1 bannedhost.net
127.0.0.1 barbudafarms.com
127.0.0.1 barnandfence.com
127.0.0.1 batsearch.com
127.0.0.1 baygraphicsllc.com
127.0.0.1 bb-search.com
127.0.0.1 bbbsearch.com
127.0.0.1 bedhome.com
127.0.0.1 bediadance.com
127.0.0.1 bellabasketsfl.com
127.0.0.1 bernaolatwin.com
127.0.0.1 best-counter.com
127.0.0.1 best-hardpics.com
127.0.0.1 best-winning-casino.com
127.0.0.1 bestcrawler.com
127.0.0.1 bestfor.ru
127.0.0.1 bestporngate.com
127.0.0.1 bestxporno.com
127.0.0.1 blackjack-free.net
127.0.0.1 blender.xu.pl
127.0.0.1 bodaciousbabette.com
127.0.0.1 boobdoll.com
127.0.0.1 boobsandtits.com
127.0.0.1 boobsclub.com
127.0.0.1 boredlife.com
127.0.0.1 bowlofogumbo.com
127.0.0.1 bradcoem.org
127.0.0.1 brandiyoung.com
127.0.0.1 brookeburn.com
127.0.0.1 bucps.com
127.0.0.1 burgerkingbigscreen.com
127.0.0.1 buscards.net
127.0.0.1 bustyrussell.com
127.0.0.1 buttejazz.org
127.0.0.1 buyselldomain.net
127.0.0.1 calcioturris.com
127.0.0.1 canberracricketcoaching.com
127.0.0.1 candycantaloupes.com
127.0.0.1 careers.dulcineasystems.net
127.0.0.1 carsands.com
127.0.0.1 carsrentals.net
127.0.0.1 casino-gambling-1.net
127.0.0.1 casino-gambling-2.net
127.0.0.1 casino-onlines.net
127.0.0.1 casino.com.free.game.pogo.gratisdownloads.nl
127.0.0.1 casino2win.net
127.0.0.1 casinomidas.net
127.0.0.1 casinonline.net
127.0.0.1 catallogue.com
127.0.0.1 catsss.da.ru
127.0.0.1 caxa.ru
127.0.0.1 cclebali.org
127.0.0.1 ceewawires.org
127.0.0.1 certumgroup.com
127.0.0.1 chelancatering.com
127.0.0.1 childrenvilla.com
127.0.0.1 chips-4-free.com
127.0.0.1 chrisswasey.com
127.0.0.1 chriswallace.net
127.0.0.1 ckick4thumbs.com
127.0.0.1 clackamasliteraryreview.com
127.0.0.1 clearsearch.cc
127.0.0.1 clearsearch.net
127.0.0.1 clickaire.com
127.0.0.1 clickyestoenter.net
127.0.0.1 clrsch.com
127.0.0.1 cmtapestry.com
127.0.0.1 cool-homepage.co
127.0.0.1 cool-homepage.com
127.0.0.1 cool-search.net
127.0.0.1 cool-search.netfartpost.com
127.0.0.1 cool-web-search.com
127.0.0.1 coolfetishsite.com
127.0.0.1 coolfreehost.com
127.0.0.1 coolfreepage.com
127.0.0.1 coolfreepages.com
127.0.0.1 coolmoneysearch.com
127.0.0.1 coolpornsearch.com
127.0.0.1 coolsearcher.info
127.0.0.1 coolwebsearsh.com
127.0.0.1 copmtraine.com
127.0.0.1 couldnotfind.com
127.0.0.1 count-all.com
127.0.0.1 cracks.me.uk
127.0.0.1 creamedcutties.com
127.0.0.1 creditsearchonline.com
127.0.0.1 crestring.com
127.0.0.1 crooder.com
127.0.0.1 curvedspaces.com
127.0.0.1 cvs.jps.ru
127.0.0.1 cvsymphony.com
127.0.0.1 cydom.com
127.0.0.1 daily-gals.com
127.0.0.1 dancingbabycd.com
127.0.0.1 datanotary.com
127.0.0.1 datareco.com
127.0.0.1 davemarshall.org
127.0.0.1 dcfitusa.com
127.0.0.1 defaultsearch.net
127.0.0.1 desarrollocreativo.com
127.0.0.1 develip.com
127.0.0.1 dewis.spb.ru
127.0.0.1 dewis.us
127.0.0.1 df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz
127.0.0.1 dietpills4free.com
127.0.0.1 dietpussy.com
127.0.0.1 digistreamsa.com
127.0.0.1 dionforvalleycouncil.org
127.0.0.1 doctorwaldron.com
127.0.0.1 document-not-found.pornpic.org
127.0.0.1 doggyaction.com
127.0.0.1 domain-your-registration.com
127.0.0.1 domains-for-you-online.com
127.0.0.1 domains2003.net
127.0.0.1 domkrat.com
127.0.0.1 dp-host.com
127.0.0.1 dragqueen.gay-clan.com
127.0.0.1 drug-sources-exposed.com
127.0.0.1 drvvv.com
127.0.0.1 dutch-sex.com
127.0.0.1 dvdbank.org
127.0.0.1 e-localad.com
127.0.0.1 e-plus.cc
127.0.0.1 e-websitesolutions.com
127.0.0.1 eases.net
127.0.0.1 easy-search.net
127.0.0.1 easycategories.com
127.0.0.1 ecosrioplatenses.org
127.0.0.1 ecstasyporn.net
127.0.0.1 eikokoike.com
127.0.0.1 epornsex.com
127.0.0.1 euuu.com
127.0.0.1 evidence-detector.biz
127.0.0.1 evilspidercomics.com
127.0.0.1 ewebsearch.net
127.0.0.1 findloss.com
127.0.0.1 excellentsckin.com
127.0.0.1 extremeseek.net
127.0.0.1 faithstevens.com
127.0.0.1 fantasiewelten.com
127.0.0.1 farmsteadbandb.com
127.0.0.1 fartpost.com
127.0.0.1 fastwebfinder.com
127.0.0.1 faxporn.com
127.0.0.1 fickenisgeil.de
127.0.0.1 finance-loans.com
127.0.0.1 find-itnow.com
127.0.0.1 find-uk-health.co.uk
127.0.0.1 find4u.net
127.0.0.1 findit-now.com
127.0.0.1 findthesite.com
127.0.0.1 findthewebsiteyouneed.com
127.0.0.1 www.findthewebsiteyouneed.com
127.0.0.1 fionasteel.com
127.0.0.1 firstbookmark.net
127.0.0.1 fitness-free.com
127.0.0.1 foodvacations.net
127.0.0.1 forex.jps.ru
127.0.0.1 forexcredit.com
127.0.0.1 forexcredit.ru
127.0.0.1 formingfusions.com
127.0.0.1 forsythfire.net
127.0.0.1 forthline.com
127.0.0.1 free-chipes.com
127.0.0.1 free-hit.com
127.0.0.1 free-pics-and-movies.com
127.0.0.1 free-sex-movie-clips.net
127.0.0.1 free4porno.net
127.0.0.1 free64all.com
127.0.0.1 freebookmark.net
127.0.0.1 freebookmarks.net
127.0.0.1 freecategories.com
127.0.0.1 freecoolhost.com
127.0.0.1 freerbhost.com
127.0.0.1 freeshemalepics.net
127.0.0.1 freeyaho.com
127.0.0.1 freshseek.com
127.0.0.1 freshteensite.com
127.0.0.1 gabrielscott.com
127.0.0.1 galpostgirls.com
127.0.0.1 gals-for-free.com
127.0.0.1 gambling-online4you.com
127.0.0.1 gameterror.net
127.0.0.1 gay50.com
127.0.0.1 generalsmeltingofcanada.com
127.0.0.1 geteens.com
127.0.0.1 getpicshere.com
127.0.0.1 gimmezamore.com
127.0.0.1 gimnasiaer.com
127.0.0.1 girls-porn-life.com
127.0.0.1 glbdf.org
127.0.0.1 global-finder.com
127.0.0.1 globe-finder.cc
127.0.0.1 globe-finder.com
127.0.0.1 gocybersearch.com
127.0.0.1 golftennis.net
127.0.0.1 good-mortgages-calculator.com
127.0.0.1 good-mortgages.net
127.0.0.1 goodsexs.com
127.0.0.1 googlebar.jps.ru
127.0.0.1 googlf.com
127.0.0.1 gradforum.org
127.0.0.1 gratis-porn-movie.com
127.0.0.1 gratis-pornopics.com
127.0.0.1 guzzycats.com
127.0.0.1 gzphoenix.com
127.0.0.1 hallnetaccolade.com
127.0.0.1 hand-book.com
127.0.0.1 happyanal.com
127.0.0.1 hard-gals.com
127.0.0.1 hardbodytgp.com
127.0.0.1 hardcoreover.com
127.0.0.1 hardloved.com
127.0.0.1 hardwareseek.net
127.0.0.1 harukaigawa.com
127.0.0.1 hccsolanonapa.org
127.0.0.1 health-protein.com
127.0.0.1 hentai4u.net
127.0.0.1 here4search.com
127.0.0.1 heyrichy.com
127.0.0.1 hi-search.com
127.0.0.1 hiddenguides.com
127.0.0.1 hitlistlyrics.com
127.0.0.1 holidayautostr.com
127.0.0.1 homemortage.ws
127.0.0.1 hostssp.com
127.0.0.1 hot-cartoon-sex.anime.american-teens.net
127.0.0.1 hotbookmark.com
127.0.0.1 hotels-list.net
127.0.0.1 hotelxxxcams.com
127.0.0.1 hotpopup.com
127.0.0.1 hotsearchbox.com
127.0.0.1 hotsex-series.com
127.0.0.1 hotstartpage.com
127.0.0.1 hqsex.biz
127.0.0.1 hugeporn4u.net
127.0.0.1 hunacsa.com
127.0.0.1 hupacasath.com
127.0.0.1 hzsx.com
127.0.0.1 icansearch.net
127.0.0.1 idgsearch.com
127.0.0.1 ie-search.com
127.0.0.1 incestporngate.com
127.0.0.1 infodigger.net
127.0.0.1 infoglobus.com
127.0.0.1 inherhole.com
127.0.0.1 insertthiscock.com
127.0.0.1 insurance-flood.net
127.0.0.1 insuranceall.net
127.0.0.1 internetsearch.ru
127.0.0.1 ionichost.com
127.0.0.1 ionomist.com
127.0.0.1 ipsex.net
127.0.0.1 itsanal.com
127.0.0.1 itseasy.us
127.0.0.1 iweb-commerce.com
127.0.0.1 iwebland.com
127.0.0.1 jeannineoldfield.com
127.0.0.1 jethomepage.com
127.0.0.1 jetseeker.com
127.0.0.1 jmhgallery.org
127.0.0.1 joannelatham.com
127.0.0.1 judin.ru
127.0.0.1 junkysex.com
127.0.0.1 karleyt.narod.ru
127.0.0.1 kathisomers.com
127.0.0.1 kazaa-lite.ws
127.0.0.1 keithgreenpro.com
127.0.0.1 kenmccaul.com
127.0.0.1 kilosex.com
127.0.0.1 kimhines.com
127.0.0.1 kinoru.com
127.0.0.1 ksdspups.org
127.0.0.1 landrape.com
127.0.0.1 lauraroebuck.com
127.0.0.1 leannalovelace.com
127.0.0.1 lesobank.ru
127.0.0.1 libertyonlinehosting.com
127.0.0.1 lingerie-mania.com
127.0.0.1 lisamatthew.com
127.0.0.1 liveholio.com
127.0.0.1 livenewspaper.com
127.0.0.1 louiseleeds.com
127.0.0.1 love-pix.com
127.0.0.1 lovelas.com
127.0.0.1 lovelysearch.com
127.0.0.1 low-taxes.com
127.0.0.1 luckysearch.net
127.0.0.1 lunitaweb.net
127.0.0.1 lustful-porno.com
127.0.0.1 mackinnonsbrook.org
127.0.0.1 madfinder.com
127.0.0.1 madisonmoons.com
127.0.0.1 madisonoilco.com
127.0.0.1 madonalive.com
127.0.0.1 majuozawa.com
127.0.0.1 makin-do.com
127.0.0.1 male4free.com
127.0.0.1 map-quest.org
127.0.0.1 marilynchamber.com
127.0.0.1 martfinder.com
127.0.0.1 massearch.com
127.0.0.1 matetrava.com
127.0.0.1 mature50.com
127.0.0.1 matureporngate.com
127.0.0.1 maxdzines.com
127.0.0.1 mcgeeforlabor.com
127.0.0.1 mdstunisie.org
127.0.0.1 medicare-insurance.net
127.0.0.1 medicare-supplemental.com
127.0.0.1 mega-dating-tips.com
127.0.0.1 megumikanzaki.com
127.0.0.1 meshalynn.com
127.0.0.1 meta-adult.com
127.0.0.1 meta-casino.com
127.0.0.1 meta-mobile.com
127.0.0.1 meta-porn.com
127.0.0.1 metafora.ru
127.0.0.1 metapoisk.ru
127.0.0.1 michiyonakajima.com
127.0.0.1 miconsultamedica.com
127.0.0.1 mikasakamoto.com
127.0.0.1 mikoni.com
127.0.0.1 militarygods.porn4porn.net
127.0.0.1 millennialpeople.org
127.0.0.1 mipham.org
127.0.0.1 missingcommand.com
127.0.0.1 mommykiss.com
127.0.0.1 moneyhunters.com
127.0.0.1 montgomeryhospitalanesthesia.com
127.0.0.1 morflot.com
127.0.0.1 mortgage-debt.net
127.0.0.1 mortismaximus.com
127.0.0.1 moscowwhores.com
127.0.0.1 moviecategories.com
127.0.0.1 mp3-pix.com
127.0.0.1 mrtg.jps.ru
127.0.0.1 msn-info.net
127.0.0.1 multipussy.com
127.0.0.1 mundopolar.com
127.0.0.1 mustv.com
127.0.0.1 mywebsearch.net
127.0.0.1 nativehardcore.com
127.0.0.1 naturalspy.com
127.0.0.1 nbasportsbook.net
127.0.0.1 nellyslyrics.com
127.0.0.1 nepgyan.com
127.0.0.1 nesrecords.com
127.0.0.1 netshastra.net
127.0.0.1 nettime.ru
127.0.0.1 nettracker.jps.ru
127.0.0.1 netyellowpages.info
127.0.0.1 new-incest.com
127.0.0.1 newcategories.com
127.0.0.1 newcracks.com
127.0.0.1 newcracks.net
127.0.0.1 newlife-lajolla.com
127.0.0.1 newsexgate.com
127.0.0.1 newtonsracks.com
127.0.0.1 newxpics.com
127.0.0.1 nhlsportsbook.net
127.0.0.1 niagaracapital.com
127.0.0.1 niche-tv.com
127.0.0.1 nmrba.com
127.0.0.1 nocalories.net
127.0.0.1 nocensor.com
127.0.0.1 ormandcompany.com
127.0.0.1 nsbabes.com
127.0.0.1 nuclearwitness.org
127.0.0.1 nursemania.com
127.0.0.1 nvntour.com
127.0.0.1 nvphall.org
127.0.0.1 oborot.com
127.0.0.1 ocalalivestockmarket.com
127.0.0.1 ocsff.com
127.0.0.1 oeatlanta.com
127.0.0.1 oharrowsearch.com
127.0.0.1 ok-search.com
127.0.0.1 okulta.com
127.0.0.1 omegabrains.net
127.0.0.1 online-casino-1.net
127.0.0.1 online-casino-bonus.info
127.0.0.1 online-casinos-x.com
127.0.0.1 online-winning.net
127.0.0.1 onlineserverz.com
127.0.0.1 onlinetradings.net
127.0.0.1 onlybleep.com
127.0.0.1 onlyinsured.com
127.0.0.1 operanabuco.com
127.0.0.1 opsex.com
127.0.0.1 oregoncharters.org
127.0.0.1 otrlives.com
127.0.0.1 ozawamadoka.com
127.0.0.1 paigesummer.com
127.0.0.1 pamelacollections.com
127.0.0.1 panamcup.com
127.0.0.1 pantygirls4u.com
127.0.0.1 pantyhoserealm.com
127.0.0.1 pantyplace.com
127.0.0.1 pastubes.com
127.0.0.1 paulapage.com
127.0.0.1 paulhoover.com
127.0.0.1 payfortraffic.net
127.0.0.1 pedo.ws
127.0.0.1 people.1gb.ru
127.0.0.1 pervertbot.com
127.0.0.1 pharma-diet-pills.com
127.0.0.1 pharmacy2003.com
127.0.0.1 pharmalocator.com
127.0.0.1 phendimetrazine-tenuate-adipex.com
127.0.0.1 pics-videos.com
127.0.0.1 picsdir.com
127.0.0.1 picsforbucks.com
127.0.0.1 picsofseductiveladies.com
127.0.0.1 pills-birth-control.com
127.0.0.1 pillsmall.com
127.0.0.1 pilotronix.com
127.0.0.1 pixpox.com
127.0.0.1 planemusic.com
127.0.0.1 poiska.net
127.0.0.1 poker-casino-free.com
127.0.0.1 poker-games-free.net
127.0.0.1 polradiologia.com
127.0.0.1 pooi.net
127.0.0.1 porn-teacher.com
127.0.0.1 porncamz.com
127.0.0.1 pornfree.info
127.0.0.1 pornnightdreams.com
127.0.0.1 pornokopec.com
127.0.0.1 porntetris.com
127.0.0.1 porntwist.com
127.0.0.1 powerwebsearch.com
127.0.0.1 prblitz.com
127.0.0.1 pretypics.com
127.0.0.1 pribalt.com
127.0.0.1 privacy-support.biz
127.0.0.1 privateporn.net
127.0.0.1 prostactive.com
127.0.0.1 prostol.com
127.0.0.1 protect-yourself.biz
127.0.0.1 prsainlandempire.org
127.0.0.1 put-your-link-here.com
127.0.0.1 pyrocorp.com
127.0.0.1 quick-search.ws
127.0.0.1 quiksearchgenealogy.com
127.0.0.1 radfrall.org
127.0.0.1 ramgo.com
127.0.0.1 ranafrog.ne
127.0.0.1 rapegate.com
127.0.0.1 redbudbmx.com
127.0.0.1 refinance-help.com
127.0.0.1 removeearthkeepers.org
127.0.0.1 rightfinder.net
127.0.0.1 robbsproshop.com
127.0.0.1 robertferencz.com
127.0.0.1 rotocasters.com
127.0.0.1 royalsearch.net
127.0.0.1 runsearch.com
127.0.0.1 russiansponsor.com
127.0.0.1 russogay.com
127.0.0.1 s2.exocrew.com
127.0.0.1 sacitylife.com
127.0.0.1 samplegals.com
127.0.0.1 sbssurvivor.com
127.0.0.1 scarypix.com
127.0.0.1 sccdnet.com
127.0.0.1 schoolforest.com
127.0.0.1 search-1.net
127.0.0.1 search-2003.com
127.0.0.1 search-about.net
127.0.0.1 search-hawk.com
127.0.0.1 search-log.com
127.0.0.1 search-meta.com
127.0.0.1 search-safe.com
127.0.0.1 search.psn.cn
127.0.0.1 searchadultweb.com
127.0.0.1 searchbutler.com
127.0.0.1 searchbuttler.com
127.0.0.1 searchbutler.org
127.0.0.1 searchcomplete.com
127.0.0.1 searchdesire.com
127.0.0.1 searchdot.net
127.0.0.1 searchexpander.com
127.0.0.1 searchfastnet.com
127.0.0.1 searchforge.com
127.0.0.1 searching-the-net.com
127.0.0.1 searchmeta.md
127.0.0.1 searchmeta.net
127.0.0.1 searchmeta.ru
127.0.0.1 searchmeta.webhost.ru
127.0.0.1 searchnow.ws
127.0.0.1 searchonfly.com
127.0.0.1 searchv.com
127.0.0.1 searchxl.com
127.0.0.1 searchxp.com
127.0.0.1 sebot.com
127.0.0.1 securenp.org
127.0.0.1 security-warning.biz
127.0.0.1 seehardcore.com
127.0.0.1 seekwell.net
127.0.0.1 selfbookmark.com
127.0.0.1 selfbookmark.info
127.0.0.1 selfbookmark.net
127.0.0.1 sex.free4porno.net
127.0.0.1 sex-coach.com
127.0.0.1 sex-festival.com
127.0.0.1 sex-video-galleries.com
127.0.0.1 sexgalleries4all.com
127.0.0.1 sexmoviesnet.com
127.0.0.1 sexpatriot.net
127.0.0.1 sexy18.cc
127.0.0.1 sexycat.adult-host.org
127.0.0.1 sfbayfolkboats.com
127.0.0.1 sgirls.net
127.0.0.1 sharempeg.com
127.0.0.1 shopcards.net
127.0.0.1 shopknights.com
127.0.0.1 sic02.com
127.0.0.1 sintrader.com
127.0.0.1 site1.ru
127.0.0.1 sites-in-web.com
127.0.0.1 sitevictoria.com
127.0.0.1 sixroads.com
127.0.0.1 skakalka.ru
127.0.0.1 slawsearch.com
127.0.0.1 slotch.com
127.0.0.1 slotchbar.com
127.0.0.1 smartsumo.com
127.0.0.1 smutarchive.net
127.0.0.1 solongas.com
127.0.0.1 sonomaevents.com
127.0.0.1 spermatrix.com
127.0.0.1 sportbooks-free4you.com
127.0.0.1 spros.com
127.0.0.1 spyass.com
127.0.0.1 spyorgy.net
127.0.0.1 staceyowens.com
127.0.0.1 stacistaxx.com
127.0.0.1 stacystaxx.com
127.0.0.1 start-space.com
127.0.0.1 steamycock.com
127.0.0.1 sterva.com
127.0.0.1 stevecashdollar.com
127.0.0.1 stop-tracking.biz
127.0.0.1 stopvotefraud.com
127.0.0.1 stopxxxpics.com
127.0.0.1 strekoza.com
127.0.0.1 stuffstore.com
127.0.0.1 styleclickink.com
127.0.0.1 summercollins.com
127.0.0.1 summitcross.com
127.0.0.1 super-spider.com
127.0.0.1 super-websearch.com
127.0.0.1 supersexmachine.com
127.0.0.1 superwebsearch.com
127.0.0.1 supret.com
127.0.0.1 suzannebrecht.com
127.0.0.1 sweeteenz.com
127.0.0.1 tacil.org
127.0.0.1 tangounion.com
127.0.0.1 tastethemusic.com
127.0.0.1 tax-refund4you.com
127.0.0.1 tech-jobs.ws
127.0.0.1 technology-related.com
127.0.0.1 teen-biz.com
127.0.0.1 teen-pic-post.com
127.0.0.1 teenpornosex.com
127.0.0.1 teens4free.net
127.0.0.1 teensact.com
127.0.0.1 teensgate.com
127.0.0.1 teensguru.com
127.0.0.1 teenswamp.com
127.0.0.1 testosterone-birth-control.com
127.0.0.1 the-exit.com
127.0.0.1 the-huns-yellow-pages.com
127.0.0.1 thefakejournal.com
127.0.0.1 thehuy.net
127.0.0.1 theproxy.org
127.0.0.1 therealsearch.com
127.0.0.1 thesten.com
127.0.0.1 thornleygroup.com
127.0.0.1 tings.org
127.0.0.1 tit-x.com
127.0.0.1 titanvision.com
127.0.0.1 titsianna.com
127.0.0.1 toddhayes.com
127.0.0.1 toon-comics.com
127.0.0.1 tooncomics.com
127.0.0.1 topsearcher.com
127.0.0.1 trafficback.com
127.0.0.1 trafficswitcher.com
127.0.0.1 travel.picture-posters.com
127.0.0.1 true-portal.com
127.0.0.1 trytechnical.com
127.0.0.1 ufindall.click-now.net
127.0.0.1 umaxsearch.com
127.0.0.1 une-autre-france.com
127.0.0.1 unigays.com
127.0.0.1 unipages.cc
127.0.0.1 up2you.ru
127.0.0.1 urlstat.com
127.0.0.1 urlstat.ru
127.0.0.1 uralitel.ru
127.0.0.1 ursie.net
127.0.0.1 utahsweet.com
127.0.0.1 utopicportal.com
127.0.0.1 uusocialjustice.org
127.0.0.1 v61.com
127.0.0.1 vaginpics.com
127.0.0.1 valmyers.com
127.0.0.1 vegas-free.com
127.0.0.1 vegbuy.com
127.0.0.1 veloventures.com
127.0.0.1 verzila.com
127.0.0.1 victoriaadam.com
127.0.0.1 videocategories.com
127.0.0.1 vitamins-for-each.com
127.0.0.1 votehowe.org
127.0.0.1 vxebony.com
127.0.0.1 wakeupdick.com
127.0.0.1 warnomore.org
127.0.0.1 watersport-specialties.com
127.0.0.1 web-homepage.net
127.0.0.1 web-search.tk
127.0.0.1 webcoolsearch.com
127.0.0.1 websearchdot.com
127.0.0.1 weekend-movies.com
127.0.0.1 wetpornostars.com
127.0.0.1 whatsyoursearch.com
127.0.0.1 white-pages.ws
127.0.0.1 whittierblvd.com
127.0.0.1 win-in-casino.com
127.0.0.1 wiresearch.com
127.0.0.1 wolfpacracing.com
127.0.0.1 wordlist.jps.ru
127.0.0.1 wpc2001.org
127.0.0.1 wspzone.sexpornonline.com
127.0.0.1 wwwbet.net
127.0.0.1 wwwbetting.net
127.0.0.1 wwwpokergames.com
127.0.0.1 wwwpokerplayers.com
127.0.0.1 wwwroulette.net
127.0.0.1 x-library.com
127.0.0.1 x-webdesign.com
127.0.0.1 xcomics4u.com
127.0.0.1 xic-bs.com
127.0.0.1 xldr.com
127.0.0.1 xp18.com
127.0.0.1 xrenosearch.com
127.0.0.1 xtragay.com
127.0.0.1 xu.xu.pl
127.0.0.1 xxxcategories.com
127.0.0.1 xxxemailxxx.com
127.0.0.1 y-e-l-l-o-w.com
127.0.0.1 yellow500.com
127.0.0.1 yezol.com
127.0.0.1 you-search.com
127.0.0.1 you-search.com.ru
127.0.0.1 youfindall.com
127.0.0.1 youfindall.net
127.0.0.1 your-prescriptions.net
127.0.0.1 yourbookmarks.info
127.0.0.1 yourbookmarks.ws
127.0.0.1 ypir.com
127.0.0.1 ysa-info.net
127.0.0.1 yukohamano.com
127.0.0.1 ywebsearch.info
127.0.0.1 zapros.com
127.0.0.1 zesearch.com
127.0.0.1 ziportal.com
127.0.0.1 zipportal.com
127.0.0.1 zoneoffreeporn.com
127.0.0.1 zoomegasite.com
127.0.0.1 zvimigdal.com
127.0.0.1 zyban-zocor-levitra.com
127.0.0.1 t.rack.cc
127.0.0.1 omega-search.com
127.0.0.1 cool-xxx.net
127.0.0.1 revolto3.da.ru
127.0.0.1 dating-search.net
127.0.0.1 linksummary.com
127.0.0.1 duolaimi.net
127.0.0.1 ez-searching.com
127.0.0.1 freehqmovies.com
127.0.0.1 xzoomy.com
127.0.0.1 freescratchandwin.com
127.0.0.1 globalwebsearch.com
127.0.0.1 www.gocybersearch.com
127.0.0.1 mayancasino.com
127.0.0.1 www.hastalavista.com
127.0.0.1 www.free-popup-killer.com
127.0.0.1 www.digitalfan.com
127.0.0.1 google123.web1000.com
127.0.0.1 search.ieplugin.com
127.0.0.1 i-lookup.com
127.0.0.1 spidersearch.com
127.0.0.1 istarthere.com
127.0.0.1 xxxtoolbar.com
127.0.0.1 www.seekporn.org
127.0.0.1 17-plus.com
127.0.0.1 lolita4all1.xrensmagpost.com
127.0.0.1 mafiapics.com
127.0.0.1 www.teenmonster.com
127.0.0.1 ie.marketdart.com
127.0.0.1 masterbar.com
127.0.0.1 search.netzany.co
127.0.0.1 only-virgins.com
127.0.0.1 passthison.com
127.0.0.1 blondetgp.com
127.0.0.1 prolivation.com
127.0.0.1 server-au.imrworldwide.com
127.0.0.1 rocketsearch.com
127.0.0.1 roar.com
127.0.0.1 searchaccurate.com
127.0.0.1 searchalot.com
127.0.0.1 searchandbrowse.com
127.0.0.1 gtawarehouse.com
127.0.0.1 startium.com
127.0.0.1 searchandclick.com
127.0.0.1 searchby.net
127.0.0.1 searchdot.com
127.0.0.1 search-exe.com
127.0.0.1 secret-crush.com
127.0.0.1 seekseek.com
127.0.0.1 sexarena.com
127.0.0.1 sexocean.play-lolita.com
127.0.0.1 startsurfing.com
127.0.0.1 srng.net
127.0.0.1 apps.webservicehost.com
127.0.0.1 search.shopnav.com
127.0.0.1 wish7.com
127.0.0.1 www.supersexpass.com
127.0.0.1 surferbar.com
127.0.0.1 xlola.underagehost.com
127.0.0.1 hotlolitas.underagehost.com
127.0.0.1 loading-lolita.com
127.0.0.1 www.xupiter.com
127.0.0.1 xjupiter.com
127.0.0.1 www.xjupiter.com
127.0.0.1 www.browserwise.com
127.0.0.1 sqwire.com
127.0.0.1 orbitexplorer.com
127.0.0.1 searchcentrix.com
127.0.0.1 categories.mygeek.com
127.0.0.1 web-entrance.co
127.0.0.1 whazit.com
127.0.0.1 windowenhancer.com
127.0.0.1 buz.ru
127.0.0.1 iwon.com
127.0.0.1 www.bonzi.com
127.0.0.1 featured-results.com
127.0.0.1 searchmadesafe.net
127.0.0.1 quicklaunch.com
127.0.0.1 www.cashsurfers.com
127.0.0.1 lop.com
127.0.0.1 tjdo.com
127.0.0.1 ebav.com
127.0.0.1 ebgo.com
127.0.0.1 ebaw.com
127.0.0.1 ebkb.com
127.0.0.1 ebmu.com
127.0.0.1 ecmp.com
127.0.0.1 edhq.com
127.0.0.1 edty.com
127.0.0.1 sbee.com
127.0.0.1 aavc.com
127.0.0.1 acjp.com
127.0.0.1 ecmh.com
127.0.0.1 emch.com
127.0.0.1 ecpm.com
127.0.0.1 wabu.com
127.0.0.1 wabq.com
127.0.0.1 ebch.com
127.0.0.1 ebdv.com
127.0.0.1 ebdw.com
127.0.0.1 ebjp.com
127.0.0.1 ebkn.com
127.0.0.1 ebky.com
127.0.0.1 eblv.com
127.0.0.1 wbkb.com
127.0.0.1 ebvr.com
127.0.0.1 ecwz.com
127.0.0.1 ecyb.com
127.0.0.1 eduy.com
127.0.0.1 eeev.com
127.0.0.1 farse.com
127.0.0.1 ibmx.com
127.0.0.1 icwb.com
127.0.0.1 icwo.com
127.0.0.1 icwp.com
127.0.0.1 iddh.com
127.0.0.1 idhh.com
127.0.0.1 ifiz.com
127.0.0.1 iguu.com
127.0.0.1 samz.com
127.0.0.1 saoe.com
127.0.0.1 sbjr.com
127.0.0.1 sbnl.com
127.0.0.1 sbnt.com
127.0.0.1 sbvr.com
127.0.0.1 scbm.com
127.0.0.1 sckr.com
127.0.0.1 scrk.com
127.0.0.1 sdry.com
127.0.0.1 seld.com
127.0.0.1 sfux.com
127.0.0.1 sheat.com
127.0.0.1 sipo.com
127.0.0.1 smds.com
127.0.0.1 srib.com
127.0.0.1 srox.com
127.0.0.1 srsf.com
127.0.0.1 ssaw.com
127.0.0.1 ssby.com
127.0.0.1 surj.com
127.0.0.1 tbvg.com
127.0.0.1 tdak.com
127.0.0.1 tdmy.com
127.0.0.1 tefs.com
127.0.0.1 tfil.com
127.0.0.1 tjar.com
127.0.0.1 tjaw.com
127.0.0.1 tjgo.com
127.0.0.1 tjem.com
127.0.0.1 torc.com
127.0.0.1 wfix.com
127.0.0.1 wflu.com
127.0.0.1 tdko.com
127.0.0.1 thko.com
127.0.0.1 H24413.tfil.com
127.0.0.1 germany.rub.to
127.0.0.1 search.rub.to
127.0.0.1 unitedstates.rub.to
127.0.0.1 www.commonname.com
127.0.0.1 www.ezcybersearch.com
127.0.0.1 www.jethomepage.com
127.0.0.1 www.gohip.com
127.0.0.1 hotbar.com
127.0.0.1 www.huntbar.com
127.0.0.1 search.imiserver.com
127.0.0.1 searchenhancement.com
127.0.0.1 newtonknows.com
127.0.0.1 search-explorer.net
127.0.0.1 searchsquire.com
127.0.0.1 secondpower.com
127.0.0.1 2ndpower.com
127.0.0.1 searchgateway.net
127.0.0.1 worldusa.com
127.0.0.1 www.topsearcher.com
127.0.0.1 smutserver.com
127.0.0.1 searchmeup.com
127.0.0.1 cameup.com
127.0.0.1 kliksearch.com
127.0.0.1 realphx.com
127.0.0.1 blazefind.com
127.0.0.1 zoofil.com
127.0.0.1 terafinder.com
127.0.0.1 008i.com
127.0.0.1 171203.com
127.0.0.1 39-93.com
127.0.0.1 adult-personal.us
127.0.0.1 cashsearch.biz
127.0.0.1 cl55.biz
127.0.0.1 dailyteenspic.com
127.0.0.1 dialer2004.com
127.0.0.1 digital-pornography.com
127.0.0.1 eager-sex.com
127.0.0.1 ergosites.com
127.0.0.1 freecj.com
127.0.0.1 greg-search.com
127.0.0.1 incest-host.com
127.0.0.1 ironcarteam.com
127.0.0.1 is-best.com
127.0.0.1 killerpornstars.com
127.0.0.1 lollitop.com
127.0.0.1 love-host.com
127.0.0.1 myexexex.com
127.0.0.1 my-finder.com
127.0.0.1 onlineclick.net
127.0.0.1 onlysex.ws
127.0.0.1 regfreeze.com
127.0.0.1 ruworld.com
127.0.0.1 selltraffic.biz
127.0.0.1 sexunique.net
127.0.0.1 sinpussy.com
127.0.0.1 teenhost.net
127.0.0.1 ultraload.net
127.0.0.1 vse-moe.biz
127.0.0.1 xsex.ws
127.0.0.1 75tz.com
127.0.0.1 iefeadsl.com
127.0.0.1 rf104.com
127.0.0.1 www.v61.com
127.0.0.1 ads.centralmedia.ws
127.0.0.1 c.centralmedia.ws
127.0.0.1 count.cc
127.0.0.1 topx.cc
127.0.0.1 sidefind.com
127.0.0.1 thenewsearch.com
127.0.0.1 new-search.net
127.0.0.1 x-google.net
127.0.0.1 adultgambling.org
127.0.0.1 bleepesonline.net
127.0.0.1 girls4rent.net
127.0.0.1 usefullsoft.net
127.0.0.1 livegambling.com
127.0.0.1 adultsgames.net
127.0.0.1 easyantispy.com
127.0.0.1 spybotremover.net
127.0.0.1 winprotect.net
127.0.0.1 funny-girls.com
127.0.0.1 winmsn.com
127.0.0.1 oneclicksearches.com
127.0.0.1 bestweblinks.com
127.0.0.1 iqsearch.net
127.0.0.1 dumpserv.com
127.0.0.1 helpyoursearch.com
127.0.0.1 sgrunt.biz
127.0.0.1 yeak.net
127.0.0.1 u45.cx
127.0.0.1 u46.cx
127.0.0.1 u47.cc
127.0.0.1 u48.cc
127.0.0.1 sfonditalia.biz
127.0.0.1 realarea.biz
127.0.0.1 archiviosex.net
127.0.0.1 agava.com
127.0.0.1 agava.ru
127.0.0.1 hut1.ru
127.0.0.1 hu15.ru
127.0.0.1 winfixer.com
127.0.0.1 3721.com
127.0.0.1 easysearchingtips.com
127.0.0.1 fine-search.net
127.0.0.1 noproblemsurf.com
127.0.0.1 pcspyremover.com
127.0.0.1 search-motor.com
127.0.0.1 searchwhatuwant.com
127.0.0.1 ad25.com
127.0.0.1 ad45.com
127.0.0.1 ad77.com
127.0.0.1 ad86.com
127.0.0.1 full-search.net
127.0.0.1 go2-search.com
127.0.0.1 onemoresearch.net
127.0.0.1 search-777.com
127.0.0.1 search-to-find.com
127.0.0.1 search-what.net
127.0.0.1 winshow.biz
127.0.0.1 lookfor.cc
127.0.0.1 looking-for.cc
127.0.0.1 tgp-4-you.com
127.0.0.1 veryeasysearch.com
127.0.0.1 010402.com
127.0.0.1 20x2p.com
127.0.0.1 db105.com
127.0.0.1 ga31.com
127.0.0.1 mpeg-look.com
127.0.0.1 n-udd.com
127.0.0.1 p-uud.com
127.0.0.1 porn-screen.com
127.0.0.1 rb37.com
127.0.0.1 t058.com
127.0.0.1 u-239.com
127.0.0.1 v-224.com
127.0.0.1 trackhits.cc
127.0.0.1 tracktraff.cc
127.0.0.1 power-cleaner.com
127.0.0.1 yoursitebar.com
127.0.0.1 ysbweb.com
127.0.0.1 www.ysbweb.com
127.0.0.1 installcash.com
127.0.0.1 toolbarcash.com
127.0.0.1 enjoywebsurf.com
127.0.0.1 msnguard.cc
127.0.0.1 searchclick.cc
127.0.0.1 havy.biz
127.0.0.1 ewizard.cc
127.0.0.1 4klm.com
127.0.0.1 camup.net
127.0.0.1 bdsmlibrary.net
127.0.0.1 n-glx.s-redirect.com
127.0.0.1 aaasexypics.com
127.0.0.1 allforadult.com
127.0.0.1 autoescrowpay.com
127.0.0.1 awmcash.biz
127.0.0.1 awmdabest.com
127.0.0.1 buldog-stats.com
127.0.0.1 counter.sexmaniack.com
127.0.0.1 fregat.drocherway.com
127.0.0.1 greg-tut.com
127.0.0.1 iframe.biz
127.0.0.1 megapornix.com
127.0.0.1 newiframe.biz
127.0.0.1 nylonsexy.com
127.0.0.1 pizdato.biz
127.0.0.1 sexfiles.nu
127.0.0.1 slutmania.biz
127.0.0.1 sp2bleeped.biz
127.0.0.1 toolbarpartner.com
127.0.0.1 vesbiz.biz
127.0.0.1 virgin-tgp.net
127.0.0.1 vparivalka.com
127.0.0.1 x.full-tgp.net
127.0.0.1 toolbar.cc
127.0.0.1 himen.biz
127.0.0.1 msupdater.net
127.0.0.1 www.msupdater.net
127.0.0.1 1800searchonline.com
127.0.0.1 www.1800searchonline.com
127.0.0.1 1stsearchportal.com
127.0.0.1 www.1stsearchportal.com
127.0.0.1 24-7searching-and-more.com
127.0.0.1 www.24-7searching-and-more.com
127.0.0.1 971searchbox.com
127.0.0.1 www.971searchbox.com
127.0.0.1 aaawebfinder.com
127.0.0.1 www.aaawebfinder.com
127.0.0.1 ampmsearch.com
127.0.0.1 www.ampmsearch.com
127.0.0.1 clickhere4search.com
127.0.0.1 www.clickhere4search.com
127.0.0.1 clicktomakeasearch.com
127.0.0.1 www.clicktomakeasearch.com
127.0.0.1 directsearchzone.com
127.0.0.1 www.directsearchzone.com
127.0.0.1 easysearch4you.com
127.0.0.1 www.easysearch4you.com
127.0.0.1 enterthesearch.com
127.0.0.1 www.enterthesearch.com
127.0.0.1 esearch2005.com
127.0.0.1 www.esearch2005.com
127.0.0.1 eza1netsearch.com
127.0.0.1 www.eza1netsearch.com
127.0.0.1 ezwebsearching.com
127.0.0.1 www.ezwebsearching.com
127.0.0.1 globalefinder.com
127.0.0.1 www.globalefinder.com
127.0.0.1 go2realsearch.com
127.0.0.1 www.go2realsearch.com
127.0.0.1 myseachexplorer.com
127.0.0.1 www.myseachexplorer.com
127.0.0.1 quicksearch360.com
127.0.0.1 www.quicksearch360.com
127.0.0.1 s1s1s1search.com
127.0.0.1 www.s1s1s1search.com
127.0.0.1 search101online.com
127.0.0.1 www.search101online.com
127.0.0.1 search123forme.com
127.0.0.1 www.search123forme.com
127.0.0.1 search345quest.com
127.0.0.1 www.search345quest.com
127.0.0.1 searchmiracle.com
127.0.0.1 www.searchmiracle.com
127.0.0.1 searchtheworld4you.com
127.0.0.1 www.searchtheworld4you.com
127.0.0.1 searchwebzone.com
127.0.0.1 www.searchwebzone.com
127.0.0.1 seektheglobe.com
127.0.0.1 www.seektheglobe.com
127.0.0.1 sitesearchcentral.com
127.0.0.1 www.sitesearchcentral.com
127.0.0.1 the818search-co.com
127.0.0.1 www.the818search-co.com
127.0.0.1 type2find.com
127.0.0.1 www.type2find.com
127.0.0.1 xosearchox.com
127.0.0.1 www.xosearchox.com
127.0.0.1 yoursearchspace.com
127.0.0.1 www.yoursearchspace.com
127.0.0.1 httpwwwads.com
127.0.0.1 www.httpwwwads.com
127.0.0.1 adshttp.com
127.0.0.1 www.adshttp.com
127.0.0.1 adsonwww.com
127.0.0.1 www.adsonwww.com
127.0.0.1 dnaads.com
127.0.0.1 www.dnaads.com
127.0.0.1 marketengines.com
127.0.0.1 www.marketengines.com
127.0.0.1 ad-w-a-r-e.com
127.0.0.1 www.ad-w-a-r-e.com
127.0.0.1 a-d-w-a-r-e.com
127.0.0.1 www.a-d-w-a-r-e.com
127.0.0.1 securityindex.net
127.0.0.1 www.securityindex.net
127.0.0.1 sexpicsporn.com
127.0.0.1 www.sexpicsporn.com
127.0.0.1 free-spybot.com
127.0.0.1 www.free-spybot.com
127.0.0.1 cashengines.com
127.0.0.1 www.cashengines.com
127.0.0.1 microsoftantispyware.net
127.0.0.1 www.microsoftantispyware.net
127.0.0.1 mircosoftantispy.com
127.0.0.1 www.mircosoftantispy.com
127.0.0.1 msantispy.com
127.0.0.1 www.msantispy.com
127.0.0.1 netspyprotector.com
127.0.0.1 www.netspyprotector.com
127.0.0.1 avforce.com
127.0.0.1 www.avforce.com
127.0.0.1 savehits.com
127.0.0.1 www.savehits.com
127.0.0.1 saveli.com
127.0.0.1 www.saveli.com
127.0.0.1 metastop.com
127.0.0.1 www.metastop.com
127.0.0.1 perlink.biz
127.0.0.1 www.perlink.biz
127.0.0.1 highdialer.com
127.0.0.1 www.highdialer.com
127.0.0.1 online-more.com
127.0.0.1 www.online-more.com
127.0.0.1 www.syserrors.com
127.0.0.1 www.vcodec.com
127.0.0.1 toolbartraff.biz
127.0.0.1 www.toolbartraff.biz
127.0.0.1 pcadprotector.cc
127.0.0.1 www.pcadprotector.cc
127.0.0.1 airtleworld.com
127.0.0.1 www.airtleworld.com
127.0.0.1 domaincar.com
127.0.0.1 www.domaincar.com
127.0.0.1 worldray.com
127.0.0.1 www.worldray.com
127.0.0.1 www5.worldray.com
127.0.0.1 www6.worldray.com
127.0.0.1 www.spytrooper.com
127.0.0.1 spytrooper.com
127.0.0.1 dl.ad-ware.cc
127.0.0.1 ad-ware.cc
127.0.0.1 downloads.adaware.cc
127.0.0.1 adaware.cc
127.0.0.1 hitscount.net
127.0.0.1 count.hitscount.net
127.0.0.1 fined.biz
127.0.0.1 de.ag
127.0.0.1 games.de.ag
127.0.0.1 www.games.de.ag
127.0.0.1 little-download.net
127.0.0.1 www.little-download.net
127.0.0.1 little-help.com
127.0.0.1 www.little-help.com
127.0.0.1 www.spyaxe.net
127.0.0.1 www.spyaxe.com
127.0.0.1 www.spyaxe.biz
127.0.0.1 www.malwarewipe.com
127.0.0.1 dl.malwarewipe.com
127.0.0.1 www.malwarewipeupdate.com
127.0.0.1 unionseek.com
127.0.0.1 www.unionseek.com
127.0.0.1 sirh0t.blackhats.tc
127.0.0.1 blackhats.tc
127.0.0.1 www.blackhats.tc
127.0.0.1 ritztours.com
127.0.0.1 www.ritztours.com
127.0.0.1 flashflashmx.3322.org
127.0.0.1 3322.org
127.0.0.1 www.3322.org
127.0.0.1 jupitersatellites.biz
127.0.0.1 www.jupitersatellites.biz
127.0.0.1 yops.biz
127.0.0.1 www.yops.biz
127.0.0.1 goldengr.hypermart.net
127.0.0.1 web-nexus.net
127.0.0.1 safe-sales.biz
127.0.0.1 www.safe-sales.biz
127.0.0.1 jerrynews.com
127.0.0.1 www.jerrynews.com
127.0.0.1 Teslaplus.com
127.0.0.1 www.Teslaplus.com
127.0.0.1 WorldAntiSpy.com
127.0.0.1 www.WorldAntiSpy.com
127.0.0.1 www.securitycaution.com
127.0.0.1 securitycaution.com
127.0.0.1 adservs.com
127.0.0.1 csx.adservs.com
127.0.0.1 www.csx.adservs.com
127.0.0.1 toolbarbest.biz
127.0.0.1 www.toolbarbest.biz
127.0.0.1 game4all.biz
127.0.0.1 www.game4all.biz
127.0.0.1 wm.kannylizaciya.info
127.0.0.1 www.wm.kannylizaciya.info
127.0.0.1 wm.buhartes.info
127.0.0.1 www.wm.buhartes.info
127.0.0.1 login.fric.cn
127.0.0.1 www.login.fric.cn
127.0.0.1 xsremover.com
127.0.0.1 www.xsremover.com
127.0.0.1 spydeface.com
127.0.0.1 www.spydeface.com
127.0.0.1 alfacleaner.com
127.0.0.1 www.alfacleaner.com
127.0.0.1 innovagest2000.com
127.0.0.1 www.innovagest2000.com
127.0.0.1 www.thespyguard.com
127.0.0.1 thespyguard.com
127.0.0.1 www.adwarepunisher.com
127.0.0.1 adwarepunisher.com
127.0.0.1 www.spyiblock.com
127.0.0.1 spyiblock.com
127.0.0.1 www.uvu-channel.com
127.0.0.1 uvu-channel.com
127.0.0.1 www.hachimitsu-lemon.com
127.0.0.1 hachimitsu-lemon.com
127.0.0.1 SEARCHTOFIND.NET
127.0.0.1 www.SEARCHTOFIND.NET
127.0.0.1 www.pestrap.com
127.0.0.1 pestrap.com
127.0.0.1 uptodatesecurity.com
127.0.0.1 www.uptodatesecurity.com
127.0.0.1 thinstall.abetterinternet.com
127.0.0.1 www.3abetterinternet.com
127.0.0.1 download.abetterinternet.com
127.0.0.1 www.abetterinternet.com
127.0.0.1 qmex.psyche-evolution.com
127.0.0.1 www.qmex.psyche-evolution.com
127.0.0.1 core.psyche-evolution.com
127.0.0.1 www.core.psyche-evolution.com
127.0.0.1 1stantivirus.com
127.0.0.1 www.1stantivirus.com
127.0.0.1 scanandrepair.com
127.0.0.1 www.scanandrepair.com
127.0.0.1 uydsiygeds.com
127.0.0.1 www.uydsiygeds.com
127.0.0.1 pesttrap.com
127.0.0.1 www.pesttrap.com
127.0.0.1 adwarebazooka.com
127.0.0.1 get.adwarebazooka.com
127.0.0.1 www.adwarebazooka.com
127.0.0.1 kliksoftware.com
127.0.0.1 www.kliksoftware.com
127.0.0.1 hitvirus.com
127.0.0.1 get.hitvirus.com
127.0.0.1 www.hitvirus.com
127.0.0.1 promo.dollarrevenue.com
127.0.0.1 www.promo.dollarrevenue.com
127.0.0.1 maxifile.com
127.0.0.1 www.maxifile.com
127.0.0.1 targetsaver.com
127.0.0.1 www.targetsaver.com
127.0.0.1 dl.targetsaver.com
127.0.0.1 www.dl.targetsaver.com
127.0.0.1 nonameforthisdomain.com
127.0.0.1 www.nonameforthisdomain.com
127.0.0.1 hypoteches.com
127.0.0.1 www.hypoteches.com
127.0.0.1 www.earthllnk.net
127.0.0.1 earthllnk.net
127.0.0.1 hostance.net
127.0.0.1 www.hostance.net
127.0.0.1 my-dedik-one.com
127.0.0.1 www.my-dedik-one.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 6sek.com
127.0.0.1 www.6sek.com
127.0.0.1 cashdeluxe.net
127.0.0.1 www.cashdeluxe.net
127.0.0.1 stats.cashdeluxe.net
127.0.0.1 www.stats.cashdeluxe.net
127.0.0.1 www.2006ooo.com
127.0.0.1 www.spyware-stop.com
127.0.0.1 spyware-stop.com
127.0.0.1 www.SpyShield.org
127.0.0.1 SpyShield.org
127.0.0.1 utils.winfixer.com
127.0.0.1 www.utils.winfixer.com
127.0.0.1 toolbarbucks.biz
127.0.0.1 www.toolbarbucks.biz
127.0.0.1 derklaif.biz
127.0.0.1 www.derklaif.biz
127.0.0.1 www.v-codec.com
127.0.0.1 v-codec.com
127.0.0.1 www.emediacodec.com
127.0.0.1 emediacodec.com
127.0.0.1 www.popentertain.com
127.0.0.1 popentertain.com
127.0.0.1 softwareprofit.com
127.0.0.1 www.softwareprofit.com
127.0.0.1 de.winantivirus.com
127.0.0.1 download.winantivirus.com
127.0.0.1 winantivirus.com
127.0.0.1 www.winantivirus.com
127.0.0.1 offers.bullseye-network.com
127.0.0.1 www.offers.bullseye-network.com
127.0.0.1 bullseye-network.com
127.0.0.1 www.bullseye-network.com
127.0.0.1 sponsor2.ucmore.com
127.0.0.1 www.sponsor2.ucmore.com
127.0.0.1 hostthesky.com
127.0.0.1 www.hostthesky.com
127.0.0.1 dbdecicated.com
127.0.0.1 www.dbdecicated.com
127.0.0.1 readagreement.net
127.0.0.1 www.readagreement.net
127.0.0.1 gl.secdep.info
127.0.0.1 www.gl.secdep.info
127.0.0.1 spyfalcon.com
127.0.0.1 www.spyfalcon.com
127.0.0.1 spyfalconupdate.com
127.0.0.1 www.spyfalconupdate.com
127.0.0.1 spy-shield.com
127.0.0.1 www.spy-shield.com
127.0.0.1 winnanny.com
127.0.0.1 www.winnanny.com
127.0.0.1 winsoftware.com
127.0.0.1 www.winsoftware.com
127.0.0.1 winfirewall.com
127.0.0.1 www.winfirewall.com
127.0.0.1 winantispyware.com
127.0.0.1 www.winantispyware.com
127.0.0.1 udefender.com
127.0.0.1 www.udefender.com
127.0.0.1 bravesentry.com
127.0.0.1 www.bravesentry.com
127.0.0.1 content.dollarrevenue.com
127.0.0.1 www.content.dollarrevenue.com
127.0.0.1 toolbar.azebar.com
127.0.0.1 www.toolbar.azebar.com
127.0.0.1 traffsale1.biz
127.0.0.1 www.traffsale1.biz
127.0.0.1 spywaredisinfector.com
127.0.0.1 www.spywaredisinfector.com
127.0.0.1 SpyCut.com
127.0.0.1 www.SpyCut.com
127.0.0.1 almanah.biz
127.0.0.1 www.almanah.biz
127.0.0.1 antispydns.biz
127.0.0.1 www.antispydns.biz
127.0.0.1 spyaxeupdate.com
127.0.0.1 www.spyaxeupdate.com
127.0.0.1 malwarewipesupport.com
127.0.0.1 www.malwarewipesupport.com
127.0.0.1 remedyantispy.com
127.0.0.1 www.remedyantispy.com
127.0.0.1 systemstable.com
127.0.0.1 www.systemstable.com
127.0.0.1 whoisprivacyprotect.com
127.0.0.1 www.whoisprivacyprotect.com
127.0.0.1 prime.webhancer.com
127.0.0.1 www.prime.webhancer.com
127.0.0.1 webhancer.com
127.0.0.1 www.webhancer.com
127.0.0.1 dr.webhancer.com
127.0.0.1 www.dr.webhancer.com
127.0.0.1 dr2.webhancer.com
127.0.0.1 www.dr2.webhancer.com
127.0.0.1 www.onli-ne.com
127.0.0.1 spycontra.com
127.0.0.1 www.spycontra.com
127.0.0.1 anti-virus-pro.com
127.0.0.1 www.anti-virus-pro.com
127.0.0.1 check.jupitersatellites.biz
127.0.0.1 www.check.jupitersatellites.biz
127.0.0.1 necessaryupdates.com
127.0.0.1 www.necessaryupdates.com
127.0.0.1 bestworldgirls-for-u.net
127.0.0.1 www.bestworldgirls-for-u.net
127.0.0.1 stejax.pl
127.0.0.1 www.stejax.pl
127.0.0.1 kitehosting.com
127.0.0.1 www.kitehosting.com
127.0.0.1 ware2006.com
127.0.0.1 www.ware2006.com
127.0.0.1 filestore.com
127.0.0.1 www.filestore.com
127.0.0.1 systemupdates.net
127.0.0.1 www.systemupdates.net
127.0.0.1 logs.vapochille.com
127.0.0.1 www.logs.vapochille.com
127.0.0.1 goldenfreehost.com
127.0.0.1 www.goldenfreehost.com
127.0.0.1 todaywarnings.com
127.0.0.1 www.todaywarnings.com
127.0.0.1 spywarequake.com
127.0.0.1 spywarequake.info
127.0.0.1 www.spywarequake.info
127.0.0.1 www.spywarequake.com
127.0.0.1 download2.spywarequake.com
127.0.0.1 download3.spywarequake.com
127.0.0.1 download4.spywarequake.com
127.0.0.1 download5.spywarequake.com
127.0.0.1 download7.spywarequake.com
127.0.0.1 download8.spywarequake.com
127.0.0.1 download9.spywarequake.com
127.0.0.1 download10.spywarequake.com
127.0.0.1 download11.spywarequake.com
127.0.0.1 download12.spywarequake.com
127.0.0.1 download13.spywarequake.com
127.0.0.1 download15.spywarequake.com
127.0.0.1 updates.spywarequake.com
127.0.0.1 urgentsystemupdate.com
127.0.0.1 www.urgentsystemupdate.com
127.0.0.1 dl2.spywarestrike.com
127.0.0.1 dl3.spywarestrike.com
127.0.0.1 dl4.spywarestrike.com
127.0.0.1 dl5.spywarestrike.com
127.0.0.1 dl6.spywarestrike.com
127.0.0.1 dl7.spywarestrike.com
127.0.0.1 dl8.spywarestrike.com
127.0.0.1 nospywaresoft.com
127.0.0.1 spywarestrike.com
127.0.0.1 www.nospywaresoft.com
127.0.0.1 www.spywarestrike.com
127.0.0.1 spyaxesupport.com
127.0.0.1 www.spyaxesupport.com
127.0.0.1 download3.spyaxe.com
127.0.0.1 download4.spyaxe.com
127.0.0.1 download5.spyaxe.com
127.0.0.1 download6.spyaxe.com
127.0.0.1 dl2.spyfalcon.com
127.0.0.1 dl3.spyfalcon.com
127.0.0.1 dl4.spyfalcon.com
127.0.0.1 dl5.spyfalcon.com
127.0.0.1 dl9.spyfalcon.com
127.0.0.1 dl10.spyfalcon.com
127.0.0.1 dl16.spyfalcon.com
127.0.0.1 www.sgrunt.biz
127.0.0.1 traffbest.biz
127.0.0.1 www.traffbest.biz
127.0.0.1 securityfeature.com
127.0.0.1 www.securityfeature.com
127.0.0.1 pimasoft.com
127.0.0.1 www.pimasoft.com
127.0.0.1 blackhawksoftware.com
127.0.0.1 www.blackhawksoftware.com
127.0.0.1 spy-sniper.com
127.0.0.1 www.spy-sniper.com
127.0.0.1 safetydefender.com
127.0.0.1 www.safetydefender.com
127.0.0.1 securitywarnings.net
127.0.0.1 www.securitywarnings.net
127.0.0.1 urgentsystemupdate.biz
127.0.0.1 www.urgentsystemupdate.biz
127.0.0.1 antispylab.com
127.0.0.1 www.antispylab.com
127.0.0.1 spywaresheriff.com
127.0.0.1 www.spywaresheriff.com
127.0.0.1 allmegabucks.com
127.0.0.1 www.allmegabucks.com
127.0.0.1 rizalof.com
127.0.0.1 www.rizalof.com
127.0.0.1 rc.rizalof.com
127.0.0.1 media-codec.com
127.0.0.1 www.media-codec.com
127.0.0.1 SpywareScraper.com
127.0.0.1 www.SpywareScraper.com
127.0.0.1 crystalysmedia.com
127.0.0.1 www.crystalysmedia.com
127.0.0.1 180solutions.com
127.0.0.1 cts.180solutions.com
127.0.0.1 bis.180solutions.com
127.0.0.1 downloads.180solutions.com
127.0.0.1 uploads.180solutions.com
127.0.0.1 installs.180solutions.com
127.0.0.1 config.180solutions.com
127.0.0.1 ping.180solutions.com
127.0.0.1 tv.180solutions.com
127.0.0.1 nowhere.180solutions.com
127.0.0.1 www.180solutions.com
127.0.0.1 180searchassistant.com
127.0.0.1 www.180searchassistant.com
127.0.0.1 theguardservices.com
127.0.0.1 www.theguardservices.com
127.0.0.1 securitybulletin.net
127.0.0.1 www.securitybulletin.net
127.0.0.1 www.supernet.speedserv.com
127.0.0.1 spyonthis.net
127.0.0.1 download.spyonthis.net
127.0.0.1 www.spyonthis.net
127.0.0.1 hijack-this.net
127.0.0.1 www.hijack-this.net
127.0.0.1 errorsafe.com
127.0.0.1 de.errorsafe.com
127.0.0.1 download.errorsafe.com
127.0.0.1 www.errorsafe.com
127.0.0.1 amaena.com
127.0.0.1 trial.updates.winsoftware.com
127.0.0.1 instlog.winfixer.com
127.0.0.1 winfixer2006.com
127.0.0.1 www.winfixer2006.com
127.0.0.1 webtopsecurity.com
127.0.0.1 www.webtopsecurity.com
127.0.0.1 traff5all.biz
127.0.0.1 www.traff5all.biz
127.0.0.1 1-extreme.biz
127.0.0.1 www.1-extreme.biz
127.0.0.1 download.bravesentry.com
127.0.0.1 www.download.bravesentry.com
127.0.0.1 evko.biz
127.0.0.1 www.evko.biz
127.0.0.1 lavasoftupdate.com
127.0.0.1 www.lavasoftupdate.com
127.0.0.1 download.secureyournet.biz
127.0.0.1 www.download.secureyournet.biz
127.0.0.1 secureyournet.biz
127.0.0.1 www.secureyournet.biz
127.0.0.1 windupdates.com
127.0.0.1 asdbiz.biz
127.0.0.1 www.asdbiz.biz
127.0.0.1 spywarelabs.com
127.0.0.1 www.spywarelabs.com
127.0.0.1 traffweb1.biz
127.0.0.1 www.traffweb1.biz
127.0.0.1 newtoolbar.biz
127.0.0.1 www.newtoolbar.biz
127.0.0.1 buytraff.biz
127.0.0.1 www.buytraff.biz
127.0.0.1 safetyuptodate.com
127.0.0.1 www.safetyuptodate.com
127.0.0.1 crazywinnings.com
127.0.0.1 frame.crazywinnings.com
127.0.0.1 www.crazywinnings.com
127.0.0.1 topconverting.com
127.0.0.1 www.topconverting.com
127.0.0.1 casalemedia.com
127.0.0.1 b.casalemedia.com
127.0.0.1 www.casalemedia.com
127.0.0.1 addictivetechnologies.com
127.0.0.1 www.addictivetechnologies.com
127.0.0.1 addictivetechnologies.net
127.0.0.1 www.addictivetechnologies.net
127.0.0.1 admin2cash.biz
127.0.0.1 www.admin2cash.biz
127.0.0.1 advcash.biz
127.0.0.1 www.advcash.biz
127.0.0.1 all4internet.com
127.0.0.1 www.all4internet.com
127.0.0.1 bettersearch.biz
127.0.0.1 www.bettersearch.biz
127.0.0.1 c4tdownload.com
127.0.0.1 www.c4tdownload.com
127.0.0.1 clickspring.net
127.0.0.1 www.clickspring.net
127.0.0.1 contentmatch.net
127.0.0.1 www.contentmatch.net
127.0.0.1 dialer-shop.com
127.0.0.1 www.dialer-shop.com
127.0.0.1 dialoff.com
127.0.0.1 www.dialoff.com
127.0.0.1 energy-factor.com
127.0.0.1 www.energy-factor.com
127.0.0.1 hardcorefantasyland.com
127.0.0.1 www.hardcorefantasyland.com
127.0.0.1 hardfootballbabes.com
127.0.0.1 www.hardfootballbabes.com
127.0.0.1 linkautomatici.com
127.0.0.1 www.linkautomatici.com
127.0.0.1 master69.biz
127.0.0.1 www.master69.biz
127.0.0.1 master70.biz
127.0.0.1 www.master70.biz
127.0.0.1 master71.biz
127.0.0.1 www.master71.biz
127.0.0.1 mcdial.biz
127.0.0.1 www.mcdial.biz
127.0.0.1 mt-download.com
127.0.0.1 www.mt-download.com
127.0.0.1 my-teensex.com
127.0.0.1 overpro.com
127.0.0.1 private-dialer.biz
127.0.0.1 private-iframe.biz
127.0.0.1 redfunny.com
127.0.0.1 scoobidoo.com
127.0.0.1 skoobidoo.com
127.0.0.1 sexvideopro.com
127.0.0.1 storage-tasp.com
127.0.0.1 xbeta69.com
127.0.0.1 securityuptodate.net
127.0.0.1 www.securityuptodate.net
127.0.0.1 troonety.biz
127.0.0.1 www.troonety.biz
127.0.0.1 zurrusco.com
127.0.0.1 www.zurrusco.com
127.0.0.1 breenten.biz
127.0.0.1 www.breenten.biz
127.0.0.1 votreenton.biz
127.0.0.1 www.votreenton.biz
127.0.0.1 ozonung.biz
127.0.0.1 www.ozonung.biz
127.0.0.1 digikeygen.com
127.0.0.1 www.digikeygen.com
127.0.0.1 5starvideos.com
127.0.0.1 www.5starvideos.com
127.0.0.1 moviereality.com
127.0.0.1 www.moviereality.com
127.0.0.1 perfectedsecurity.com
127.0.0.1 www.perfectedsecurity.com
127.0.0.1 securityprecaution.net
127.0.0.1 www.securityprecaution.net
127.0.0.1 securityupdatesite.com
127.0.0.1 www.securityupdatesite.com
127.0.0.1 dns-look-up.com
127.0.0.1 www.dns-look-up.com
127.0.0.1 ayb.dns-look-up.com
127.0.0.1 search200.com
127.0.0.1 www.search200.com
127.0.0.1 404dns.com
127.0.0.1 www.404dns.com
127.0.0.1 mcboo.com
127.0.0.1 dr.mcboo.com
127.0.0.1 www.mcboo.com
127.0.0.1 appealcircuit.com
127.0.0.1 www.appealcircuit.com
127.0.0.1 balotierra.com
127.0.0.1 www.balotierra.com
127.0.0.1 oldflock.com
127.0.0.1 www.oldflock.com
127.0.0.1 pornmagpass.com
127.0.0.1 www.pornmagpass.com
127.0.0.1 dailypornmag.com
127.0.0.1 www.dailypornmag.com
127.0.0.1 babespornmag.com
127.0.0.1 www.babespornmag.com
127.0.0.1 teenspornmag.com
127.0.0.1 www.teenspornmag.com
127.0.0.1 maturespornmag.com
127.0.0.1 www.maturespornmag.com
127.0.0.1 hardcorepornmag.com
127.0.0.1 www.hardcorepornmag.com
127.0.0.1 gayspornmag.com
127.0.0.1 www.gayspornmag.com
127.0.0.1 topsecuritysite.net
127.0.0.1 www.topsecuritysite.net
127.0.0.1 bestsafetyguide.net
127.0.0.1 www.bestsafetyguide.net
127.0.0.1 searchweb2.com
127.0.0.1 www.searchweb2.com
127.0.0.1 www.lop.com
127.0.0.1 vidscodec.com
127.0.0.1 www.vidscodec.com
127.0.0.1 newvidscodec.net
127.0.0.1 www.newvidscodec.net
127.0.0.1 media-codec.net
127.0.0.1 www.media-codec.net
127.0.0.1 mediacodec.net
127.0.0.1 www.mediacodec.net
127.0.0.1 imediacodec.com
127.0.0.1 www.imediacodec.com
127.0.0.1 emcodec.com
127.0.0.1 www.emcodec.com
127.0.0.1 vicodec.com
127.0.0.1 www.vicodec.com
127.0.0.1 xpasswordmanager.com
127.0.0.1 www.xpasswordmanager.com
127.0.0.1 cracks4all.com
127.0.0.1 www.cracks4all.com
127.0.0.1 media-motor.net
127.0.0.1 mmm.media-motor.net
127.0.0.1 bins.media-motor.net
127.0.0.1 bins2.media-motor.net
127.0.0.1 logs.media-motor.net
127.0.0.1 mmohsix.com
127.0.0.1 www.mmohsix.com
127.0.0.1 pops.mmohsix.com
127.0.0.1 megalocast.net
127.0.0.1 js.megalocast.net
127.0.0.1 www.megalocast.net
127.0.0.1 dl.web-nexus.net
127.0.0.1 movies-etc.com
127.0.0.1 cdn.movies-etc.com
127.0.0.1 cdn2.movies-etc.com
127.0.0.1 internet-optimizer.com
127.0.0.1 www.internet-optimizer.com
127.0.0.1 888.com
127.0.0.1 www.888.com
127.0.0.1 images.888.com
127.0.0.1 surfsidekick.com
127.0.0.1 www.surfsidekick.com
127.0.0.1 sdl.surfsidekick.com
127.0.0.1 kmpads.com
127.0.0.1 www.kmpads.com
127.0.0.1 ads.kmpads.com
127.0.0.1 zipcodec.com
127.0.0.1 www.zipcodec.com
127.0.0.1 ibankis.org
127.0.0.1 www.ibankis.org
127.0.0.1 adwarefinder.com
127.0.0.1 www.adwarefinder.com
127.0.0.1 nbcsearch.com
127.0.0.1 www.nbcsearch.com
127.0.0.1 TBCODE.COM
127.0.0.1 www.TBCODE.COM
127.0.0.1 1987324.com
127.0.0.1 www.1987324.com
127.0.0.1 www.archiviosex.net
127.0.0.1 sysnetsecurity.com
127.0.0.1 www.sysnetsecurity.com
127.0.0.1 sysnetsecurity.net
127.0.0.1 www.sysnetsecurity.net
127.0.0.1 error404site.com
127.0.0.1 www.error404site.com
127.0.0.1 error404site.net
127.0.0.1 www.error404site.net
127.0.0.1 wm.vother.info
127.0.0.1 www.wm.vother.info
127.0.0.1 vother.info
127.0.0.1 www.vother.info
127.0.0.1 wm.komforochka.info
127.0.0.1 www.wm.komforochka.info
127.0.0.1 komforochka.info
127.0.0.1 www.komforochka.info
127.0.0.1 hervam.com
127.0.0.1 www.hervam.com
127.0.0.1 www.nunah.info
127.0.0.1 nunah.info
127.0.0.1 www.searchmeup.com
127.0.0.1 www.searchcolours.com
127.0.0.1 searchcolours.com
127.0.0.1 brodbfm.net
127.0.0.1 www.brodbfm.net
127.0.0.1 easybestdeals.com
127.0.0.1 www.easybestdeals.com
127.0.0.1 spywareno.com
127.0.0.1 www.spywareno.com
127.0.0.1 spyheal.com
127.0.0.1 www.spyheal.com
127.0.0.1 www.streamxs.ws
127.0.0.1 streamxs.ws
127.0.0.1 asta-killer.com
127.0.0.1 newmediaidea.com
127.0.0.1 www.newmediaidea.com
127.0.0.1 syssecuritysite.net
127.0.0.1 www.syssecuritysite.net
127.0.0.1 aulde.net
127.0.0.1 www.aulde.net
127.0.0.1 searchdrive.info
127.0.0.1 wwwsearchdrive.info
127.0.0.1 download.bardownload.com
127.0.0.1 www.download.bardownload.com
127.0.0.1 bardownload.com
127.0.0.1 www.bardownload.com
127.0.0.1 intcodec.com
127.0.0.1 www.intcodec.com
127.0.0.1 newupdates.lzio.com
127.0.0.1 uptofind.com
127.0.0.1 www.uptofind.com
127.0.0.1 homelandnetwork.COM
127.0.0.1 www.homelandnetwork.COM
127.0.0.1 getmirar.com
127.0.0.1 mirarsearch.com
127.0.0.1 net-nucleus.com
127.0.0.1 zenotecnico.com
127.0.0.1 www.zenotecnico.com
127.0.0.1 zenotecnico2.com
127.0.0.1 www.zenotecnico2.com
127.0.0.1 surfaccuracy.com
127.0.0.1 www.surfaccuracy.com
127.0.0.1 cache.surfaccuracy.com
127.0.0.1 www.cache.surfaccuracy.com
127.0.0.1 www.the.007guard.com
127.0.0.1 the.007guard.com
127.0.0.1 install.007guard.com
127.0.0.1 www.install.007guard.com
127.0.0.1 007guard.com
127.0.0.1 www.007guard.com
127.0.0.1 feeds.2search.com
127.0.0.1 www.feeds.2search.com
127.0.0.1 2search.com
127.0.0.1 www.2search.com
127.0.0.1 feeds2.2search.org
127.0.0.1 www.feeds2.2search.org
127.0.0.1 2search.org
127.0.0.1 www.2search.org
127.0.0.1 zangocash.com
127.0.0.1 www.zangocash.com
127.0.0.1 static.zangocash.com
127.0.0.1 www.static.zangocash.com
127.0.0.1 public.zangocash.com
127.0.0.1 www.public.zangocash.com
127.0.0.1 code.ignphrases.com
127.0.0.1 www.ignphrases.com
127.0.0.1 ignphrases.com
127.0.0.1 www.igetnet.com
127.0.0.1 igetnet.com
127.0.0.1 www.topbrowsing.com
127.0.0.1 topbrowsing.com
127.0.0.1 www.download.jupitersatellites.biz
127.0.0.1 download.jupitersatellites.biz
127.0.0.1 voghp.com
127.0.0.1 www.voghp.com
127.0.0.1 zhmbscwdgk.biz
127.0.0.1 www.zhmbscwdgk.biz
127.0.0.1 zabywjwzlr.biz.biz
127.0.0.1 www.zabywjwzlr.biz.biz
127.0.0.1 i-femdom.com
127.0.0.1 www.i-femdom.com
127.0.0.1 buy-find.info
127.0.0.1 www.buy-find.info
127.0.0.1 searche.info
127.0.0.1 www.searche.info
127.0.0.1 easy-pharmacy.info
127.0.0.1 www.easy-pharmacy.info
127.0.0.1 good-casino.net
127.0.0.1 www.good-casino.net
127.0.0.1 busysearch.net
127.0.0.1 www.busysearch.net
127.0.0.1 1001-search.info
127.0.0.1 www.1001-search.info
127.0.0.1 24-7pharmacy.info
127.0.0.1 www.24-7pharmacy.info
127.0.0.1 dating-galaxy.info
127.0.0.1 www.dating-galaxy.info
127.0.0.1 spyware-best.com
127.0.0.1 www.spyware-best.com
127.0.0.1 easyspyware.com
127.0.0.1 www.easyspyware.com
127.0.0.1 best-spyware.info
127.0.0.1 www.best-spyware.info
127.0.0.1 anyofus.com
127.0.0.1 www.anyofus.com
127.0.0.1 specialoems.com
127.0.0.1 www.specialoems.com
127.0.0.1 svideocodec.com
127.0.0.1 www.svideocodec.com
127.0.0.1 getpornmag.com
127.0.0.1 www.getpornmag.com
127.0.0.1 animepornmag.com
127.0.0.1 www.animepornmag.com
127.0.0.1 syssecuritypage.com
127.0.0.1 www.syssecuritypage.com
127.0.0.1 safetyhomepage.com
127.0.0.1 www.safetyhomepage.com
127.0.0.1 CashUnlim.com
127.0.0.1 www.CashUnlim.com
127.0.0.1 bdsmpornmag.com
127.0.0.1 www.bdsmpornmag.com
127.0.0.1 ebonypornmag.com
127.0.0.1 www.ebonypornmag.com
127.0.0.1 nylonporn.com
127.0.0.1 www.nylonporn.com
127.0.0.1 uniformpornmag.com
127.0.0.1 www.uniformpornmag.com
127.0.0.1 maturepornmag.com
127.0.0.1 www.maturepornmag.com
127.0.0.1 pornstarspornmag.com
127.0.0.1 www.pornstarspornmag.com
127.0.0.1 shemalepornmag.com
127.0.0.1 www.shemalepornmag.com
127.0.0.1 lesbianpornmag.com
127.0.0.1 www.lesbianpornmag.com
127.0.0.1 dailytoolbar.com
127.0.0.1 www.dailytoolbar.com
127.0.0.1 maturetoolbar.com
127.0.0.1 www.maturetoolbar.com
127.0.0.1 asiantoolbar.com
127.0.0.1 www.asiantoolbar.com
127.0.0.1 www.ac66.cn
127.0.0.1 ac66.cn
127.0.0.1 mir.100888290cs.com
127.0.0.1 woool.100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 100888290cs.com
127.0.0.1 ert0003.e76.163ns.com
127.0.0.1 www.163ns.com
127.0.0.1 163ns.com
127.0.0.1 www.chenshijituan.com
127.0.0.1 chenshijituan.com
127.0.0.1 www.u7u.cn
127.0.0.1 u7u.cn
127.0.0.1 www.wg581.com
127.0.0.1 wg581.com
127.0.0.1 jhzjyj.bigwww.com
127.0.0.1 www.bigwww.com
127.0.0.1 bigwww.com
127.0.0.1 www.132.com
127.0.0.1 132.com
127.0.0.1 www.tzxsj.com
127.0.0.1 tzxsj.com
127.0.0.1 www.q36.cn
127.0.0.1 q36.cn
127.0.0.1 down.136136.net
127.0.0.1 www.136136.net
127.0.0.1 136136.net
127.0.0.1 s59.cnzz.com
127.0.0.1 www.cnzz.com
127.0.0.1 cnzz.com
127.0.0.1 ulink13.dudu.com
127.0.0.1 ulink7.dudu.com
127.0.0.1 www.dudu.com
127.0.0.1 dudu.com
127.0.0.1 dcdl.dmcast.com
127.0.0.1 www.dmcast.com
127.0.0.1 dcww.dmcast.com
127.0.0.1 ibm.dmcast.com
127.0.0.1 dmcast.com
127.0.0.1 worldtostart.com
127.0.0.1 www.worldtostart.com
127.0.0.1 deskbar.worldtostart.com
127.0.0.1 www.deskbar.worldtostart.com
127.0.0.1 www.dotcomtoolbar.com
127.0.0.1 dotcomtoolbar.com
127.0.0.1 search.findthewebsiteyouneed.com
127.0.0.1 www.search.findthewebsiteyouneed.com
127.0.0.1 easywww.info
127.0.0.1 www.easywww.info
127.0.0.1 f1organizer.com
127.0.0.1 www.f1organizer.com
127.0.0.1 gamehouse.com
127.0.0.1 www.gamehouse.com
127.0.0.1 totalvelocity.com
127.0.0.1 www.totalvelocity.com
127.0.0.1 webnetinfo.net
127.0.0.1 www.webnetinfo.net
127.0.0.1 srfgate.com
127.0.0.1 www.srfgate.com
127.0.0.1 infport.com
127.0.0.1 www.infport.com
127.0.0.1 instafinder.com
127.0.0.1 www.instafinder.com
127.0.0.1 megasearchbar.com
127.0.0.1 www.megasearchbar.com
127.0.0.1 ccecaedbebfcaf.com
127.0.0.1 www.ccecaedbebfcaf.com
127.0.0.1 pcodec.com
127.0.0.1 www.pcodec.com
127.0.0.1 lightspeedsearch.net
127.0.0.1 www.lightspeedsearch.net
127.0.0.1 websopot.com
127.0.0.1 www.websopot.com
127.0.0.1 superbgirlz.com
127.0.0.1 asdeykuddq.com
127.0.0.1 asidseiupc.com
127.0.0.1 fjsynebcod.com
127.0.0.1 qiudheadsd.com
127.0.0.1 www.superbgirlz.com
127.0.0.1 www.asdeykuddq.com
127.0.0.1 www.asidseiupc.com
127.0.0.1 www.fjsynebcod.com
127.0.0.1 www.qiudheadsd.com
127.0.0.1 www.trackhits.cc
127.0.0.1 resultplacement.com
127.0.0.1 www.resultplacement.com
127.0.0.1 smartprotect.info
127.0.0.1 www.smartprotect.info
127.0.0.1 best-voyeur.info
127.0.0.1 www.best-voyeur.info
127.0.0.1 Search-Daily.com
127.0.0.1 www.Search-Daily.com
127.0.0.1 yahabags.com
127.0.0.1 www.yahabags.com
127.0.0.1 www.freecat.biz
127.0.0.1 freecat.biz
127.0.0.1 www.beebappyy.biz
127.0.0.1 beebappyy.biz
127.0.0.1 costrike.com
127.0.0.1 www.costrike.com
127.0.0.1 tgpie.com
127.0.0.1 www.tgpie.com
127.0.0.1 searcher.tgpie.com
127.0.0.1 www.searcher.tgpie.com
127.0.0.1 seproger.com
127.0.0.1 www.seproger.com
127.0.0.1 anysn.seproger.com
127.0.0.1 www.anysn.seproger.com
127.0.0.1 thereall.realfet.com
127.0.0.1 www.thereall.realfet.com
127.0.0.1 greatbahamas.com
127.0.0.1 www.greatbahamas.com
127.0.0.1 fn777.greatbahamas.com
127.0.0.1 www.fn777.greatbahamas.com
127.0.0.1 sef516.greatbahamas.com
127.0.0.1 www.sef516.greatbahamas.com
127.0.0.1 rich777.greatbahamas.com
127.0.0.1 www.rich777.greatbahamas.com
127.0.0.1 rng650.greatbahamas.com
127.0.0.1 www.rng650.greatbahamas.com
127.0.0.1 realm.superbahamas.com
127.0.0.1 www.realm.superbahamas.com
127.0.0.1 enhance.com
127.0.0.1 www.enhance.com
127.0.0.1 c.enhance.com
127.0.0.1 www.c.enhance.com
127.0.0.1 adservices1.enhance.com
127.0.0.1 www.adservices1.enhance.com
127.0.0.1 traffic-ssl1.com
127.0.0.1 www.traffic-ssl1.com
127.0.0.1 traffic-acc.com
127.0.0.1 www.traffic-acc.com
127.0.0.1 filetretporn.com
127.0.0.1 www.filetretporn.com
127.0.0.1 uncj.filetretporn.com
127.0.0.1 www.uncj.filetretporn.com
127.0.0.1 rzvonporn.com
127.0.0.1 www.rzvonporn.com
127.0.0.1 theaimonline.com
127.0.0.1 www.theaimonline.com
127.0.0.1 bm.theaimonline.com
127.0.0.1 www.bm.theaimonline.com
127.0.0.1 kqzyfj.com
127.0.0.1 www.kqzyfj.com
127.0.0.1 apmebf.com
127.0.0.1 www.apmebf.com
127.0.0.1 emjcd.com
127.0.0.1 www.emjcd.com
127.0.0.1 upspiral.com
127.0.0.1 www.upspiral.com
127.0.0.1 lovezest.com
127.0.0.1 www.lovezest.com
127.0.0.1 maxysize.com
127.0.0.1 www.maxysize.com
127.0.0.1 camouflageclothingonline.net
127.0.0.1 www.camouflageclothingonline.net
127.0.0.1 getfound.com
127.0.0.1 www.getfound.com
127.0.0.1 search.getfound.com
127.0.0.1 www.search.getfound.com
127.0.0.1 searchfeed.com
127.0.0.1 www.searchfeed.com
127.0.0.1 netster.com
127.0.0.1 www.netster.com
127.0.0.1 ireit.com
127.0.0.1 www.ireit.com
127.0.0.1 content.ireit.com
127.0.0.1 www.content.ireit.com
127.0.0.1 toseeka.com
127.0.0.1 www.toseeka.com
127.0.0.1 zcodec.com
127.0.0.1 www.zcodec.com
127.0.0.1 strcodec.com
127.0.0.1 www.strcodec.com
127.0.0.1 uglyphotos.net
127.0.0.1 www.uglyphotos.net
127.0.0.1 imcodec.com
127.0.0.1 www.imcodec.com
127.0.0.1 softcodec.com
127.0.0.1 www.softcodec.com
127.0.0.1 dvdcodec.net
127.0.0.1 www.dvdcodec.net
127.0.0.1 playercodec.net
127.0.0.1 www.playercodec.net
127.0.0.1 lightcodec.com
127.0.0.1 www.lightcodec.com
127.0.0.1 winmediacodec.com
127.0.0.1 www.winmediacodec.com
127.0.0.1 videoscodec.com
127.0.0.1 www.videoscodec.com
127.0.0.1 mmcodec.com
127.0.0.1 www.mmcodec.com
127.0.0.1 xpassgenerator.com
127.0.0.1 www.xpassgenerator.com
127.0.0.1 mypornmagpass.com
127.0.0.1 www.mypornmagpass.com
127.0.0.1 searchbee.net
127.0.0.1 www.searchbee.net
127.0.0.1 warez.com
127.0.0.1 www.warez.com
127.0.0.1 srv.warez.com
127.0.0.1 prosearching.com
127.0.0.1 www.prosearching.com
127.0.0.1 zelaznyworld.com
127.0.0.1 www.zelaznyworld.com
127.0.0.1 mabou.org
127.0.0.1 net.mabou.org
127.0.0.1 www.mabou.org
127.0.0.1 infectedkernel.com
127.0.0.1 www.infectedkernel.com
127.0.0.1 qippi.com
127.0.0.1 www.qippi.com
127.0.0.1 ad.yieldmanager.com
127.0.0.1 www.ad.yieldmanager.com
127.0.0.1 ad.marketingsector.com
127.0.0.1 www.ad.marketingsector.com
127.0.0.1 adnet-plus.com
127.0.0.1 wwww.adnet-plus.com
127.0.0.1 firstgoodsearch.com
127.0.0.1 www.firstgoodsearch.com
127.0.0.1 myfuncards.smileycentral.com
127.0.0.1 www.myfuncards.smileycentral.com
127.0.0.1 powercodec.com
127.0.0.1 www.powercodec.com
127.0.0.1 truecodec.com
127.0.0.1 www.truecodec.com
127.0.0.1 keycodec.com
127.0.0.1 www.keycodec.com
127.0.0.1 msupdate.net
127.0.0.1 www.msupdate.net
127.0.0.1 redirect.msupdate.net
127.0.0.1 yoogee.com
127.0.0.1 www.yoogee.com
127.0.0.1 razespyware.net
127.0.0.1 www.razespyware.net
127.0.0.1 entertainsite.net
127.0.0.1 www.entertainsite.net
127.0.0.1 allstarsvideos.net
127.0.0.1 www.allstarsvideos.net
127.0.0.1 rbnnetwork.com
127.0.0.1 www.rbnnetwork.com
127.0.0.1 think-adz.com
127.0.0.1 www.think-adz.com
127.0.0.1 think-adz2.com
127.0.0.1 www.think-adz2.com
127.0.0.1 www.safeiepage.com
127.0.0.1 safeiepage.com
127.0.0.1 yootube.info
127.0.0.1 Sexxpassport.com
127.0.0.1 www.Sexxpassport.com
127.0.0.1 Antispyweb.net
127.0.0.1 www.Antispyweb.net
127.0.0.1 www.bigtrafficnetwork.com
127.0.0.1 www3.bigtrafficnetwork.com
127.0.0.1 bigtrafficnetwork.com
127.0.0.1 trafficgeneration.biz
127.0.0.1 www.trafficgeneration.biz
127.0.0.1 www.toolbar5.trafficgeneration.biz
127.0.0.1 www.toolbar3.trafficgeneration.biz
127.0.0.1 zippy-lookup.com
127.0.0.1 www.zippy-lookup.com
127.0.0.1 here4search.biz
127.0.0.1 www.here4search.biz
127.0.0.1 popcorn.net
127.0.0.1 www.popcorn.net
127.0.0.1 eupdatepage.com
127.0.0.1 www.eupdatepage.com
127.0.0.1 errorsdns.com
127.0.0.1 www.errorsdns.com
127.0.0.1 esafetypage.com
127.0.0.1 www.esafetypage.com
127.0.0.1 eprotectpage.com
127.0.0.1 www.eprotectpage.com
127.0.0.1 esecuritypage.com
127.0.0.1 www.esecuritypage.com
127.0.0.1 iednserror.com
127.0.0.1 www.iednserror.com
127.0.0.1 idnserror.com
127.0.0.1 www.idnserror.com
127.0.0.1 iesecurepage.com
127.0.0.1 www.iesecurepage.com
127.0.0.1 dvdaccess.net
127.0.0.1 www.dvdaccess.net
127.0.0.1 qualitycodec.com
127.0.0.1 www.qualitycodec.com
127.0.0.1 elitecodec.com
127.0.0.1 www.elitecodec.com
127.0.0.1 vidcodecs.com
127.0.0.1 www.vidcodecs.com
127.0.0.1 supercodec.com
127.0.0.1 www.supercodec.com
127.0.0.1 perfectcodec.com
127.0.0.1 www.perfectcodec.com
127.0.0.1 searchfindsearch.com
127.0.0.1 www.searchfindsearch.com
127.0.0.1 site.accessorygeeks.com
127.0.0.1 www.site.accessorygeeks.com
127.0.0.1 accessorygeeks.com
127.0.0.1 www.accessorygeeks.com
127.0.0.1 ivideocodec.com
127.0.0.1 www.ivideocodec.com
127.0.0.1 medcodec.com
127.0.0.1 www.medcodec.com
127.0.0.1 absolutee.com
127.0.0.1 www.absolutee.com
127.0.0.1 pornohome.net
127.0.0.1 www.pornohome.net
127.0.0.1 tvcodec.com
127.0.0.1 www.tvcodec.com
127.0.0.1 moviecodec.net
127.0.0.1 www.moviecodec.net
127.0.0.1 silvercodec.com
127.0.0.1 www.silvercodec.com
127.0.0.1 goldcodec.com
127.0.0.1 www.goldcodec.com
127.0.0.1 clusif.free.fr
127.0.0.1 outerinfo.com
127.0.0.1 www.outerinfo.com
127.0.0.1 elitemediagroup.net
127.0.0.1 mmm.elitemediagroup.net
127.0.0.1 www.elitemediagroup.net
127.0.0.1 snipernet.biz
127.0.0.1 www.snipernet.biz
127.0.0.1 sxload.com
127.0.0.1 www.sxload.com
127.0.0.1 adgate.info
127.0.0.1 www.adgate.info
127.0.0.1 www.ishowbao.com
127.0.0.1 ishowbao.com
127.0.0.1 sd.ncast.cn
127.0.0.1 www.sd.ncast.cn
127.0.0.1 sh.ncast.cn
127.0.0.1 www.sh.ncast.cn
127.0.0.1 ncast.cn
127.0.0.1 www.ncast.cn
127.0.0.1 videosaccess.net
127.0.0.1 www.videosaccess.net
127.0.0.1 yourieprotect.com
127.0.0.1 www.yourieprotect.com
127.0.0.1 youriesafety.com
127.0.0.1 www.youriesafety.com
127.0.0.1 securetoolbars.com
127.0.0.1 www.securetoolbars.com
127.0.0.1 www.amaena.com
127.0.0.1 go.winantivirus.com
127.0.0.1 download.systemdoctor.com
127.0.0.1 ulog.systemdoctor.com
127.0.0.1 www.systemdoctor.com
127.0.0.1 go.systemdoctor.com
127.0.0.1 systemdoctor.com
127.0.0.1 www.adsextend.net
127.0.0.1 adsextend.net
127.0.0.1 ad.mokead.com
127.0.0.1 www.ad.mokead.com
127.0.0.1 mokead.com
127.0.0.1 www.mokead.com
127.0.0.1 virusburst.com
127.0.0.1 www.virusburst.com
127.0.0.1 aviewersoft.com
127.0.0.1 www.aviewersoft.com
127.0.0.1 braincodec.com
127.0.0.1 www.braincodec.com
127.0.0.1 www.asianpornmag.com
127.0.0.1 www.ebony-pornmag.com
127.0.0.1 www.lesbianspornmag.com
127.0.0.1 www.nylonpornmag.com
127.0.0.1 www.shemalespornmag.com
127.0.0.1 vaxobject.com
127.0.0.1 www.vaxobject.com
127.0.0.1 mediaobjectsource.com
127.0.0.1 www.mediaobjectsource.com
127.0.0.1 amediasoftware.com
127.0.0.1 www.amediasoftware.com
127.0.0.1 activexsoftwares.com
127.0.0.1 www.activexsoftwares.com
127.0.0.1 activexmediaobject.com
127.0.0.1 www.activexmediaobject.com
127.0.0.1 mediaactivex.com
127.0.0.1 www.mediaactivex.com
127.0.0.1 wzdq.cn
127.0.0.1 www.wzdq.cn
127.0.0.1 deja-rue.com
127.0.0.1 www.deja-rue.com
127.0.0.1 spywarebot.com
127.0.0.1 www.spywarebot.com
127.0.0.1 revolt-search.com
127.0.0.1 www.revolt-search.com
127.0.0.1 MUAFK.COM
127.0.0.1 www.MUAFK.COM
127.0.0.1 offers.ukiee.com
127.0.0.1 www.ukiee.com
127.0.0.1 ukiee.com
127.0.0.1 lzio.com
127.0.0.1 www.lzio.com
127.0.0.1 lavl-vicky.com
127.0.0.1 www.lavl-vicky.com
127.0.0.1 checkssecurity.com
127.0.0.1 www.checkssecurity.com
127.0.0.1 cleansoftwares.com
127.0.0.1 www.cleansoftwares.com
127.0.0.1 atruesecurity.com
127.0.0.1 www.atruesecurity.com
127.0.0.1 atotalsafety.com
127.0.0.1 www.atotalsafety.com
127.0.0.1 allprotections.com
127.0.0.1 www.allprotections.com
127.0.0.1 multimediaobject.com
127.0.0.1 www.multimediaobject.com
127.0.0.1 iesafetywarning.com
127.0.0.1 www.iesafetywarning.com
127.0.0.1 uptodateprotect.com
127.0.0.1 www.uptodateprotect.com
127.0.0.1 alldnserrors.com
127.0.0.1 www.alldnserrors.com
127.0.0.1 allsecuritysite.com
127.0.0.1 www.allsecuritysite.com
127.0.0.1 curedc.info
127.0.0.1 www.curedc.info
127.0.0.1 catch-dc.info
127.0.0.1 www.catch-dc.info
127.0.0.1 nicemoviejokes.com
127.0.0.1 www.nicemoviejokes.com
127.0.0.1 goodmovielaugh.com
127.0.0.1 www.goodmovielaugh.com
127.0.0.1 good-movie-play.com
127.0.0.1 nice-movie-jokes.com
127.0.0.1 br.errorsafe.com
127.0.0.1 br.winantivirus.com
127.0.0.1 br.winfixer.com
127.0.0.1 www.winfixer.com
127.0.0.1 download.cdn.winsoftware.com
127.0.0.1 download.winantispyware.com
127.0.0.1 download.winfixer.com
127.0.0.1 es.winantivirus.com
127.0.0.1 fr.winantivirus.com
127.0.0.1 fr.winfixer.com
127.0.0.1 go.errorsafe.com
127.0.0.1 go.winantispyware.com
127.0.0.1 hk.winantivirus.com
127.0.0.1 instlog.errorsafe.com
127.0.0.1 instlog.winantivirus.com
127.0.0.1 kb.errorsafe.com
127.0.0.1 kb.winantivirus.com
127.0.0.1 nl.errorsafe.com
127.0.0.1 se.errorsafe.com
127.0.0.1 secure.errorsafe.com
127.0.0.1 secure.winantivirus.com
127.0.0.1 support.winantivirus.com
127.0.0.1 ulog.winantivirus.com
127.0.0.1 utils.errorsafe.com
127.0.0.1 utils.winantivirus.com
127.0.0.1 winantispy.com
127.0.0.1 www.winantispy.com
127.0.0.1 secure.winantispy.com
127.0.0.1 download.windrivecleaner.com
127.0.0.1 www.windrivecleaner.com
127.0.0.1 windrivecleaner.com
127.0.0.1 errorprotector.com
127.0.0.1 www.errorprotector.com
127.0.0.1 www.win-anti-virus-pro.com
127.0.0.1 win-anti-virus-pro.com
127.0.0.1 www.win-virus-pro.com
127.0.0.1 win-virus-pro.com
127.0.0.1 www.winantiviruspro.com
127.0.0.1 winantiviruspro.com
127.0.0.1 malwarewiped.com
127.0.0.1 www.malwarewiped.com
127.0.0.1 zxlinks.com
127.0.0.1 www.zxlinks.com
127.0.0.1 wanfuchina.com
127.0.0.1 www.wanfuchina.com
127.0.0.1 generateskey.com
127.0.0.1 www.generateskey.com
127.0.0.1 accessvid.net
127.0.0.1 www.accessvid.net
127.0.0.1 mediaobjectsite.com
127.0.0.1 www.mediaobjectsite.com
127.0.0.1 activexsource.com
127.0.0.1 www.activexsource.com
127.0.0.1 mediaobjectguide.com
127.0.0.1 www.mediaobjectguide.com
127.0.0.1 tscodec.com
127.0.0.1 www.tscodec.com
127.0.0.1 vidaccess.net
127.0.0.1 www.vidaccess.net
127.0.0.1 vaxcodec.com
127.0.0.1 www.vaxcodec.com
127.0.0.1 alltruesoftware.com
127.0.0.1 www.alltruesoftware.com
127.0.0.1 siteentrances.com
127.0.0.1 www.siteentrances.com
127.0.0.1 vids-access.com
127.0.0.1 www.vids-access.com
127.0.0.1 sites-entrance.net
127.0.0.1 www.sites-entrance.net
127.0.0.1 sites-entrance.com
127.0.0.1 www.sites-entrance.com
127.0.0.1 playcodecs.com
127.0.0.1 www.playcodecs.com
127.0.0.1 sitesentrance.com
127.0.0.1 www.sitesentrance.com
127.0.0.1 playerscodec.com
127.0.0.1 www.playerscodec.com
127.0.0.1 site-entrance.net
127.0.0.1 www.site-entrance.net
127.0.0.1 web.links4all.biz
127.0.0.1 otherchance.com
127.0.0.1 www.otherchance.com
127.0.0.1 secureserver3.com
127.0.0.1 www.secureserver3.com
127.0.0.1 simpaticissimo.com
127.0.0.1 www.simpaticissimo.com
127.0.0.1 reserved-company.info
127.0.0.1 www.reserved-company.info
127.0.0.1 vcodec2007.com
127.0.0.1 www.vcodec2007.com
127.0.0.1 spyboot.com
127.0.0.1 adultan.com
127.0.0.1 www.adultan.com
127.0.0.1 adultfilmsite.com
127.0.0.1 www.adultfilmsite.com
127.0.0.1 adultmovieplus.com
127.0.0.1 www.adultmovieplus.com
127.0.0.1 adultsper.com
127.0.0.1 www.adultsper.com
127.0.0.1 clubxxxvideo.com
127.0.0.1 www.clubxxxvideo.com
127.0.0.1 cutadult.com
127.0.0.1 www.cutadult.com
127.0.0.1 galleryclick.net
127.0.0.1 www.galleryclick.net
127.0.0.1 gallerypictures.net
127.0.0.1 www.gallerypictures.net
127.0.0.1 greatadultvideo.com
127.0.0.1 www.greatadultvideo.com
127.0.0.1 hardcorevideosite.com
127.0.0.1 www.hardcorevideosite.com
127.0.0.1 loweradult.com
127.0.0.1 www.loweradult.com
127.0.0.1 mega-adult.com
127.0.0.1 www.mega-adult.com
127.0.0.1 siteticket.net
127.0.0.1 www.siteticket.net
127.0.0.1 sureadult.com
127.0.0.1 www.sureadult.com
127.0.0.1 xxxallvideo.com
127.0.0.1 www.xxxallvideo.com
127.0.0.1 xxxmovietour.com
127.0.0.1 www.xxxmovietour.com
127.0.0.1 xxxteenfilm.com
127.0.0.1 www.xxxteenfilm.com
127.0.0.1 xxxzonevideo.com
127.0.0.1 www.xxxzonevideo.com
127.0.0.1 superadultfriend.com
127.0.0.1 www.superadultfriend.com
127.0.0.1 superporncity.com
127.0.0.1 www.superporncity.com
127.0.0.1 theadulteye.com
127.0.0.1 www.theadulteye.com
127.0.0.1 adultzoneworld.com
127.0.0.1 www.adultzoneworld.com
127.0.0.1 pornissex.com
127.0.0.1 www.pornissex.com
127.0.0.1 pornxxxfilm.com
127.0.0.1 www.pornxxxfilm.com
127.0.0.1 worldbestadult.com
127.0.0.1 www.worldbestadult.com
127.0.0.1 securityplugins.com
127.0.0.1 www.securityplugins.com
127.0.0.1 virusrescue.com
127.0.0.1 www.virusrescue.com
127.0.0.1 adprotect.com
127.0.0.1 www.adprotect.com
127.0.0.1 antivirusgolden.com
127.0.0.1 www.antivirusgolden.com
127.0.0.1 spysoldier.com
127.0.0.1 www.spysoldier.com
127.0.0.1 onlinesecuritynet.com
127.0.0.1 www.onlinesecuritynet.com
127.0.0.1 spywareknight.com
127.0.0.1 www.spywareknight.com
127.0.0.1 moviecodecs.net
127.0.0.1 www.moviecodecs.net
127.0.0.1 esafetylist.com
127.0.0.1 www.esafetylist.com
127.0.0.1 sverner.info
127.0.0.1 www.sverner.info
127.0.0.1 fastssearch.com
127.0.0.1 www.fastssearch.com
127.0.0.1 drivecleanr.com
127.0.0.1 www.drivecleanr.com
127.0.0.1 access-dvd.com
127.0.0.1 www.access-dvd.com
127.0.0.1 spybot-2007.com
127.0.0.1 www.spybot-2007.com
127.0.0.1 get-spybot.com
127.0.0.1 www.get-spybot.com
127.0.0.1 curepcsolutions.com
127.0.0.1 www.curepcsolutions.com
127.0.0.1 pcflashsoft.com
127.0.0.1 www.pcflashsoft.com
127.0.0.1 spylog.com
127.0.0.1 www.spylog.com
127.0.0.1 errorkiller.com
127.0.0.1 www.errorkiller.com
127.0.0.1 Some-Standards.com
127.0.0.1 www.Some-Standards.com
127.0.0.1 getpatytoday.info
127.0.0.1 www.getpatytoday.info
127.0.0.1 antiddos.us
127.0.0.1 www.antiddos.us
127.0.0.1 pussyharem.com
127.0.0.1 www.pussyharem.com
127.0.0.1 axmediasoftware.com
127.0.0.1 www.axmediasoftware.com
127.0.0.1 videoaxsoftware.com
127.0.0.1 www.videoaxsoftware.com
127.0.0.1 movies-codecs.com
127.0.0.1 www.movies-codecs.com
127.0.0.1 adarmor.com
127.0.0.1 www.adarmor.com
127.0.0.1 fixerantispy.com
127.0.0.1 www.fixerantispy.com
127.0.0.1 spyanalyst.com
127.0.0.1 www.spyanalyst.com
127.0.0.1 spyofficer.com
127.0.0.1 www.spyofficer.com
127.0.0.1 tvscodec.com
127.0.0.1 www.tvscodec.com
127.0.0.1 blackblues00.com
127.0.0.1 www.blackblues00.com
127.0.0.1 www.net-nucleus.com
127.0.0.1 www.mirarsearch.com
127.0.0.1 spywarewizard.net
127.0.0.1 www.spywarewizard.net
127.0.0.1 dcurtis.com
127.0.0.1 www.dcurtis.com
127.0.0.1 contra-virus.com
127.0.0.1 www.contra-virus.com
127.0.0.1 mrantispy.com
127.0.0.1 www.mrantispy.com
127.0.0.1 malwarealarm.com
127.0.0.1 www.malwarealarm.com
127.0.0.1 myspyprotector.com
127.0.0.1 www.myspyprotector.com
127.0.0.1 spydefence.com
127.0.0.1 www.spydefence.com
127.0.0.1 onporn.info
127.0.0.1 www.onporn.info
127.0.0.1 keygenguru.com
127.0.0.1 www.keygenguru.com
127.0.0.1 whitescat.com
127.0.0.1 www.whitescat.com
127.0.0.1 123topsearch.com
127.0.0.1 www.123topsearch.com
127.0.0.1 itknown.net
127.0.0.1 www.itknown.net
127.0.0.1 www.downloadmax.net
127.0.0.1 coolservecorp.net
127.0.0.1 www.coolservecorp.net
127.0.0.1 r16254.coolservecorp.net
127.0.0.1 panet.org
127.0.0.1 www.panet.org
127.0.0.1 cc.panet.org
127.0.0.1 ss.panet.org
127.0.0.1 fhg.panet.org
127.0.0.1 google.panet.org
127.0.0.1 yahoo.panet.org
127.0.0.1 backup.mabou.org
127.0.0.1 nav.mabou.org
127.0.0.1 dnl.mabou.org
127.0.0.1 www.searchmeta.net
127.0.0.1 vipru.com
127.0.0.1 www.vipru.com
127.0.0.1 xibu315.com
127.0.0.1 net.xibu315.com
127.0.0.1 www.xibu315.com
127.0.0.1 cache.ysbweb.com
127.0.0.1 www.vapochille.com
127.0.0.1 rms.vapochille.com
127.0.0.1 vapochille.com
127.0.0.1 spywarezapper.com
127.0.0.1 www.spywarezapper.com
127.0.0.1 mediaaxobject.com
127.0.0.1 www.mediaaxobject.com
127.0.0.1 axobjectsource.com
127.0.0.1 www.axobjectsource.com
127.0.0.1 videoaxobject.com
127.0.0.1 www.videoaxobject.com
127.0.0.1 accesskeygenerator.com
127.0.0.1 www.accesskeygenerator.com
127.0.0.1 numb-soft.com
127.0.0.1 www.numb-soft.com
127.0.0.1 internationalmarketingfirm.com
127.0.0.1 www.internationalmarketingfirm.com
127.0.0.1 7939.com
127.0.0.1 www.7939.com
127.0.0.1 hao123.com
127.0.0.1 www.hao123.com
127.0.0.1 4199.com
127.0.0.1 www.4199.com
127.0.0.1 9505.com
127.0.0.1 www.9505.com
127.0.0.1 7322.com
127.0.0.1 www.7322.com
127.0.0.1 huoche.com.cn
127.0.0.1 www.huoche.com.cn
127.0.0.1 free-porn-movies.info
127.0.0.1 www.free-porn-movies.info
127.0.0.1 player-codec.com
127.0.0.1 www.player-codec.com
127.0.0.1 activexvideo.com
127.0.0.1 www.activexvideo.com
127.0.0.1 activexemedia.com
127.0.0.1 www.activexemedia.com
127.0.0.1 axemediasoftware.com
127.0.0.1 www.axemediasoftware.com
127.0.0.1 activexmediasource.com
127.0.0.1 www.activexmediasource.com
127.0.0.1 videoactivexsoftware.com
127.0.0.1 www.videoactivexsoftware.com
127.0.0.1 ifeelyou.info
127.0.0.1 notify.ifeelyou.info
127.0.0.1 www.ifeelyou.info
127.0.0.1 iconnectyou.biz
127.0.0.1 www.iconnectyou.biz
127.0.0.1 settings.iconnectyou.biz
127.0.0.1 imergeyou.com
127.0.0.1 www.imergeyou.com
127.0.0.1 settings.imergeyou.com
127.0.0.1 myexes.hk
127.0.0.1 www.myexes.hk
127.0.0.1 updatemysettings.com
127.0.0.1 www.updatemysettings.com
127.0.0.1 settings.updatemysettings.com
127.0.0.1 controlmeh.com
127.0.0.1 www.controlmeh.com
127.0.0.1 settings.controlmeh.com
127.0.0.1 gfxgraphics.net
127.0.0.1 www.gfxgraphics.net
127.0.0.1 settings.gfxgraphics.net
127.0.0.1 ipointyou.hk
127.0.0.1 www.ipointyou.hk
127.0.0.1 axobjectpage.com
127.0.0.1 www.axobjectpage.com
127.0.0.1 axsoftwaretool.com
127.0.0.1 www.axsoftwaretool.com
127.0.0.1 sitekeygenerator.com
127.0.0.1 www.sitekeygenerator.com
127.0.0.1 mediaactivexobject.com
127.0.0.1 www.mediaactivexobject.com
127.0.0.1 videoactivexsoft.com
127.0.0.1 www.videoactivexsoft.com
127.0.0.1 videoobjectmedia.com
127.0.0.1 www.videoobjectmedia.com
127.0.0.1 traffstats.biz
127.0.0.1 www.traffstats.biz
127.0.0.1 support.365soft.info
127.0.0.1 www.support.365soft.info
127.0.0.1 best-targeted-traffic.com
127.0.0.1 www.best-targeted-traffic.com
127.0.0.1 createaccesskey.com
127.0.0.1 www.createaccesskey.com
127.0.0.1 sexxxpassport.com
127.0.0.1 www.sexxxpassport.com
127.0.0.1 mmmike.com
127.0.0.1 www.mmmike.com
127.0.0.1 worldwideadvertisingservices.info
127.0.0.1 www.worldwideadvertisingservices.info
127.0.0.1 www.nownames.org
127.0.0.1 nownames.org
127.0.0.1 dedmazay.3322.org
127.0.0.1 dr38.mcboo.com
127.0.0.1 bin.errorprotector.com
127.0.0.1 cdn.drivecleaner.com
127.0.0.1 cdn.errorsafe.com
127.0.0.1 cdn.winsoftware.com
127.0.0.1 download.cdn.drivecleaner.com
127.0.0.1 download.cdn.errorsafe.com
127.0.0.1 drivecleaner.com
127.0.0.1 dynamique.drivecleaner.com
127.0.0.1 go.drivecleaner.com
127.0.0.1 jsp.drivecleaner.com
127.0.0.1 secure.drivecleaner.com
127.0.0.1 secure.winantispam.com
127.0.0.1 www.drivecleaner.com
127.0.0.1 www.winantispam.com
127.0.0.1 www.windrivesafe.com
127.0.0.1 181.365soft.info
127.0.0.1 www.181.365soft.info
127.0.0.1 24.365soft.info
127.0.0.1 www.24.365soft.info
127.0.0.1 c5.www4free.info
127.0.0.1 www.c5.www4free.info
127.0.0.1 bookedspace.com
127.0.0.1 www.bookedspace.com
127.0.0.1 searchclickads.net
127.0.0.1 www.searchclickads.net
127.0.0.1 toolster.de
127.0.0.1 www.toolster.de
127.0.0.1 checkin100.com
127.0.0.1 www.checkin100.com
127.0.0.1 dist.checkin100.com
127.0.0.1 myadultexplorer.com
127.0.0.1 www.myadultexplorer.com
127.0.0.1 client.myadultexplorer.com
127.0.0.1 sense-super.com
127.0.0.1 www.sense-super.com
127.0.0.1 awbeta.net-nucleus.com
127.0.0.1 mycpmads.com
127.0.0.1 www.mycpmads.com
127.0.0.1 p2psoft.biz
127.0.0.1 www.p2psoft.biz
127.0.0.1 wonder-context.com
127.0.0.1 new.wonder-context.com
127.0.0.1 www.wonder-context.com
127.0.0.1 www.matcash.com
127.0.0.1 media.matcash.com
127.0.0.1 matcash.com
127.0.0.1 www.laughnetwork.com
127.0.0.1 laughnetwork.com
127.0.0.1 www.cooldeskalert.com
127.0.0.1 cooldeskalert.com
127.0.0.1 www.awesomehomepage.com
127.0.0.1 awesomehomepage.com
127.0.0.1 www.softomate.com
127.0.0.1 softomate.com
127.0.0.1 magicsearch.ws
127.0.0.1 www.magicsearch.ws
127.0.0.1 antivermins.com
127.0.0.1 www.antivermins.com
127.0.0.1 awarninglist.com
127.0.0.1 www.awarninglist.com
127.0.0.1 macrovirus.com
127.0.0.1 www.macrovirus.com
127.0.0.1 www.iframebiz.com
127.0.0.1 iframebiz.com
127.0.0.1 search.keyword.exeupdate.com
127.0.0.1 client.exeupdate.com
127.0.0.1 www.exeupdate.com
127.0.0.1 download.searchtabs.net
127.0.0.1 install.searchtab.net
127.0.0.1 www.searchtab.net
127.0.0.1 videoobjectax.com
127.0.0.1 www.videoobjectax.com
127.0.0.1 videoaccessactivex.com
127.0.0.1 www.videoaccessactivex.com
127.0.0.1 site-ticket.net
127.0.0.1 www.site-ticket.net
127.0.0.1 floorsovertexas.com
127.0.0.1 www.floorsovertexas.com
127.0.0.1 cameouk.co.uk
127.0.0.1 www.cameouk.co.uk
127.0.0.1 graceinthedesert.org
127.0.0.1 www.graceinthedesert.org
127.0.0.1 northernsoulclub.com
127.0.0.1 www.northernsoulclub.com
127.0.0.1 oxfordclockrepairs.co.uk
127.0.0.1 www.oxfordclockrepairs.co.uk
127.0.0.1 starcleaningservice.com.au
127.0.0.1 www.starcleaningservice.com.au
127.0.0.1 hiboss.com
127.0.0.1 www.hiboss.com
127.0.0.1 releaseforlife.com
127.0.0.1 www.releaseforlife.com
127.0.0.1 relevantknowledge.com
127.0.0.1 www.relevantknowledge.com
127.0.0.1 bpfq02.com
127.0.0.1 www.bpfq02.com
127.0.0.1 axmediaproject.com
127.0.0.1 www.axmediaproject.com
127.0.0.1 activexmediapro.com
127.0.0.1 www.activexmediapro.com
127.0.0.1 activexvideotool.com
127.0.0.1 www.activexvideotool.com
127.0.0.1 aximageobject.com
127.0.0.1 www.aximageobject.com
127.0.0.1 tv-codecs.com
127.0.0.1 www.tv-codecs.com
127.0.0.1 sitesticket.net
127.0.0.1 www.sitesticket.net
127.0.0.1 multitrader.info
127.0.0.1 www.multitrader.info
127.0.0.1 googlus.com
127.0.0.1 www.googlus.com
127.0.0.1 p2p-heute.de
127.0.0.1 www.p2p-heute.de
127.0.0.1 antispywarebot.com
127.0.0.1 www.antispywarebot.com
127.0.0.1 download.antispywarebot.com
127.0.0.1 www.download.antispywarebot.com
127.0.0.1 spybot.reviewsit.net
127.0.0.1 www.spybot.reviewsit.net
127.0.0.1 reviewsit.net
127.0.0.1 www.reviewsit.net
127.0.0.1 antispywaredownloads.com
127.0.0.1 www.antispywaredownloads.com
127.0.0.1 www-spyboot.com
127.0.0.1 www.www-spyboot.com
127.0.0.1 computerrecover.com
127.0.0.1 www.computerrecover.com
127.0.0.1 kr62.com
127.0.0.1 www.kr62.com
127.0.0.1 marketing-know-how.com
127.0.0.1 www.marketing-know-how.com
127.0.0.1 titanmotors.com
127.0.0.1 www.titanmotors.com
127.0.0.1 alliesecurity.com
127.0.0.1 www.alliesecurity.com
127.0.0.1 allsecuritynotes.com
127.0.0.1 www.allsecuritynotes.com
127.0.0.1 aprotectedpage.com
127.0.0.1 www.aprotectedpage.com
127.0.0.1 asafetynotice.com
127.0.0.1 www.asafetynotice.com
127.0.0.1 asafetypage.com
127.0.0.1 www.asafetypage.com
127.0.0.1 asecureboard.com
127.0.0.1 www.asecureboard.com
127.0.0.1 asecurityissue.com
127.0.0.1 www.asecurityissue.com
127.0.0.1 asecuritynotice.com
127.0.0.1 www.asecuritynotice.com
127.0.0.1 asecuritypaper.com
127.0.0.1 www.asecuritypaper.com
127.0.0.1 asecuritystuff.com
127.0.0.1 www.asecuritystuff.com
127.0.0.1 assureprotection.com
127.0.0.1 www.assureprotection.com
127.0.0.1 atrueprotection.com
127.0.0.1 www.atrueprotection.com
127.0.0.1 eprotectionline.com
127.0.0.1 www.eprotectionline.com
127.0.0.1 esecuritynote.com
127.0.0.1 www.esecuritynote.com
127.0.0.1 ieprotectpage.com
127.0.0.1 www.ieprotectpage.com
127.0.0.1 iesafetypage.com
127.0.0.1 www.iesafetypage.com
127.0.0.1 iesecuritytool.com
127.0.0.1 www.iesecuritytool.com
127.0.0.1 protectionssoft.com
127.0.0.1 www.protectionssoft.com
127.0.0.1 protectionwarn.com
127.0.0.1 www.protectionwarn.com
127.0.0.1 qnavigate.com
127.0.0.1 www.qnavigate.com
127.0.0.1 safetyhall.com
127.0.0.1 www.safetyhall.com
127.0.0.1 safetypropage.com
127.0.0.1 www.safetypropage.com
127.0.0.1 thesafetytool.com
127.0.0.1 www.thesafetytool.com
127.0.0.1 topsecuritypage.com
127.0.0.1 www.topsecuritypage.com
127.0.0.1 youriesecure.com
127.0.0.1 www.youriesecure.com
127.0.0.1 dl2.spyheal.com
127.0.0.1 dl3.spyheal.com
127.0.0.1 www.xp-vista.com
127.0.0.1 xp-vista.com
127.0.0.1 dl8.spyheal.com
127.0.0.1 sitestickets.net
127.0.0.1 www.sitestickets.net
127.0.0.1 madsexxx.com
127.0.0.1 www.madsexxx.com
127.0.0.1 accessclips.com
127.0.0.1 www.accessclips.com
127.0.0.1 www.warningiepage.com
127.0.0.1 warningiepage.com
127.0.0.1 videos-access.com
127.0.0.1 www.videos-access.com
127.0.0.1 axvideoproject.com
127.0.0.1 www.axvideoproject.com
127.0.0.1 videoaxproject.com
127.0.0.1 www.videoaxproject.com
127.0.0.1 videoactivexmode.com
127.0.0.1 www.videoactivexmode.com
127.0.0.1 player-codec.net
127.0.0.1 www.player-codec.net
127.0.0.1 siteentrance.net
127.0.0.1 www.siteentrance.net
127.0.0.1 www.pestcapture.com
127.0.0.1 pestcapture.com
127.0.0.1 andromedical.com
127.0.0.1 www.andromedical.com
127.0.0.1 video-clips.in
127.0.0.1 www.video-clips.in
127.0.0.1 activexmediasoftware.com
127.0.0.1 www.activexmediasoftware.com
127.0.0.1 spybot-scan.com
127.0.0.1 www.spybot-scan.com
127.0.0.1 www.spyboot.com
127.0.0.1 codecdvd.net
127.0.0.1 www.codecdvd.net
127.0.0.1 lebenstest.de
127.0.0.1 www.lebenstest.de
127.0.0.1 kalmarte.zapto.org
127.0.0.1 nmextensions.com
127.0.0.1 www.nmextensions.com
127.0.0.1 asecurebar.com
127.0.0.1 www.asecurebar.com
127.0.0.1 thesafebar.com
127.0.0.1 www.thesafebar.com
127.0.0.1 videoaxdata.com
127.0.0.1 www.videoaxdata.com
127.0.0.1 mediaaxproject.com
127.0.0.1 www.mediaaxproject.com
127.0.0.1 videoaxsolution.com
127.0.0.1 www.videoaxsolution.com
127.0.0.1 dvdsmovies.net
127.0.0.1 www.dvdsmovies.net
127.0.0.1 dvdsvideos.net
127.0.0.1 www.dvdsvideos.net
127.0.0.1 moviesdvds.net
127.0.0.1 www.moviesdvds.net
127.0.0.1 xbxxrvnyes.com
127.0.0.1 www.xbxxrvnyes.com
127.0.0.1 spywarebot-t.com
127.0.0.1 www.spywarebot-t.com
127.0.0.1 kzdh.com
127.0.0.1 www.kzdh.com
127.0.0.1 unionsms.net
127.0.0.1 www.unionsms.net
127.0.0.1 file.unionsms.net
127.0.0.1 82211.net
127.0.0.1 wwww.2211.net
127.0.0.1 2.82211.net
127.0.0.1 xsec.org
127.0.0.1 www.xsec.org
127.0.0.1 securetoolbar.com
127.0.0.1 www.securetoolbar.com
127.0.0.1 sdbot.n3.net
127.0.0.1 k8l.info
127.0.0.1 ads.k8l.info
127.0.0.1 emailicon.org
127.0.0.1 www.emailicon.org
127.0.0.1 find-52.com
127.0.0.1 www.find-52.com
127.0.0.1 wintvguide.com
127.0.0.1 www.wintvguide.com
127.0.0.1 adtrak.net
127.0.0.1 www.adtrak.net
127.0.0.1 top-banners.com
127.0.0.1 www.top-banners.com
127.0.0.1 jumptothat.com
127.0.0.1 www.jumptothat.com
127.0.0.1 searchingbooth.com
127.0.0.1 ads.searchingbooth.com
127.0.0.1 www.searchingbooth.com
127.0.0.1 uzoogle.com
127.0.0.1 games.uzoogle.com
127.0.0.1 www.uzoogle.com
127.0.0.1 marketingsector.com
127.0.0.1 ads.marketingsector.com
127.0.0.1 fun-photo.com
127.0.0.1 www.fun-photo.com
127.0.0.1 calendaralerts.net
127.0.0.1 www.calendaralerts.net
127.0.0.1 cydoor.com
127.0.0.1 www.cydoor.com
127.0.0.1 headlinesandnews.com
127.0.0.1 www.headlinesandnews.com
127.0.0.1 servedby.headlinesandnews.com
127.0.0.1 oridian.com
127.0.0.1 www.oridian.com
127.0.0.1 standardinternet.com
127.0.0.1 www.standardinternet.com
127.0.0.1 z-quest.com
127.0.0.1 ads.z-quest.com
127.0.0.1 www.z-quest.com
127.0.0.1 finalfantasyactionfigures.com
127.0.0.1 www.finalfantasyactionfigures.com
127.0.0.1 iconfessonline.com
127.0.0.1 www.iconfessonline.com
127.0.0.1 touchnsearch.com
127.0.0.1 www.touchnsearch.com
127.0.0.1 computerpcgames.net
127.0.0.1 www.computerpcgames.net
127.0.0.1 fairsearcher.com
127.0.0.1 www.fairsearcher.com
127.0.0.1 greencardspouse.com
127.0.0.1 www.greencardspouse.com
127.0.0.1 deskwizz.com
127.0.0.1 apps.deskwizz.com
127.0.0.1 www.deskwizz.com
127.0.0.1 cuisinartoven.com
127.0.0.1 www.cuisinartoven.com
127.0.0.1 webbuying.net
127.0.0.1 u.webbuying.net
127.0.0.1 www.webbuying.net
127.0.0.1 paypopup.com
127.0.0.1 www.paypopup.com
127.0.0.1 www224.paypopup.com
127.0.0.1 multi-pops.com
127.0.0.1 www.multi-pops.com
127.0.0.1 service.multi-pops.com
127.0.0.1 i-nt-e-r-n-e-t.com
127.0.0.1 www.i-nt-e-r-n-e-t.com
127.0.0.1 searchfromyourbrowser.net
127.0.0.1 www.searchfromyourbrowser.net
127.0.0.1 quick.searchfromyourbrowser.net
127.0.0.1 ertikadeswiokinganfujas.com
127.0.0.1 www.ertikadeswiokinganfujas.com
127.0.0.1 juyatinjesaza.com
127.0.0.1 www.juyatinjesaza.com
127.0.0.1 hadesunharuikeya.com
127.0.0.1 www3.hadesunharuikeya.com
127.0.0.1 dr47.mcboo.com
127.0.0.1 032439.com
127.0.0.1 www.032439.com
127.0.0.1 80gw6ry3i3x3qbrkwhxhw.032439.com
127.0.0.1 command.adservs.com
127.0.0.1 report.dropspam.com
127.0.0.1 dropspam.com
127.0.0.1 www.dropspam.com
127.0.0.1 dl1.antivermins.com
127.0.0.1 dl1.spydawn.com
127.0.0.1 souljah.com
127.0.0.1 www.souljah.com
127.0.0.1 geil-de.info
127.0.0.1 www.geil-de.info
127.0.0.1 www.pochta.ru
127.0.0.1 pochta.ru
127.0.0.1 www.arquivojpgs.smtp.ru
127.0.0.1 arquivojpgs.smtp.ru
127.0.0.1 www.smtp.ru
127.0.0.1 www.x-ratedclips.com
127.0.0.1 x-ratedclips.com
127.0.0.1 www.mediaaxsolution.com
127.0.0.1 mediaaxsolution.com
127.0.0.1 www.activexmediasite.com
127.0.0.1 activexmediasite.com
127.0.0.1 engineplay.com
127.0.0.1 www.engineplay.com
127.0.0.1 ofuxico.uol.com.br
127.0.0.1 hobbypesca.com.br
127.0.0.1 www.hobbypesca.com.br
127.0.0.1 www.abyssmedia.com
127.0.0.1 abyssmedia.com
127.0.0.1 zjkjw.gov.cn
127.0.0.1 www.zjkjw.gov.cn
127.0.0.1 lfxmsc.gov.cn
127.0.0.1 www.lfxmsc.gov.cn
127.0.0.1 ultimateprotect.com
127.0.0.1 www.get-access.host.sk
127.0.0.1 www.burnsrecyclinginc.com
127.0.0.1 burnsrecyclinginc.com
127.0.0.1 use-play.com
127.0.0.1 www.use-play.com
127.0.0.1 plus-play.com
127.0.0.1 www.plus-play.com
127.0.0.1 review-play.com
127.0.0.1 www.review-play.com
127.0.0.1 avideoaxaccess.com
127.0.0.1 www.avideoaxaccess.com
127.0.0.1 cartoes.uol.com.br
127.0.0.1 fhgate.com
127.0.0.1 www.fhgate.com
127.0.0.1 aflgate.com
127.0.0.1 www.aflgate.com
127.0.0.1 bqgate.com
127.0.0.1 www.bqgate.com
127.0.0.1 xvgate.com
127.0.0.1 www.xvgate.com
127.0.0.1 bnmgate.com
127.0.0.1 www.bnmgate.com
127.0.0.1 cdegate.com
127.0.0.1 www.cdegate.com
127.0.0.1 hwgate.com
127.0.0.1 www.hwgate.com
127.0.0.1 worldsecurityonline.biz
127.0.0.1 www.worldsecurityonline.biz
127.0.0.1 karachun.biz
127.0.0.1 www.karachun.biz
127.0.0.1 anti-vermins.com
127.0.0.1 www.anti-vermins.com
127.0.0.1 antispyware.com
127.0.0.1 www.antispyware.com
127.0.0.1 2squared.com
127.0.0.1 www.2squared.com
127.0.0.1 spydawn.com
127.0.0.1 www.spydawn.com
127.0.0.1 videosoftwareax.com
127.0.0.1 www.videosoftwareax.com
127.0.0.1 imagemediaax.com
127.0.0.1 www.imagemediaax.com
127.0.0.1 freeimageheaven.com
127.0.0.1 www.freeimageheaven.com
127.0.0.1 itfindout.org
127.0.0.1 www.itfindout.org
127.0.0.1 findanyshow.org
127.0.0.1 www.findanyshow.org
127.0.0.1 findwapsite.org
127.0.0.1 www.findwapsite.org
127.0.0.1 nowsearchonline.org
127.0.0.1 www.nowsearchonline.org
127.0.0.1 ebestfind.org
127.0.0.1 www.ebestfind.org
127.0.0.1 canidetect.org
127.0.0.1 www.canidetect.org
127.0.0.1 starsdoor.com
127.0.0.1 www.starsdoor.com
127.0.0.1 imageactivexsolution.com
127.0.0.1 www.imageactivexsolution.com
127.0.0.1 hotwinupdates.com
127.0.0.1 www.hotwinupdates.com
127.0.0.1 antispywarebox.com
127.0.0.1 www.antispywarebox.com
127.0.0.1 protectmypc.net
127.0.0.1 www.protectmypc.net
127.0.0.1 mediacodec2007.com
127.0.0.1 www.mediacodec2007.com
127.0.0.1 malwarebot.com
127.0.0.1 www.malwarebot.com
127.0.0.1 www.nerdwareinc.com
127.0.0.1 nerdwareinc.com
127.0.0.1 exportplay.com
127.0.0.1 www.exportplay.com
127.0.0.1 avpcheckupdate.com
127.0.0.1 www.avpcheckupdate.com
127.0.0.1 net-integration.net
127.0.0.1 www.net-integration.net
127.0.0.1 net-integration.us
127.0.0.1 www.net-integration.us
127.0.0.1 zdrqmpad.com
127.0.0.1 www.zdrqmpad.com
127.0.0.1 sandracounter.com
127.0.0.1 www.sandracounter.com
127.0.0.1 mybestsearch2007.com
127.0.0.1 www.mybestsearch2007.com
127.0.0.1 givecnt.info
127.0.0.1 www.givecnt.info
127.0.0.1 khcbaym.com
127.0.0.1 www.khcbaym.com
127.0.0.1 allvideoactivex.com
127.0.0.1 www.allvideoactivex.com
127.0.0.1 gaystogay.com
127.0.0.1 www.gaystogay.com
127.0.0.1 ayb.netbios-wait.com
127.0.0.1 www.netbios-wait.com
127.0.0.1 netbios-wait.com
127.0.0.1 vskeylogger.nazwa.pl
127.0.0.1 www.vskeylogger.nazwa.pl
127.0.0.1 farmacept32.phpnet.us
127.0.0.1 playbrowse.com
127.0.0.1 www.playbrowse.com
127.0.0.1 videoactivexnote.com
127.0.0.1 www.videoactivexnote.com
127.0.0.1 digitalcoders.net
127.0.0.1 www.digitalcoders.net
127.0.0.1 cia-trjn.myvnc.com
127.0.0.1 www.cia-trjn.myvnc.com
127.0.0.1 misofthelp.com
127.0.0.1 www.misofthelp.com
127.0.0.1 swz2006.to.8866.org
127.0.0.1 www.swz2006.to.8866.org
127.0.0.1 myspywarebot.com
127.0.0.1 www.myspywarebot.com
127.0.0.1 spywarebott.com
127.0.0.1 www.spywarebott.com
127.0.0.1 giangho.biz
127.0.0.1 www.giangho.biz
127.0.0.1 3bay.it
127.0.0.1 www.3bay.it
127.0.0.1 3ebay.it
127.0.0.1 www.3ebay.it
127.0.0.1 4ebay.it
127.0.0.1 www.4ebay.it
127.0.0.1 4repubblica.it
127.0.0.1 www.4repubblica.it
127.0.0.1 5iscali.it
127.0.0.1 www.5iscali.it
127.0.0.1 5repubblica.it
127.0.0.1 www.5repubblica.it
127.0.0.1 5tiscali.it
127.0.0.1 www.5tiscali.it
127.0.0.1 6iscali.it
127.0.0.1 www.6iscali.it
127.0.0.1 6tiscali.it
127.0.0.1 www.6tiscali.it
127.0.0.1 aginegialle.it
127.0.0.1 www.aginegialle.it
127.0.0.1 aitalia.it
127.0.0.1 www.aitalia.it
127.0.0.1 aklitalia.it
127.0.0.1 www.aklitalia.it
127.0.0.1 alialia.it
127.0.0.1 www.alialia.it
127.0.0.1 aliotalia.it
127.0.0.1 www.aliotalia.it
127.0.0.1 alirtalia.it
127.0.0.1 www.alirtalia.it
127.0.0.1 alitaia.it
127.0.0.1 www.alitaia.it
127.0.0.1 alitaklia.it
127.0.0.1 www.alitaklia.it
127.0.0.1 alitala.it
127.0.0.1 www.alitala.it
127.0.0.1 alitaliaq.it
127.0.0.1 www.alitaliaq.it
127.0.0.1 alitalias.it
127.0.0.1 www.alitalias.it
127.0.0.1 alitaliaz.it
127.0.0.1 www.alitaliaz.it
127.0.0.1 alitali.it
127.0.0.1 www.alitali.it
127.0.0.1 alitalioa.it
127.0.0.1 www.alitalioa.it
127.0.0.1 alitalisa.it
127.0.0.1 www.alitalisa.it
127.0.0.1 alitaliua.it
127.0.0.1 www.alitaliua.it
127.0.0.1 alitalkia.it
127.0.0.1 www.alitalkia.it
127.0.0.1 alitaloia.it
127.0.0.1 www.alitaloia.it
127.0.0.1 alitaluia.it
127.0.0.1 www.alitaluia.it
127.0.0.1 alitaslia.it
127.0.0.1 www.alitaslia.it
127.0.0.1 alitlia.it
127.0.0.1 www.alitlia.it
127.0.0.1 alitralia.it
127.0.0.1 www.alitralia.it
127.0.0.1 alitsalia.it
127.0.0.1 www.alitsalia.it
127.0.0.1 aliutalia.it
127.0.0.1 www.aliutalia.it
127.0.0.1 aloitalia.it
127.0.0.1 www.aloitalia.it
127.0.0.1 aluitalia.it
127.0.0.1 www.aluitalia.it
127.0.0.1 aslitalia.it
127.0.0.1 www.aslitalia.it
127.0.0.1 asupereva.it
127.0.0.1 www.asupereva.it
127.0.0.1 aupereva.it
127.0.0.1 www.aupereva.it
127.0.0.1 azzetta.it
127.0.0.1 www.azzetta.it
127.0.0.1 bgazzetta.it
127.0.0.1 www.bgazzetta.it
127.0.0.1 bgoogle.it
127.0.0.1 www.bgoogle.it
127.0.0.1 bvirgilio.it
127.0.0.1 www.bvirgilio.it
127.0.0.1 ccorriere.it
127.0.0.1 www.ccorriere.it
127.0.0.1 cdorriere.it
127.0.0.1 www.cdorriere.it
127.0.0.1 cforriere.it
127.0.0.1 www.cforriere.it
127.0.0.1 ciorriere.it
127.0.0.1 www.ciorriere.it
127.0.0.1 cirriere.it
127.0.0.1 www.cirriere.it
127.0.0.1 clorriere.it
127.0.0.1 www.clorriere.it
127.0.0.1 codrriere.it
127.0.0.1 www.codrriere.it
127.0.0.1 coeriere.it
127.0.0.1 www.coeriere.it
127.0.0.1 coerriere.it
127.0.0.1 www.coerriere.it
127.0.0.1 cofrriere.it
127.0.0.1 www.cofrriere.it
127.0.0.1 cogrriere.it
127.0.0.1 www.cogrriere.it
127.0.0.1 coirriere.it
127.0.0.1 www.coirriere.it
127.0.0.1 coorriere.it
127.0.0.1 www.coorriere.it
127.0.0.1 coprriere.it
127.0.0.1 www.coprriere.it
127.0.0.1 coreiere.it
127.0.0.1 www.coreiere.it
127.0.0.1 coreriere.it
127.0.0.1 www.coreriere.it
127.0.0.1 corrdiere.it
127.0.0.1 www.corrdiere.it
127.0.0.1 correiere.it
127.0.0.1 www.correiere.it
127.0.0.1 corrfiere.it
127.0.0.1 www.corrfiere.it
127.0.0.1 corrgiere.it
127.0.0.1 www.corrgiere.it
127.0.0.1 corridere.it
127.0.0.1 www.corridere.it
127.0.0.1 corriedre.it
127.0.0.1 www.corriedre.it
127.0.0.1 corriee.it
127.0.0.1 www.corriee.it
127.0.0.1 corrieere.it
127.0.0.1 www.corrieere.it
127.0.0.1 corriefre.it
127.0.0.1 www.corriefre.it
127.0.0.1 corriegre.it
127.0.0.1 www.corriegre.it
127.0.0.1 corrierde.it
127.0.0.1 www.corrierde.it
127.0.0.1 corriered.it
127.0.0.1 www.corriered.it
127.0.0.1 corrieree.it
127.0.0.1 www.corrieree.it
127.0.0.1 corrieref.it
127.0.0.1 www.corrieref.it
127.0.0.1 corrierer.it
127.0.0.1 www.corrierer.it
127.0.0.1 corrieres.it
127.0.0.1 www.corrieres.it
127.0.0.1 corrierew.it
127.0.0.1 www.corrierew.it
127.0.0.1 corrierfe.it
127.0.0.1 www.corrierfe.it
127.0.0.1 corrierge.it
127.0.0.1 www.corrierge.it
127.0.0.1 corrierre.it
127.0.0.1 www.corrierre.it
127.0.0.1 corrierr.it
127.0.0.1 www.corrierr.it
127.0.0.1 corrierse.it
127.0.0.1 www.corrierse.it
127.0.0.1 corrierte.it
127.0.0.1 www.corrierte.it
127.0.0.1 corrierwe.it
127.0.0.1 www.corrierwe.it
127.0.0.1 corrierw.it
127.0.0.1 www.corrierw.it
127.0.0.1 corriesre.it
127.0.0.1 www.corriesre.it
127.0.0.1 corriete.it
127.0.0.1 www.corriete.it
127.0.0.1 corrietre.it
127.0.0.1 www.corrietre.it
127.0.0.1 corriewre.it
127.0.0.1 www.corriewre.it
127.0.0.1 corrifere.it
127.0.0.1 www.corrifere.it
127.0.0.1 corriiere.it
127.0.0.1 www.corriiere.it
127.0.0.1 corrilere.it
127.0.0.1 www.corrilere.it
127.0.0.1 corrioere.it
127.0.0.1 www.corrioere.it
127.0.0.1 corrire.it
127.0.0.1 www.corrire.it
127.0.0.1 corrirere.it
127.0.0.1 www.corrirere.it
127.0.0.1 corrirre.it
127.0.0.1 www.corrirre.it
127.0.0.1 corrisere.it
127.0.0.1 www.corrisere.it
127.0.0.1 corriuere.it
127.0.0.1 www.corriuere.it
127.0.0.1 corriwere.it
127.0.0.1 www.corriwere.it
127.0.0.1 corriwre.it
127.0.0.1 www.corriwre.it
127.0.0.1 corrliere.it
127.0.0.1 www.corrliere.it
127.0.0.1 corroere.it
127.0.0.1 www.corroere.it
127.0.0.1 corroiere.it
127.0.0.1 www.corroiere.it
127.0.0.1 corrriere.it
127.0.0.1 www.corrriere.it
127.0.0.1 corrtiere.it
127.0.0.1 www.corrtiere.it
127.0.0.1 corruere.it
127.0.0.1 www.corruere.it
127.0.0.1 corruiere.it
127.0.0.1 www.corruiere.it
127.0.0.1 cortiere.it
127.0.0.1 www.cortiere.it
127.0.0.1 cortriere.it
127.0.0.1 www.cortriere.it
127.0.0.1 cotriere.it
127.0.0.1 www.cotriere.it
127.0.0.1 cotrriere.it
127.0.0.1 www.cotrriere.it
127.0.0.1 cporriere.it
127.0.0.1 www.cporriere.it
127.0.0.1 cprriere.it
127.0.0.1 www.cprriere.it
127.0.0.1 crriere.it
127.0.0.1 www.crriere.it
127.0.0.1 cvirgilio.it
127.0.0.1 www.cvirgilio.it
127.0.0.1 cvorriere.it
127.0.0.1 www.cvorriere.it
127.0.0.1 cxorriere.it
127.0.0.1 www.cxorriere.it
127.0.0.1 dcorriere.it
127.0.0.1 www.dcorriere.it
127.0.0.1 debay.it
127.0.0.1 www.debay.it
127.0.0.1 derrari.it
127.0.0.1 www.derrari.it
127.0.0.1 drepubblica.it
127.0.0.1 www.drepubblica.it
127.0.0.1 dsupereva.it
127.0.0.1 www.dsupereva.it
127.0.0.1 e3bay.it
127.0.0.1 www.e3bay.it
127.0.0.1 e4bay.it
127.0.0.1 www.e4bay.it
127.0.0.1 eba6y.it
127.0.0.1 www.eba6y.it
127.0.0.1 eba7y.it
127.0.0.1 www.eba7y.it
127.0.0.1 ebaay.it
127.0.0.1 www.ebaay.it
127.0.0.1 ebagy.it
127.0.0.1 www.ebagy.it
127.0.0.1 ebahy.it
127.0.0.1 www.ebahy.it
127.0.0.1 ebajy.it
127.0.0.1 www.ebajy.it
127.0.0.1 ebaqy.it
127.0.0.1 www.ebaqy.it
127.0.0.1 ebasy.it
127.0.0.1 www.ebasy.it
127.0.0.1 ebaty.it
127.0.0.1 www.ebaty.it
127.0.0.1 ebauy.it
127.0.0.1 www.ebauy.it
127.0.0.1 ebawy.it
127.0.0.1 www.ebawy.it
127.0.0.1 ebaxy.it
127.0.0.1 www.ebaxy.it
127.0.0.1 ebay6.it
127.0.0.1 www.ebay6.it
127.0.0.1 ebay7.it
127.0.0.1 www.ebay7.it
127.0.0.1 ebayg.it
127.0.0.1 www.ebayg.it
127.0.0.1 ebayh.it
127.0.0.1 www.ebayh.it
127.0.0.1 ebayj.it
127.0.0.1 www.ebayj.it
127.0.0.1 ebayu.it
127.0.0.1 www.ebayu.it
127.0.0.1 ebayt.it
127.0.0.1 www.ebayt.it
127.0.0.1 ebazy.it
127.0.0.1 www.ebazy.it
127.0.0.1 ebgay.it
127.0.0.1 www.ebgay.it
127.0.0.1 ebhay.it
127.0.0.1 www.ebhay.it
127.0.0.1 ebnay.it
127.0.0.1 www.ebnay.it
127.0.0.1 ebqay.it
127.0.0.1 www.ebqay.it
127.0.0.1 ebsay.it
127.0.0.1 www.ebsay.it
127.0.0.1 ebsy.it
127.0.0.1 www.ebsy.it
127.0.0.1 ebvay.it
127.0.0.1 www.ebvay.it
127.0.0.1 ebway.it
127.0.0.1 www.ebway.it
127.0.0.1 ebxay.it
127.0.0.1 www.ebxay.it
127.0.0.1 ebzay.it
127.0.0.1 www.ebzay.it
127.0.0.1 edbay.it
127.0.0.1 www.edbay.it
127.0.0.1 eebay.it
127.0.0.1 www.eebay.it
127.0.0.1 eepubblica.it
127.0.0.1 www.eepubblica.it
127.0.0.1 efbay.it
127.0.0.1 www.efbay.it
127.0.0.1 egbay.it
127.0.0.1 www.egbay.it
127.0.0.1 ehbay.it
127.0.0.1 www.ehbay.it
127.0.0.1 enay.it
127.0.0.1 www.enay.it
127.0.0.1 enbay.it
127.0.0.1 www.enbay.it
127.0.0.1 erbay.it
127.0.0.1 www.erbay.it
127.0.0.1 erepubblica.it
127.0.0.1 www.erepubblica.it
127.0.0.1 erossoalice.it
127.0.0.1 www.erossoalice.it
127.0.0.1 errari.it
127.0.0.1 www.errari.it
127.0.0.1 esbay.it
127.0.0.1 www.esbay.it
127.0.0.1 esupereva.it
127.0.0.1 www.esupereva.it
127.0.0.1 evbay.it
127.0.0.1 www.evbay.it
127.0.0.1 ewbay.it
127.0.0.1 www.ewbay.it
127.0.0.1 fazzetta.it
127.0.0.1 www.fazzetta.it
127.0.0.1 fcorriere.it
127.0.0.1 www.fcorriere.it
127.0.0.1 febay.it
127.0.0.1 www.febay.it
127.0.0.1 ferraeri.it
127.0.0.1 www.ferraeri.it
127.0.0.1 ferrai.it
127.0.0.1 www.ferrai.it
127.0.0.1 ferrarei.it
127.0.0.1 www.ferrarei.it
127.0.0.1 ferrarti.it
127.0.0.1 www.ferrarti.it
127.0.0.1 ferrasri.it
127.0.0.1 www.ferrasri.it
127.0.0.1 ferratri.it
127.0.0.1 www.ferratri.it
127.0.0.1 ferreari.it
127.0.0.1 www.ferreari.it
127.0.0.1 ferrri.it
127.0.0.1 www.ferrri.it
127.0.0.1 ferrsari.it
127.0.0.1 www.ferrsari.it
127.0.0.1 ferrtari.it
127.0.0.1 www.ferrtari.it
127.0.0.1 fetrrari.it
127.0.0.1 www.fetrrari.it
127.0.0.1 fgazzetta.it
127.0.0.1 www.fgazzetta.it
127.0.0.1 fgoogle.it
127.0.0.1 www.fgoogle.it
127.0.0.1 firgilio.it
127.0.0.1 www.firgilio.it
127.0.0.1 frepubblica.it
127.0.0.1 www.frepubblica.it
127.0.0.1 frrari.it
127.0.0.1 www.frrari.it
127.0.0.1 frrrari.it
127.0.0.1 www.frrrari.it
127.0.0.1 ftiscali.it
127.0.0.1 www.ftiscali.it
127.0.0.1 ftrenitalia.it
127.0.0.1 www.ftrenitalia.it
127.0.0.1 ftuttogratis.it
127.0.0.1 www.ftuttogratis.it
127.0.0.1 fvirgilio.it
127.0.0.1 www.fvirgilio.it
127.0.0.1 fwrrari.it
127.0.0.1 www.fwrrari.it
127.0.0.1 g0oogle.it
127.0.0.1 www.g0oogle.it
127.0.0.1 g9oogle.it
127.0.0.1 www.g9oogle.it
127.0.0.1 gaazzetta.it
127.0.0.1 www.gaazzetta.it
127.0.0.1 gaqzzetta.it
127.0.0.1 www.gaqzzetta.it
127.0.0.1 gaszzetta.it
127.0.0.1 www.gaszzetta.it
127.0.0.1 gaxzetta.it
127.0.0.1 www.gaxzetta.it
127.0.0.1 gaxzzetta.it
127.0.0.1 www.gaxzzetta.it
127.0.0.1 gazxetta.it
127.0.0.1 www.gazxetta.it
127.0.0.1 gazxzetta.it
127.0.0.1 www.gazxzetta.it
127.0.0.1 gazzaetta.it
127.0.0.1 www.gazzaetta.it
127.0.0.1 gazzdetta.it
127.0.0.1 www.gazzdetta.it
127.0.0.1 gazzedtta.it
127.0.0.1 www.gazzedtta.it
127.0.0.1 gazzeetta.it
127.0.0.1 www.gazzeetta.it
127.0.0.1 gazzeftta.it
127.0.0.1 www.gazzeftta.it
127.0.0.1 gazzegtta.it
127.0.0.1 www.gazzegtta.it
127.0.0.1 gazzehtta.it
127.0.0.1 www.gazzehtta.it
127.0.0.1 gazzerta.it
127.0.0.1 www.gazzerta.it
127.0.0.1 gazzertta.it
127.0.0.1 www.gazzertta.it
127.0.0.1 gazzestta.it
127.0.0.1 www.gazzestta.it
127.0.0.1 gazzetra.it
127.0.0.1 www.gazzetra.it
127.0.0.1 gazzettaa.it
127.0.0.1 www.gazzettaa.it
127.0.0.1 gazzettaq.it
127.0.0.1 www.gazzettaq.it
127.0.0.1 gazzettas.it
127.0.0.1 www.gazzettas.it
127.0.0.1 gazzettaz.it
127.0.0.1 www.gazzettaz.it
127.0.0.1 gazzettfa.it
127.0.0.1 www.gazzettfa.it
127.0.0.1 gazzettga.it
127.0.0.1 www.gazzettga.it
127.0.0.1 gazzettha.it
127.0.0.1 www.gazzettha.it
127.0.0.1 gazzett.it
127.0.0.1 www.gazzett.it
127.0.0.1 gazzettqa.it
127.0.0.1 www.gazzettqa.it
127.0.0.1 gazzettra.it
127.0.0.1 www.gazzettra.it
127.0.0.1 gazzettsa.it
127.0.0.1 www.gazzettsa.it
127.0.0.1 gazzetts.it
127.0.0.1 www.gazzetts.it
127.0.0.1 gazzettya.it
127.0.0.1 www.gazzettya.it
127.0.0.1 gazzettza.it
127.0.0.1 www.gazzettza.it
127.0.0.1 gazzetya.it
127.0.0.1 www.gazzetya.it
127.0.0.1 gazzetyta.it
127.0.0.1 www.gazzetyta.it
127.0.0.1 gazzeyta.it
127.0.0.1 www.gazzeyta.it
127.0.0.1 gazzeytta.it
127.0.0.1 www.gazzeytta.it
127.0.0.1 gazzfetta.it
127.0.0.1 www.gazzfetta.it
127.0.0.1 gazzretta.it
127.0.0.1 www.gazzretta.it
127.0.0.1 gazzrtta.it
127.0.0.1 www.gazzrtta.it
127.0.0.1 gazzsetta.it
127.0.0.1 www.gazzsetta.it
127.0.0.1 gazztta.it
127.0.0.1 www.gazztta.it
127.0.0.1 gazzwetta.it
127.0.0.1 www.gazzwetta.it
127.0.0.1 gazzwtta.it
127.0.0.1 www.gazzwtta.it
127.0.0.1 gazzxetta.it
127.0.0.1 www.gazzxetta.it
127.0.0.1 gbazzetta.it
127.0.0.1 www.gbazzetta.it
127.0.0.1 gboogle.it
127.0.0.1 www.gboogle.it
127.0.0.1 gerrari.it
127.0.0.1 www.gerrari.it
127.0.0.1 gfazzetta.it
127.0.0.1 www.gfazzetta.it
127.0.0.1 gfoogle.it
127.0.0.1 www.gfoogle.it
127.0.0.1 ggazzetta.it
127.0.0.1 www.ggazzetta.it
127.0.0.1 ghazzetta.it
127.0.0.1 www.ghazzetta.it
127.0.0.1 ghoogle.it
127.0.0.1 www.ghoogle.it
127.0.0.1 giogle.it
127.0.0.1 www.giogle.it
127.0.0.1 gioogle.it
127.0.0.1 www.gioogle.it
127.0.0.1 girgilio.it
127.0.0.1 www.girgilio.it
127.0.0.1 giscali.it
127.0.0.1 www.giscali.it
127.0.0.1 gkoogle.it
127.0.0.1 www.gkoogle.it
127.0.0.1 glogle.it
127.0.0.1 www.glogle.it
127.0.0.1 go0ogle.it
127.0.0.1 www.go0ogle.it
127.0.0.1 go9ogle.it
127.0.0.1 www.go9ogle.it
127.0.0.1 goigle.it
127.0.0.1 www.goigle.it
127.0.0.1 goiogle.it
127.0.0.1 www.goiogle.it
127.0.0.1 gokogle.it
127.0.0.1 www.gokogle.it
127.0.0.1 golgle.it
127.0.0.1 www.golgle.it
127.0.0.1 gologle.it
127.0.0.1 www.gologle.it
127.0.0.1 goo0gle.it
127.0.0.1 www.goo0gle.it
127.0.0.1 goo9gle.it
127.0.0.1 www.goo9gle.it
127.0.0.1 goobgle.it
127.0.0.1 www.goobgle.it
127.0.0.1 gooble.it
127.0.0.1 www.gooble.it
127.0.0.1 goofgle.it
127.0.0.1 www.goofgle.it
127.0.0.1 googble.it
127.0.0.1 www.googble.it
127.0.0.1 googel.it
127.0.0.1 www.googel.it
127.0.0.1 googfle.it
127.0.0.1 www.googfle.it
127.0.0.1 googhle.it
127.0.0.1 www.googhle.it
127.0.0.1 googkle.it
127.0.0.1 www.googkle.it
127.0.0.1 googl3e.it
127.0.0.1 www.googl3e.it
127.0.0.1 googl4e.it
127.0.0.1 www.googl4e.it
127.0.0.1 googlde.it
127.0.0.1 www.googlde.it
127.0.0.1 googld.it
127.0.0.1 www.googld.it
127.0.0.1 google3.it
127.0.0.1 www.google3.it
127.0.0.1 google4.it
127.0.0.1 www.google4.it
127.0.0.1 googled.it
127.0.0.1 www.googled.it
127.0.0.1 googlef.it
127.0.0.1 www.googlef.it
127.0.0.1 googler.it
127.0.0.1 www.googler.it
127.0.0.1 googles.it
127.0.0.1 www.googles.it
127.0.0.1 googlew.it
127.0.0.1 www.googlew.it
127.0.0.1 googlfe.it
127.0.0.1 www.googlfe.it
127.0.0.1 googlf.it
127.0.0.1 www.googlf.it
127.0.0.1 googlke.it
127.0.0.1 www.googlke.it
127.0.0.1 googloe.it
127.0.0.1 www.googloe.it
127.0.0.1 googlpe.it
127.0.0.1 www.googlpe.it
127.0.0.1 googlre.it
127.0.0.1 www.googlre.it
127.0.0.1 googlse.it
127.0.0.1 www.googlse.it
127.0.0.1 googlwe.it
127.0.0.1 www.googlwe.it
127.0.0.1 googole.it
127.0.0.1 www.googole.it
127.0.0.1 googple.it
127.0.0.1 www.googple.it
127.0.0.1 googtle.it
127.0.0.1 www.googtle.it
127.0.0.1 googvle.it
127.0.0.1 www.googvle.it
127.0.0.1 googyle.it
127.0.0.1 www.googyle.it
127.0.0.1 goohgle.it
127.0.0.1 www.goohgle.it
127.0.0.1 goohle.it
127.0.0.1 www.goohle.it
127.0.0.1 gooigle.it
127.0.0.1 www.gooigle.it
127.0.0.1 gookgle.it
127.0.0.1 www.gookgle.it
127.0.0.1 goopgle.it
127.0.0.1 www.goopgle.it
127.0.0.1 gootgle.it
127.0.0.1 www.gootgle.it
127.0.0.1 gootle.it
127.0.0.1 www.gootle.it
127.0.0.1 goovgle.it
127.0.0.1 www.goovgle.it
127.0.0.1 goovle.it
127.0.0.1 www.goovle.it
127.0.0.1 gooygle.it
127.0.0.1 www.gooygle.it
127.0.0.1 gopgle.it
127.0.0.1 www.gopgle.it
127.0.0.1 gopogle.it
127.0.0.1 www.gopogle.it
127.0.0.1 gpogle.it
127.0.0.1 www.gpogle.it
127.0.0.1 gpoogle.it
127.0.0.1 www.gpoogle.it
127.0.0.1 gqazzetta.it
127.0.0.1 www.gqazzetta.it
127.0.0.1 grepubblica.it
127.0.0.1 www.grepubblica.it
127.0.0.1 gsazzetta.it
127.0.0.1 www.gsazzetta.it
127.0.0.1 gszzetta.it
127.0.0.1 www.gszzetta.it
127.0.0.1 gtazzetta.it
127.0.0.1 www.gtazzetta.it
127.0.0.1 gtiscali.it
127.0.0.1 www.gtiscali.it
127.0.0.1 gtoogle.it
127.0.0.1 www.gtoogle.it
127.0.0.1 gtrenitalia.it
127.0.0.1 www.gtrenitalia.it
127.0.0.1 gtuttogratis.it
127.0.0.1 www.gtuttogratis.it
127.0.0.1 gvazzetta.it
127.0.0.1 www.gvazzetta.it
127.0.0.1 gvirgilio.it
127.0.0.1 www.gvirgilio.it
127.0.0.1 gvoogle.it
127.0.0.1 www.gvoogle.it
127.0.0.1 gyoogle.it
127.0.0.1 www.gyoogle.it
127.0.0.1 gzazzetta.it
127.0.0.1 www.gzazzetta.it
127.0.0.1 gzzetta.it
127.0.0.1 www.gzzetta.it
127.0.0.1 hazzetta.it
127.0.0.1 www.hazzetta.it
127.0.0.1 hgazzetta.it
127.0.0.1 www.hgazzetta.it
127.0.0.1 hgoogle.it
127.0.0.1 www.hgoogle.it
127.0.0.1 hiscali.it
127.0.0.1 www.hiscali.it
127.0.0.1 hoogle.it
127.0.0.1 www.hoogle.it
127.0.0.1 htiscali.it
127.0.0.1 www.htiscali.it
127.0.0.1 ikataweb.it
127.0.0.1 www.ikataweb.it
127.0.0.1 ilbero.it
127.0.0.1 www.ilbero.it
127.0.0.1 inibo.it
127.0.0.1 www.inibo.it
127.0.0.1 iscali.it
127.0.0.1 www.iscali.it
127.0.0.1 iunibo.it
127.0.0.1 www.iunibo.it
127.0.0.1 iunige.it
127.0.0.1 www.iunige.it
127.0.0.1 iunimi.it
127.0.0.1 www.iunimi.it
127.0.0.1 iunipd.it
127.0.0.1 www.iunipd.it
127.0.0.1 iunipg.it
127.0.0.1 www.iunipg.it
127.0.0.1 iunipv.it
127.0.0.1 www.iunipv.it
127.0.0.1 iunito.it
127.0.0.1 www.iunito.it
127.0.0.1 jkataweb.it
127.0.0.1 www.jkataweb.it
127.0.0.1 jmsn.it
127.0.0.1 www.jmsn.it
127.0.0.1 kaaweb.it
127.0.0.1 www.kaaweb.it
127.0.0.1 kaftaweb.it
127.0.0.1 www.kaftaweb.it
127.0.0.1 kagtaweb.it
127.0.0.1 www.kagtaweb.it
127.0.0.1 kahtaweb.it
127.0.0.1 www.kahtaweb.it
127.0.0.1 kaqtaweb.it
127.0.0.1 www.kaqtaweb.it
127.0.0.1 karaweb.it
127.0.0.1 www.karaweb.it
127.0.0.1 kartaweb.it
127.0.0.1 www.kartaweb.it
127.0.0.1 kastaweb.it
127.0.0.1 www.kastaweb.it
127.0.0.1 kataaweb.it
127.0.0.1 www.kataaweb.it
127.0.0.1 katadweb.it
127.0.0.1 www.katadweb.it
127.0.0.1 kataeb.it
127.0.0.1 www.kataeb.it
127.0.0.1 kataeeb.it
127.0.0.1 www.kataeeb.it
127.0.0.1 kataewb.it
127.0.0.1 www.kataewb.it
127.0.0.1 kataeweb.it
127.0.0.1 www.kataeweb.it
127.0.0.1 kataqeb.it
127.0.0.1 www.kataqeb.it
127.0.0.1 kataqweb.it
127.0.0.1 www.kataqweb.it
127.0.0.1 katasweb.it
127.0.0.1 www.katasweb.it
127.0.0.1 katawaeb.it
127.0.0.1 www.katawaeb.it
127.0.0.1 katawb.it
127.0.0.1 www.katawb.it
127.0.0.1 katawdeb.it
127.0.0.1 www.katawdeb.it
127.0.0.1 katawebb.it
127.0.0.1 www.katawebb.it
127.0.0.1 katawebg.it
127.0.0.1 www.katawebg.it
127.0.0.1 katawebh.it
127.0.0.1 www.katawebh.it
127.0.0.1 katawebn.it
127.0.0.1 www.katawebn.it
127.0.0.1 katawebv.it
127.0.0.1 www.katawebv.it
127.0.0.1 katawedb.it
127.0.0.1 www.katawedb.it
127.0.0.1 kataweeb.it
127.0.0.1 www.kataweeb.it
127.0.0.1 katawefb.it
127.0.0.1 www.katawefb.it
127.0.0.1 katawegb.it
127.0.0.1 www.katawegb.it
127.0.0.1 katawehb.it
127.0.0.1 www.katawehb.it
127.0.0.1 katawe.it
127.0.0.1 www.katawe.it
127.0.0.1 katawenb.it
127.0.0.1 www.katawenb.it
127.0.0.1 katawerb.it
127.0.0.1 www.katawerb.it
127.0.0.1 katawesb.it
127.0.0.1 www.katawesb.it
127.0.0.1 katawevb.it
127.0.0.1 www.katawevb.it
127.0.0.1 katawev.it
127.0.0.1 www.katawev.it
127.0.0.1 katawfeb.it
127.0.0.1 www.katawfeb.it
127.0.0.1 katawqeb.it
127.0.0.1 www.katawqeb.it
127.0.0.1 katawrb.it
127.0.0.1 www.katawrb.it
127.0.0.1 katawreb.it
127.0.0.1 www.katawreb.it
127.0.0.1 katawseb.it
127.0.0.1 www.katawseb.it
127.0.0.1 katawwb.it
127.0.0.1 www.katawwb.it
127.0.0.1 katawweb.it
127.0.0.1 www.katawweb.it
127.0.0.1 katazweb.it
127.0.0.1 www.katazweb.it
127.0.0.1 katfaweb.it
127.0.0.1 www.katfaweb.it
127.0.0.1 katgaweb.it
127.0.0.1 www.katgaweb.it
127.0.0.1 kathaweb.it
127.0.0.1 www.kathaweb.it
127.0.0.1 katqaweb.it
127.0.0.1 www.katqaweb.it
127.0.0.1 katraweb.it
127.0.0.1 www.katraweb.it
127.0.0.1 katsaweb.it
127.0.0.1 www.katsaweb.it
127.0.0.1 katsweb.it
127.0.0.1 www.katsweb.it
127.0.0.1 kattaweb.it
127.0.0.1 www.kattaweb.it
127.0.0.1 katweb.it
127.0.0.1 www.katweb.it
127.0.0.1 katzaweb.it
127.0.0.1 www.katzaweb.it
127.0.0.1 kayaweb.it
127.0.0.1 www.kayaweb.it
127.0.0.1 kaztaweb.it
127.0.0.1 www.kaztaweb.it
127.0.0.1 kiataweb.it
127.0.0.1 www.kiataweb.it
127.0.0.1 kibero.it
127.0.0.1 www.kibero.it
127.0.0.1 kjataweb.it
127.0.0.1 www.kjataweb.it
127.0.0.1 kkataweb.it
127.0.0.1 www.kkataweb.it
127.0.0.1 klataweb.it
127.0.0.1 www.klataweb.it
127.0.0.1 klibero.it
127.0.0.1 www.klibero.it
127.0.0.1 kmataweb.it
127.0.0.1 www.kmataweb.it
127.0.0.1 kmsn.it
127.0.0.1 www.kmsn.it
127.0.0.1 koataweb.it
127.0.0.1 www.koataweb.it
127.0.0.1 kqataweb.it
127.0.0.1 www.kqataweb.it
127.0.0.1 ksataweb.it
127.0.0.1 www.ksataweb.it
127.0.0.1 kstaweb.it
127.0.0.1 www.kstaweb.it
127.0.0.1 ktaweb.it
127.0.0.1 www.ktaweb.it
127.0.0.1 kzataweb.it
127.0.0.1 www.kzataweb.it
127.0.0.1 l8bero.it
127.0.0.1 www.l8bero.it
127.0.0.1 l8ibero.it
127.0.0.1 www.l8ibero.it
127.0.0.1 l9bero.it
127.0.0.1 www.l9bero.it
127.0.0.1 l9ibero.it
127.0.0.1 www.l9ibero.it
127.0.0.1 lbero.it
127.0.0.1 www.lbero.it
127.0.0.1 lbiero.it
127.0.0.1 www.lbiero.it
127.0.0.1 li8bero.it
127.0.0.1 www.li8bero.it
127.0.0.1 li9bero.it
127.0.0.1 www.li9bero.it
127.0.0.1 lib3ero.it
127.0.0.1 www.lib3ero.it
127.0.0.1 lib3ro.it
127.0.0.1 www.lib3ro.it
127.0.0.1 lib4ero.it
127.0.0.1 www.lib4ero.it
127.0.0.1 lib4ro.it
127.0.0.1 www.lib4ro.it
127.0.0.1 libdero.it
127.0.0.1 www.libdero.it
127.0.0.1 libe3ro.it
127.0.0.1 www.libe3ro.it
127.0.0.1 libdro.it
127.0.0.1 www.libdro.it
127.0.0.1 libe4o.it
127.0.0.1 www.libe4o.it
127.0.0.1 libe4ro.it
127.0.0.1 www.libe4ro.it
127.0.0.1 libe5o.it
127.0.0.1 www.libe5o.it
127.0.0.1 libe5ro.it
127.0.0.1 www.libe5ro.it
127.0.0.1 libedro.it
127.0.0.1 www.libedro.it
127.0.0.1 libeeo.it
127.0.0.1 www.libeeo.it
127.0.0.1 libeero.it
127.0.0.1 www.libeero.it
127.0.0.1 libefro.it
127.0.0.1 www.libefro.it
127.0.0.1 libegro.it
127.0.0.1 www.libegro.it
127.0.0.1 liber0.it
127.0.0.1 www.liber0.it
127.0.0.1 liber0o.it
127.0.0.1 www.liber0o.it
127.0.0.1 liber4o.it
127.0.0.1 www.liber4o.it
127.0.0.1 liber5o.it
127.0.0.1 www.liber5o.it
127.0.0.1 liber9.it
127.0.0.1 www.liber9.it
127.0.0.1 liberdo.it
127.0.0.1 www.liberdo.it
127.0.0.1 libereo.it
127.0.0.1 www.libereo.it
127.0.0.1 liberfo.it
127.0.0.1 www.liberfo.it
127.0.0.1 libergo.it
127.0.0.1 www.libergo.it
127.0.0.1 liberko.it
127.0.0.1 www.liberko.it
127.0.0.1 liberl.it
127.0.0.1 www.liberl.it
127.0.0.1 liberlo.it
127.0.0.1 www.liberlo.it
127.0.0.1 libero0.it
127.0.0.1 www.libero0.it
127.0.0.1 libero9.it
127.0.0.1 www.libero9.it
127.0.0.1 liberoi.it
127.0.0.1 www.liberoi.it
127.0.0.1 liberok.it
127.0.0.1 www.liberok.it
127.0.0.1 liberol.it
127.0.0.1 www.liberol.it
127.0.0.1 liberop.it
127.0.0.1 www.liberop.it
127.0.0.1 liberpo.it
127.0.0.1 www.liberpo.it
127.0.0.1 liberro.it
127.0.0.1 www.liberro.it
127.0.0.1 libesro.it
127.0.0.1 www.libesro.it
127.0.0.1 libetro.it
127.0.0.1 www.libetro.it
127.0.0.1 libewro.it
127.0.0.1 www.libewro.it
127.0.0.1 libfero.it
127.0.0.1 www.libfero.it
127.0.0.1 libfro.it
127.0.0.1 www.libfro.it
127.0.0.1 libgero.it
127.0.0.1 www.libgero.it
127.0.0.1 libhero.it
127.0.0.1 www.libhero.it
127.0.0.1 libnero.it
127.0.0.1 www.libnero.it
127.0.0.1 libreo.it
127.0.0.1 www.libreo.it
127.0.0.1 librero.it
127.0.0.1 www.librero.it
127.0.0.1 libsero.it
127.0.0.1 www.libsero.it
127.0.0.1 libsro.it
127.0.0.1 www.libsro.it
127.0.0.1 libvero.it
127.0.0.1 www.libvero.it
127.0.0.1 libwero.it
127.0.0.1 www.libwero.it
127.0.0.1 libwro.it
127.0.0.1 www.libwro.it
127.0.0.1 ligbero.it
127.0.0.1 www.ligbero.it
127.0.0.1 ligero.it
127.0.0.1 www.ligero.it
127.0.0.1 lihbero.it
127.0.0.1 www.lihbero.it
127.0.0.1 lihero.it
127.0.0.1 www.lihero.it
127.0.0.1 liibero.it
127.0.0.1 www.liibero.it
127.0.0.1 lijbero.it
127.0.0.1 www.lijbero.it
127.0.0.1 likbero.it
127.0.0.1 www.likbero.it
127.0.0.1 lilbero.it
127.0.0.1 www.lilbero.it
127.0.0.1 linbero.it
127.0.0.1 www.linbero.it
127.0.0.1 linero.it
127.0.0.1 www.linero.it
127.0.0.1 liobero.it
127.0.0.1 www.liobero.it
127.0.0.1 liubero.it
127.0.0.1 www.liubero.it
127.0.0.1 livbero.it
127.0.0.1 www.livbero.it
127.0.0.1 ljbero.it
127.0.0.1 www.ljbero.it
127.0.0.1 ljibero.it
127.0.0.1 www.ljibero.it
127.0.0.1 lkataweb.it
127.0.0.1 www.lkataweb.it
127.0.0.1 lkbero.it
127.0.0.1 www.lkbero.it
127.0.0.1 lkibero.it
127.0.0.1 www.lkibero.it
127.0.0.1 llibero.it
127.0.0.1 www.llibero.it
127.0.0.1 loibero.it
127.0.0.1 www.loibero.it
127.0.0.1 lpibero.it
127.0.0.1 www.lpibero.it
127.0.0.1 luibero.it
127.0.0.1 www.luibero.it
127.0.0.1 masn.it
127.0.0.1 www.masn.it
127.0.0.1 mesn.it
127.0.0.1 www.mesn.it
127.0.0.1 mjsn.it
127.0.0.1 www.mjsn.it
127.0.0.1 mkataweb.it
127.0.0.1 www.mkataweb.it
127.0.0.1 mksn.it
127.0.0.1 www.mksn.it
127.0.0.1 mnsn.it
127.0.0.1 www.mnsn.it
127.0.0.1 msan.it
127.0.0.1 www.msan.it
127.0.0.1 msbn.it
127.0.0.1 www.msbn.it
127.0.0.1 msen.it
127.0.0.1 www.msen.it
127.0.0.1 mshn.it
127.0.0.1 www.mshn.it
127.0.0.1 msjn.it
127.0.0.1 www.msjn.it
127.0.0.1 msmn.it
127.0.0.1 www.msmn.it
127.0.0.1 msnb.it
127.0.0.1 www.msnb.it
127.0.0.1 msnh.it
127.0.0.1 www.msnh.it
127.0.0.1 msnj.it
127.0.0.1 www.msnj.it
127.0.0.1 msnm.it
127.0.0.1 www.msnm.it
127.0.0.1 mssn.it
127.0.0.1 www.mssn.it
127.0.0.1 mswn.it
127.0.0.1 www.mswn.it
127.0.0.1 msxn.it
127.0.0.1 www.msxn.it
127.0.0.1 mszn.it
127.0.0.1 www.mszn.it
127.0.0.1 mwsn.it
127.0.0.1 www.mwsn.it
127.0.0.1 mxsn.it
127.0.0.1 www.mxsn.it
127.0.0.1 mzsn.it
127.0.0.1 www.mzsn.it
127.0.0.1 nibo.it
127.0.0.1 www.nibo.it
127.0.0.1 nige.it
127.0.0.1 www.nige.it
127.0.0.1 nipd.it
127.0.0.1 www.nipd.it
127.0.0.1 nipg.it
127.0.0.1 www.nipg.it
127.0.0.1 nmsn.it
127.0.0.1 www.nmsn.it
127.0.0.1 noogle.it
127.0.0.1 www.noogle.it
127.0.0.1 oaginebianche.it
127.0.0.1 www.oaginebianche.it
127.0.0.1 ogogle.it
127.0.0.1 www.ogogle.it
127.0.0.1 oibero.it
127.0.0.1 www.oibero.it
127.0.0.1 okataweb.it
127.0.0.1 www.okataweb.it
127.0.0.1 olibero.it
127.0.0.1 www.olibero.it
127.0.0.1 oogle.it
127.0.0.1 www.oogle.it
127.0.0.1 opaginebianche.it
127.0.0.1 www.opaginebianche.it
127.0.0.1 orriere.it
127.0.0.1 www.orriere.it
127.0.0.1 ossoalice.it
127.0.0.1 www.ossoalice.it
127.0.0.1 paaginebianche.it
127.0.0.1 www.paaginebianche.it
127.0.0.1 pafginebianche.it
127.0.0.1 www.pafginebianche.it
127.0.0.1 pafinebianche.it
127.0.0.1 www.pafinebianche.it
127.0.0.1 pafinegialle.it
127.0.0.1 www.pafinegialle.it
127.0.0.1 pagfinebianche.it
127.0.0.1 www.pagfinebianche.it
127.0.0.1 paghinebianche.it
127.0.0.1 www.paghinebianche.it
127.0.0.1 pagibegialle.it
127.0.0.1 www.pagibegialle.it
127.0.0.1 pagiegialle.it
127.0.0.1 www.pagiegialle.it
127.0.0.1 pagiinebianche.it
127.0.0.1 www.pagiinebianche.it
127.0.0.1 pagimebianche.it
127.0.0.1 www.pagimebianche.it
127.0.0.1 pagimegialle.it
127.0.0.1 www.pagimegialle.it
127.0.0.1 pagimnebianche.it
127.0.0.1 www.pagimnebianche.it
127.0.0.1 paginbianche.it
127.0.0.1 www.paginbianche.it
127.0.0.1 paginebbianche.it
127.0.0.1 www.paginebbianche.it
127.0.0.1 paginebiaanche.it
127.0.0.1 www.paginebiaanche.it
127.0.0.1 paginebiamche.it
127.0.0.1 www.paginebiamche.it
127.0.0.1 paginebiamnche.it
127.0.0.1 www.paginebiamnche.it
127.0.0.1 paginebiancche.it
127.0.0.1 www.paginebiancche.it
127.0.0.1 paginebiancge.it
127.0.0.1 www.paginebiancge.it
127.0.0.1 paginebiancghe.it
127.0.0.1 www.paginebiancghe.it
127.0.0.1 paginebianchee.it
127.0.0.1 www.paginebianchee.it
127.0.0.1 paginebiancher.it
127.0.0.1 www.paginebiancher.it
127.0.0.1 paginebianchew.it
127.0.0.1 www.paginebianchew.it
127.0.0.1 paginebianchge.it
127.0.0.1 www.paginebianchge.it
127.0.0.1 paginebianchhe.it
127.0.0.1 www.paginebianchhe.it
127.0.0.1 paginebianchre.it
127.0.0.1 www.paginebianchre.it
127.0.0.1 paginebianchr.it
127.0.0.1 www.paginebianchr.it
127.0.0.1 paginebianchwe.it
127.0.0.1 www.paginebianchwe.it
127.0.0.1 paginebiancjhe.it
127.0.0.1 www.paginebiancjhe.it
127.0.0.1 paginebiancvhe.it
127.0.0.1 www.paginebiancvhe.it
127.0.0.1 paginebiancxhe.it
127.0.0.1 www.paginebiancxhe.it
127.0.0.1 paginebianmche.it
127.0.0.1 www.paginebianmche.it
127.0.0.1 paginebiannche.it
127.0.0.1 www.paginebiannche.it
127.0.0.1 paginebianvche.it
127.0.0.1 www.paginebianvche.it
127.0.0.1 paginebianvhe.it
127.0.0.1 www.paginebianvhe.it
127.0.0.1 paginebianxche.it
127.0.0.1 paginebiasnche.it
127.0.0.1 www.paginebianxche.it
127.0.0.1 paginebiianche.it
127.0.0.1 www.paginebiianche.it
127.0.0.1 paginebioanche.it
127.0.0.1 www.paginebioanche.it
127.0.0.1 paginebisanche.it
127.0.0.1 www.paginebisanche.it
127.0.0.1 paginebiuanche.it
127.0.0.1 www.paginebiuanche.it
127.0.0.1 paginebnianche.it
127.0.0.1 www.paginebnianche.it
127.0.0.1 pagineboianche.it
127.0.0.1 www.pagineboianche.it
127.0.0.1 paginebuanche.it
127.0.0.1 www.paginebuanche.it
127.0.0.1 paginebuianche.it
127.0.0.1 www.paginebuianche.it
127.0.0.1 pagineebianche.it
127.0.0.1 www.pagineebianche.it
127.0.0.1 paginefialle.it
127.0.0.1 www.paginefialle.it
127.0.0.1 paginegalle.it
127.0.0.1 www.paginegalle.it
127.0.0.1 paginegiaklle.it
127.0.0.1 www.paginegiaklle.it
127.0.0.1 paginegialkle.it
127.0.0.1 www.paginegialkle.it
127.0.0.1 paginegiallee.it
127.0.0.1 www.paginegiallee.it
127.0.0.1 paginegialler.it
127.0.0.1 www.paginegialler.it
127.0.0.1 paginegiallew.it
127.0.0.1 www.paginegiallew.it
127.0.0.1 paginegiallw.it
127.0.0.1 www.paginegiallw.it
127.0.0.1 paginegille.it
127.0.0.1 www.paginegille.it
127.0.0.1 paginegoalle.it
127.0.0.1 www.paginegoalle.it
127.0.0.1 paginegualle.it
127.0.0.1 www.paginegualle.it
127.0.0.1 pagineialle.it
127.0.0.1 www.pagineialle.it
127.0.0.1 pagineianche.it
127.0.0.1 www.pagineianche.it
127.0.0.1 paginenianche.it
127.0.0.1 www.paginenianche.it
127.0.0.1 paginerbianche.it
127.0.0.1 www.paginerbianche.it
127.0.0.1 paginevbianche.it
127.0.0.1 www.paginevbianche.it
127.0.0.1 paginevianche.it
127.0.0.1 www.paginevianche.it
127.0.0.1 paginewbianche.it
127.0.0.1 www.paginewbianche.it
127.0.0.1 paginnebianche.it
127.0.0.1 www.paginnebianche.it
127.0.0.1 paginrbianche.it
127.0.0.1 www.paginrbianche.it
127.0.0.1 paginrebianche.it
127.0.0.1 www.paginrebianche.it
127.0.0.1 paginrgialle.it
127.0.0.1 www.paginrgialle.it
127.0.0.1 paginwebianche.it
127.0.0.1 www.paginwebianche.it
127.0.0.1 pagionebianche.it
127.0.0.1 www.pagionebianche.it
127.0.0.1 pagiunebianche.it
127.0.0.1 www.pagiunebianche.it
127.0.0.1 pagnebianche.it
127.0.0.1 www.pagnebianche.it
127.0.0.1 pagnegialle.it
127.0.0.1 www.pagnegialle.it
127.0.0.1 pagoinebianche.it
127.0.0.1 www.pagoinebianche.it
127.0.0.1 pagonebianche.it
127.0.0.1 www.pagonebianche.it
127.0.0.1 pagonegialle.it
127.0.0.1 www.pagonegialle.it
127.0.0.1 paguinebianche.it
127.0.0.1 www.paguinebianche.it
127.0.0.1 pagunegialle.it
127.0.0.1 www.pagunegialle.it
127.0.0.1 pahginebianche.it
127.0.0.1 www.pahginebianche.it
127.0.0.1 painegialle.it
127.0.0.1 www.painegialle.it
127.0.0.1 pasginebianche.it
127.0.0.1 www.pasginebianche.it
127.0.0.1 pginegialle.it
127.0.0.1 www.pginegialle.it
127.0.0.1 pibero.it
127.0.0.1 www.pibero.it
127.0.0.1 plibero.it
127.0.0.1 www.plibero.it
127.0.0.1 poaginebianche.it
127.0.0.1 www.poaginebianche.it
127.0.0.1 ppaginebianche.it
127.0.0.1 www.ppaginebianche.it
127.0.0.1 psaginebianche.it
127.0.0.1 www.psaginebianche.it
127.0.0.1 psginebianche.it
127.0.0.1 www.psginebianche.it
127.0.0.1 psginegialle.it
127.0.0.1 www.psginegialle.it
127.0.0.1 qalitalia.it
127.0.0.1 www.qalitalia.it
127.0.0.1 rbay.it
127.0.0.1 www.rbay.it
127.0.0.1 rdepubblica.it
127.0.0.1 www.rdepubblica.it
127.0.0.1 rebay.it
127.0.0.1 www.rebay.it
127.0.0.1 redpubblica.it
127.0.0.1 www.redpubblica.it
127.0.0.1 reepubblica.it
127.0.0.1 www.reepubblica.it
127.0.0.1 refpubblica.it
127.0.0.1 www.refpubblica.it
127.0.0.1 relpubblica.it
127.0.0.1 www.relpubblica.it
127.0.0.1 reopubblica.it
127.0.0.1 www.reopubblica.it
127.0.0.1 reossoalice.it
127.0.0.1 www.reossoalice.it
127.0.0.1 reoubblica.it
127.0.0.1 www.reoubblica.it
127.0.0.1 repbblica.it
127.0.0.1 www.repbblica.it
127.0.0.1 rephubblica.it
127.0.0.1 www.rephubblica.it
127.0.0.1 repibblica.it
127.0.0.1 www.repibblica.it
127.0.0.1 repiubblica.it
127.0.0.1 www.repiubblica.it
127.0.0.1 replubblica.it
127.0.0.1 www.replubblica.it
127.0.0.1 repoubblica.it
127.0.0.1 www.repoubblica.it
127.0.0.1 repubbglica.it
127.0.0.1 www.repubbglica.it
127.0.0.1 repubbhlica.it
127.0.0.1 www.repubbhlica.it
127.0.0.1 repubbkica.it
127.0.0.1 www.repubbkica.it
127.0.0.1 repubbklica.it
127.0.0.1 www.repubbklica.it
127.0.0.1 repubblicaa.it
127.0.0.1 www.repubblicaa.it
127.0.0.1 repubblicaq.it
127.0.0.1 www.repubblicaq.it
127.0.0.1 repubblicas.it
127.0.0.1 www.repubblicas.it
127.0.0.1 repubblicca.it
127.0.0.1 www.repubblicca.it
127.0.0.1 repubblicda.it
127.0.0.1 www.repubblicda.it
127.0.0.1 repubblicfa.it
127.0.0.1 www.repubblicfa.it
127.0.0.1 repubblicsa.it
127.0.0.1 www.repubblicsa.it
127.0.0.1 repubblics.it
127.0.0.1 www.repubblics.it
127.0.0.1 repubblicva.it
127.0.0.1 www.repubblicva.it
127.0.0.1 repubblicza.it
127.0.0.1 www.repubblicza.it
127.0.0.1 repubblidca.it
127.0.0.1 www.repubblidca.it
127.0.0.1 repubblifca.it
127.0.0.1 www.repubblifca.it
127.0.0.1 repubbliica.it
127.0.0.1 www.repubbliica.it
127.0.0.1 repubblilca.it
127.0.0.1 www.repubblilca.it
127.0.0.1 repubblioca.it
127.0.0.1 www.repubblioca.it
127.0.0.1 repubbliuca.it
127.0.0.1 www.repubbliuca.it
127.0.0.1 repubbliva.it
127.0.0.1 www.repubbliva.it
127.0.0.1 repubblivca.it
127.0.0.1 www.repubblivca.it
127.0.0.1 repubblixa.it
127.0.0.1 www.repubblixa.it
127.0.0.1 repubblixca.it
127.0.0.1 www.repubblixca.it
127.0.0.1 repubbllica.it
127.0.0.1 www.repubbllica.it
127.0.0.1 repubbloca.it
127.0.0.1 www.repubbloca.it
127.0.0.1 repubbloica.it
127.0.0.1 www.repubbloica.it
127.0.0.1 repubblpica.it
127.0.0.1 www.repubblpica.it
127.0.0.1 repubbluica.it
127.0.0.1 www.repubbluica.it
127.0.0.1 repubbnlica.it
127.0.0.1 www.repubbnlica.it
127.0.0.1 repubbolica.it
127.0.0.1 www.repubbolica.it
127.0.0.1 repubbplica.it
127.0.0.1 www.repubbplica.it
127.0.0.1 repubbvlica.it
127.0.0.1 www.repubbvlica.it
127.0.0.1 repubnblica.it
127.0.0.1 www.repubnblica.it
127.0.0.1 repubnlica.it
127.0.0.1 www.repubnlica.it
127.0.0.1 repubvblica.it
127.0.0.1 www.repubvblica.it
127.0.0.1 repubvlica.it
127.0.0.1 www.repubvlica.it
127.0.0.1 repugbblica.it
127.0.0.1 www.repugbblica.it
127.0.0.1 repuhbblica.it
127.0.0.1 www.repuhbblica.it
127.0.0.1 repuibblica.it
127.0.0.1 www.repuibblica.it
127.0.0.1 repunbblica.it
127.0.0.1 www.repunbblica.it
127.0.0.1 repunblica.it
127.0.0.1 www.repunblica.it
127.0.0.1 repuubblica.it
127.0.0.1 www.repuubblica.it
127.0.0.1 repuvbblica.it
127.0.0.1 www.repuvbblica.it
127.0.0.1 repuvblica.it
127.0.0.1 www.repuvblica.it
127.0.0.1 repybblica.it
127.0.0.1 www.repybblica.it
127.0.0.1 repyubblica.it
127.0.0.1 www.repyubblica.it
127.0.0.1 rerpubblica.it
127.0.0.1 www.rerpubblica.it
127.0.0.1 reubblica.it
127.0.0.1 www.reubblica.it
127.0.0.1 rewpubblica.it
127.0.0.1 www.rewpubblica.it
127.0.0.1 rfepubblica.it
127.0.0.1 www.rfepubblica.it
127.0.0.1 rgepubblica.it
127.0.0.1 www.rgepubblica.it
127.0.0.1 riscali.it
127.0.0.1 www.riscali.it
127.0.0.1 roassoalice.it
127.0.0.1 www.roassoalice.it
127.0.0.1 roissoalice.it
127.0.0.1 www.roissoalice.it
127.0.0.1 roogle.it
127.0.0.1 www.roogle.it
127.0.0.1 roossoalice.it
127.0.0.1 www.roossoalice.it
127.0.0.1 ropssoalice.it
127.0.0.1 www.ropssoalice.it
127.0.0.1 rosaoalice.it
127.0.0.1 www.rosaoalice.it
127.0.0.1 rosasoalice.it
127.0.0.1 www.rosasoalice.it
127.0.0.1 rossaoalice.it
127.0.0.1 www.rossaoalice.it
127.0.0.1 rossdoalice.it
127.0.0.1 www.rossdoalice.it
127.0.0.1 rossoaalice.it
127.0.0.1 www.rossoaalice.it
127.0.0.1 rossoaice.it
127.0.0.1 www.rossoaice.it
127.0.0.1 rossoalce.it
127.0.0.1 www.rossoalce.it
127.0.0.1 rossoalicce.it
127.0.0.1 www.rossoalicce.it
127.0.0.1 rossoalicee.it
127.0.0.1 www.rossoalicee.it
127.0.0.1 rossoalicer.it
127.0.0.1 www.rossoalicer.it
127.0.0.1 rossoalicew.it
127.0.0.1 www.rossoalicew.it
127.0.0.1 rossoalic.it
127.0.0.1 www.rossoalic.it
127.0.0.1 rossoalicre.it
127.0.0.1 www.rossoalicre.it
127.0.0.1 rossoalicr.it
127.0.0.1 www.rossoalicr.it
127.0.0.1 rossoalicve.it
127.0.0.1 www.rossoalicve.it
127.0.0.1 rossoalicwe.it
127.0.0.1 www.rossoalicwe.it
127.0.0.1 rossoalicw.it
127.0.0.1 www.rossoalicw.it
127.0.0.1 rossoalicxe.it
127.0.0.1 www.rossoalicxe.it
127.0.0.1 rossoalie.it
127.0.0.1 www.rossoalie.it
127.0.0.1 rossoaliice.it
127.0.0.1 www.rossoaliice.it
127.0.0.1 rossoalioce.it
127.0.0.1 www.rossoalioce.it
127.0.0.1 rossoalivce.it
127.0.0.1 www.rossoalivce.it
127.0.0.1 rossoalive.it
127.0.0.1 www.rossoalive.it
127.0.0.1 rossoalixce.it
127.0.0.1 www.rossoalixce.it
127.0.0.1 rossoalixe.it
127.0.0.1 www.rossoalixe.it
127.0.0.1 rossoalkice.it
127.0.0.1 www.rossoalkice.it
127.0.0.1 rossoallice.it
127.0.0.1 www.rossoallice.it
127.0.0.1 rossoaloce.it
127.0.0.1 www.rossoaloce.it
127.0.0.1 rossoaloice.it
127.0.0.1 www.rossoaloice.it
127.0.0.1 rossoaluce.it
127.0.0.1 www.rossoaluce.it
127.0.0.1 rossoaslice.it
127.0.0.1 www.rossoaslice.it
127.0.0.1 rossolice.it
127.0.0.1 www.rossolice.it
127.0.0.1 rossooalice.it
127.0.0.1 www.rossooalice.it
127.0.0.1 rossopalice.it
127.0.0.1 www.rossopalice.it
127.0.0.1 rossosalice.it
127.0.0.1 www.rossosalice.it
127.0.0.1 rosspalice.it
127.0.0.1 www.rosspalice.it
127.0.0.1 rosspoalice.it
127.0.0.1 www.rosspoalice.it
127.0.0.1 rosssoalice.it
127.0.0.1 www.rosssoalice.it
127.0.0.1 rrenitalia.it
127.0.0.1 www.rrenitalia.it
127.0.0.1 rrepubblica.it
127.0.0.1 www.rrepubblica.it
127.0.0.1 rrossoalice.it
127.0.0.1 www.rrossoalice.it
127.0.0.1 rrpubblica.it
127.0.0.1 www.rrpubblica.it
127.0.0.1 rsepubblica.it
127.0.0.1 www.rsepubblica.it
127.0.0.1 rssoalice.it
127.0.0.1 www.rssoalice.it
127.0.0.1 rtepubblica.it
127.0.0.1 www.rtepubblica.it
127.0.0.1 rtiscali.it
127.0.0.1 www.rtiscali.it
127.0.0.1 rtossoalice.it
127.0.0.1 www.rtossoalice.it
127.0.0.1 rtrenitalia.it
127.0.0.1 www.rtrenitalia.it
127.0.0.1 rtuttogratis.it
127.0.0.1 www.rtuttogratis.it
127.0.0.1 rwepubblica.it
127.0.0.1 www.rwepubblica.it
127.0.0.1 salitalia.it
127.0.0.1 www.salitalia.it
127.0.0.1 saupereva.it
127.0.0.1 www.saupereva.it
127.0.0.1 sdupereva.it
127.0.0.1 www.sdupereva.it
127.0.0.1 sebay.it
127.0.0.1 www.sebay.it
127.0.0.1 sipereva.it
127.0.0.1 www.sipereva.it
127.0.0.1 siupereva.it
127.0.0.1 www.siupereva.it
127.0.0.1 spereva.it
127.0.0.1 www.spereva.it
127.0.0.1 suereva.it
127.0.0.1 www.suereva.it
127.0.0.1 suipereva.it
127.0.0.1 www.suipereva.it
127.0.0.1 suoereva.it
127.0.0.1 www.suoereva.it
127.0.0.1 suopereva.it
127.0.0.1 www.suopereva.it
127.0.0.1 supeereva.it
127.0.0.1 www.supeereva.it
127.0.0.1 supeeva.it
127.0.0.1 www.supeeva.it
127.0.0.1 superea.it
127.0.0.1 www.superea.it
127.0.0.1 supereba.it
127.0.0.1 www.supereba.it
127.0.0.1 superebva.it
127.0.0.1 www.superebva.it
127.0.0.1 superecva.it
127.0.0.1 www.superecva.it
127.0.0.1 supereeva.it
127.0.0.1 www.supereeva.it
127.0.0.1 supererva.it
127.0.0.1 www.supererva.it
127.0.0.1 superevaq.it
127.0.0.1 www.superevaq.it
127.0.0.1 superevaw.it
127.0.0.1 www.superevaw.it
127.0.0.1 superevaz.it
127.0.0.1 www.superevaz.it
127.0.0.1 superevba.it
127.0.0.1 www.superevba.it
127.0.0.1 superevca.it
127.0.0.1 www.superevca.it
127.0.0.1 superev.it
127.0.0.1 www.superev.it
127.0.0.1 superevsa.it
127.0.0.1 www.superevsa.it
127.0.0.1 superevva.it
127.0.0.1 www.superevva.it
127.0.0.1 superevw.it
127.0.0.1 www.superevw.it
127.0.0.1 superevz.it
127.0.0.1 www.superevz.it
127.0.0.1 superewva.it
127.0.0.1 www.superewva.it
127.0.0.1 superreva.it
127.0.0.1 www.superreva.it
127.0.0.1 superteva.it
127.0.0.1 www.superteva.it
127.0.0.1 superweva.it
127.0.0.1 www.superweva.it
127.0.0.1 superwva.it
127.0.0.1 www.superwva.it
127.0.0.1 supeteva.it
127.0.0.1 www.supeteva.it
127.0.0.1 supetreva.it
127.0.0.1 www.supetreva.it
127.0.0.1 supewreva.it
127.0.0.1 www.supewreva.it
127.0.0.1 supoereva.it
127.0.0.1 www.supoereva.it
127.0.0.1 suppereva.it
127.0.0.1 www.suppereva.it
127.0.0.1 suprereva.it
127.0.0.1 www.suprereva.it
127.0.0.1 supreva.it
127.0.0.1 www.supreva.it
127.0.0.1 supwereva.it
127.0.0.1 www.supwereva.it
127.0.0.1 supwreva.it
127.0.0.1 www.supwreva.it
127.0.0.1 suupereva.it
127.0.0.1 www.suupereva.it
127.0.0.1 suypereva.it
127.0.0.1 www.suypereva.it
127.0.0.1 sypereva.it
127.0.0.1 www.sypereva.it
127.0.0.1 syupereva.it
127.0.0.1 www.syupereva.it
127.0.0.1 t8iscali.it
127.0.0.1 www.t8iscali.it
127.0.0.1 t9iscali.it
127.0.0.1 www.t9iscali.it
127.0.0.1 tepubblica.it
127.0.0.1 www.tepubblica.it
127.0.0.1 tfiscali.it
127.0.0.1 www.tfiscali.it
127.0.0.1 tgazzetta.it
127.0.0.1 www.tgazzetta.it
127.0.0.1 tgiscali.it
127.0.0.1 www.tgiscali.it
127.0.0.1 tgoogle.it
127.0.0.1 www.tgoogle.it
127.0.0.1 thiscali.it
127.0.0.1 www.thiscali.it
127.0.0.1 ti8scali.it
127.0.0.1 www.ti8scali.it
127.0.0.1 ti9scali.it
127.0.0.1 www.ti9scali.it
127.0.0.1 tiacali.it
127.0.0.1 www.tiacali.it
127.0.0.1 tiascali.it
127.0.0.1 www.tiascali.it
127.0.0.1 ticali.it
127.0.0.1 www.ticali.it
127.0.0.1 tidcali.it
127.0.0.1 www.tidcali.it
127.0.0.1 tidscali.it
127.0.0.1 www.tidscali.it
127.0.0.1 tiiscali.it
127.0.0.1 www.tiiscali.it
127.0.0.1 tijscali.it
127.0.0.1 www.tijscali.it
127.0.0.1 tikscali.it
127.0.0.1 www.tikscali.it
127.0.0.1 tilscali.it
127.0.0.1 www.tilscali.it
127.0.0.1 tioscali.it
127.0.0.1 www.tioscali.it
127.0.0.1 tisacali.it
127.0.0.1 www.tisacali.it
127.0.0.1 tisacli.it
127.0.0.1 www.tisacli.it
127.0.0.1 tiscaali.it
127.0.0.1 www.tiscaali.it
127.0.0.1 tiscail.it
127.0.0.1 www.tiscail.it
127.0.0.1 tiscaki.it
127.0.0.1 www.tiscaki.it
127.0.0.1 tiscakli.it
127.0.0.1 www.tiscakli.it
127.0.0.1 tiscal8.it
127.0.0.1 www.tiscal8.it
127.0.0.1 tiscal9.it
127.0.0.1 www.tiscal9.it
127.0.0.1 tiscalii.it
127.0.0.1 www.tiscalii.it
127.0.0.1 tiscalij.it
127.0.0.1 www.tiscalij.it
127.0.0.1 tiscalik.it
127.0.0.1 www.tiscalik.it
127.0.0.1 tiscalil.it
127.0.0.1 www.tiscalil.it
127.0.0.1 tiscaliu.it
127.0.0.1 www.tiscaliu.it
127.0.0.1 tiscalji.it
127.0.0.1 www.tiscalji.it
127.0.0.1 tiscalki.it
127.0.0.1 www.tiscalki.it
127.0.0.1 tiscalk.it
127.0.0.1 www.tiscalk.it
127.0.0.1 tiscalli.it
127.0.0.1 www.tiscalli.it
127.0.0.1 tiscaloi.it
127.0.0.1 www.tiscaloi.it
127.0.0.1 tiscalo.it
127.0.0.1 www.tiscalo.it
127.0.0.1 tiscalui.it
127.0.0.1 www.tiscalui.it
127.0.0.1 tiscaoi.it
127.0.0.1 www.tiscaoi.it
127.0.0.1 tiscaoli.it
127.0.0.1 www.tiscaoli.it
127.0.0.1 tiscaqli.it
127.0.0.1 www.tiscaqli.it
127.0.0.1 tiscasli.it
127.0.0.1 www.tiscasli.it
127.0.0.1 tiscawli.it
127.0.0.1 www.tiscawli.it
127.0.0.1 tiscaxli.it
127.0.0.1 www.tiscaxli.it
127.0.0.1 tiscazli.it
127.0.0.1 www.tiscazli.it
127.0.0.1 tiscdali.it
127.0.0.1 www.tiscdali.it
127.0.0.1 tiscfali.it
127.0.0.1 www.tiscfali.it
127.0.0.1 tisclai.it
127.0.0.1 www.tisclai.it
127.0.0.1 tiscli.it
127.0.0.1 www.tiscli.it
127.0.0.1 tiscqali.it
127.0.0.1 www.tiscqali.it
127.0.0.1 tiscqli.it
127.0.0.1 www.tiscqli.it
127.0.0.1 tiscsali.it
127.0.0.1 www.tiscsali.it
127.0.0.1 tiscsli.it
127.0.0.1 www.tiscsli.it
127.0.0.1 tiscvali.it
127.0.0.1 www.tiscvali.it
127.0.0.1 tiscwali.it
127.0.0.1 www.tiscwali.it
127.0.0.1 tiscxali.it
127.0.0.1 www.tiscxali.it
127.0.0.1 tisczali.it
127.0.0.1 www.tisczali.it
127.0.0.1 tisczli.it
127.0.0.1 www.tisczli.it
127.0.0.1 tisdcali.it
127.0.0.1 www.tisdcali.it
127.0.0.1 tisecali.it
127.0.0.1 www.tisecali.it
127.0.0.1 tisfcali.it
127.0.0.1 www.tisfcali.it
127.0.0.1 tisscali.it
127.0.0.1 www.tisscali.it
127.0.0.1 tisvcali.it
127.0.0.1 www.tisvcali.it
127.0.0.1 tiswcali.it
127.0.0.1 www.tiswcali.it
127.0.0.1 tisxali.it
127.0.0.1 www.tisxali.it
127.0.0.1 tisxcali.it
127.0.0.1 www.tisxcali.it
127.0.0.1 tiuscali.it
127.0.0.1 www.tiuscali.it
127.0.0.1 tiwcali.it
127.0.0.1 www.tiwcali.it
127.0.0.1 tiwscali.it
127.0.0.1 www.tiwscali.it
127.0.0.1 tixcali.it
127.0.0.1 www.tixcali.it
127.0.0.1 tixscali.it
127.0.0.1 www.tixscali.it
127.0.0.1 tizscali.it
127.0.0.1 www.tizscali.it
127.0.0.1 tjiscali.it
127.0.0.1 www.tjiscali.it
127.0.0.1 tkiscali.it
127.0.0.1 www.tkiscali.it
127.0.0.1 tliscali.it
127.0.0.1 www.tliscali.it
127.0.0.1 toiscali.it
127.0.0.1 www.toiscali.it
127.0.0.1 toogle.it
127.0.0.1 www.toogle.it
127.0.0.1 toscali.it
127.0.0.1 www.toscali.it
127.0.0.1 tossoalice.it
127.0.0.1 www.tossoalice.it
127.0.0.1 trebitalia.it
127.0.0.1 www.trebitalia.it
127.0.0.1 treenitalia.it
127.0.0.1 www.treenitalia.it
127.0.0.1 treitalia.it
127.0.0.1 www.treitalia.it
127.0.0.1 tremnitalia.it
127.0.0.1 www.tremnitalia.it
127.0.0.1 treniralia.it
127.0.0.1 www.treniralia.it
127.0.0.1 trenitaalia.it
127.0.0.1 www.trenitaalia.it
127.0.0.1 trenitaia.it
127.0.0.1 www.trenitaia.it
127.0.0.1 trenitakia.it
127.0.0.1 www.trenitakia.it
127.0.0.1 trenitaliaa.it
127.0.0.1 www.trenitaliaa.it
127.0.0.1 trenitaliaq.it
127.0.0.1 www.trenitaliaq.it
127.0.0.1 trenitalias.it
127.0.0.1 www.trenitalias.it
127.0.0.1 trenitaliaz.it
127.0.0.1 www.trenitaliaz.it
127.0.0.1 trenitaliia.it
127.0.0.1 www.trenitaliia.it
127.0.0.1 trenitalisa.it
127.0.0.1 www.trenitalisa.it
127.0.0.1 trenitalis.it
127.0.0.1 www.trenitalis.it
127.0.0.1 trenitallia.it
127.0.0.1 www.trenitallia.it
127.0.0.1 trenitaloa.it
127.0.0.1 www.trenitaloa.it
127.0.0.1 trenitalua.it
127.0.0.1 www.trenitalua.it
127.0.0.1 trenitralia.it
127.0.0.1 www.trenitralia.it
127.0.0.1 trenitslia.it
127.0.0.1 www.trenitslia.it
127.0.0.1 trenittalia.it
127.0.0.1 www.trenittalia.it
127.0.0.1 treniutalia.it
127.0.0.1 www.treniutalia.it
127.0.0.1 treniyalia.it
127.0.0.1 www.treniyalia.it
127.0.0.1 trenmitalia.it
127.0.0.1 www.trenmitalia.it
127.0.0.1 trennitalia.it
127.0.0.1 www.trennitalia.it
127.0.0.1 trenotalia.it
127.0.0.1 www.trenotalia.it
127.0.0.1 trentalia.it
127.0.0.1 www.trentalia.it
127.0.0.1 trenutalia.it
127.0.0.1 www.trenutalia.it
127.0.0.1 trepubblica.it
127.0.0.1 www.trepubblica.it
127.0.0.1 trernitalia.it
127.0.0.1 www.trernitalia.it
127.0.0.1 trewnitalia.it
127.0.0.1 www.trewnitalia.it
127.0.0.1 triscali.it
127.0.0.1 www.triscali.it
127.0.0.1 trossoalice.it
127.0.0.1 www.trossoalice.it
127.0.0.1 trrenitalia.it
127.0.0.1 www.trrenitalia.it
127.0.0.1 trtenitalia.it
127.0.0.1 www.trtenitalia.it
127.0.0.1 truttogratis.it
127.0.0.1 www.truttogratis.it
127.0.0.1 tscali.it
127.0.0.1 www.tscali.it
127.0.0.1 ttiscali.it
127.0.0.1 www.ttiscali.it
127.0.0.1 ttrenitalia.it
127.0.0.1 www.ttrenitalia.it
127.0.0.1 tttogratis.it
127.0.0.1 www.tttogratis.it
127.0.0.1 ttuttogratis.it
127.0.0.1 www.ttuttogratis.it
127.0.0.1 tuiscali.it
127.0.0.1 www.tuiscali.it
127.0.0.1 turtogratis.it
127.0.0.1 www.turtogratis.it
127.0.0.1 tutogratis.it
127.0.0.1 www.tutogratis.it
127.0.0.1 tutrogratis.it
127.0.0.1 www.tutrogratis.it
127.0.0.1 tuttgratis.it
127.0.0.1 www.tuttgratis.it
127.0.0.1 tuttofratis.it
127.0.0.1 www.tuttofratis.it
127.0.0.1 tuttogeratis.it
127.0.0.1 www.tuttogeratis.it
127.0.0.1 tuttograatis.it
127.0.0.1 www.tuttograatis.it
127.0.0.1 tuttograis.it
127.0.0.1 www.tuttograis.it
127.0.0.1 tuttograris.it
127.0.0.1 www.tuttograris.it
127.0.0.1 tuttogratia.it
127.0.0.1 www.tuttogratia.it
127.0.0.1 tuttogratias.it
127.0.0.1 www.tuttogratias.it
127.0.0.1 tuttogratiis.it
127.0.0.1 www.tuttogratiis.it
127.0.0.1 tuttograti.it
127.0.0.1 www.tuttograti.it
127.0.0.1 tuttogratisa.it
127.0.0.1 www.tuttogratisa.it
127.0.0.1 tuttogratiss.it
127.0.0.1 www.tuttogratiss.it
127.0.0.1 tuttogratos.it
127.0.0.1 www.tuttogratos.it
127.0.0.1 tuttograts.it
127.0.0.1 www.tuttograts.it
127.0.0.1 tuttograttis.it
127.0.0.1 www.tuttograttis.it
127.0.0.1 tuttogratus.it
127.0.0.1 www.tuttogratus.it
127.0.0.1 tuttograyis.it
127.0.0.1 www.tuttograyis.it
127.0.0.1 tuttogrratis.it
127.0.0.1 www.tuttogrratis.it
127.0.0.1 tuttogrstis.it
127.0.0.1 www.tuttogrstis.it
127.0.0.1 www.tuttogrtatis.it
127.0.0.1 tuttogrtatis.it
127.0.0.1 www.tuttogtratis.it
127.0.0.1 tuttohratis.it
127.0.0.1 www.tuttohratis.it
127.0.0.1 tuttoigratis.it
127.0.0.1 www.tuttoigratis.it
127.0.0.1 tuttoogratis.it
127.0.0.1 www.tuttoogratis.it
127.0.0.1 tuttopgratis.it
127.0.0.1 www.tuttopgratis.it
127.0.0.1 tuttoratis.it
127.0.0.1 www.tuttoratis.it
127.0.0.1 tuttpgratis.it
127.0.0.1 www.tuttpgratis.it
127.0.0.1 tutttogratis.it
127.0.0.1 www.tutttogratis.it
127.0.0.1 tuttyogratis.it
127.0.0.1 www.tuttyogratis.it
127.0.0.1 tutyogratis.it
127.0.0.1 www.tutyogratis.it
127.0.0.1 tutytogratis.it
127.0.0.1 www.tutytogratis.it
127.0.0.1 tuuttogratis.it
127.0.0.1 www.tuuttogratis.it
127.0.0.1 tuytogratis.it
127.0.0.1 www.tuytogratis.it
127.0.0.1 tyiscali.it
127.0.0.1 www.tyiscali.it
127.0.0.1 tyttogratis.it
127.0.0.1 www.tyttogratis.it
127.0.0.1 uibo.it
127.0.0.1 www.uibo.it
127.0.0.1 uige.it
127.0.0.1 www.uige.it
127.0.0.1 uimi.it
127.0.0.1 www.uimi.it
127.0.0.1 uinimi.it
127.0.0.1 www.uinimi.it
127.0.0.1 uipd.it
127.0.0.1 www.uipd.it
127.0.0.1 uipg.it
127.0.0.1 www.uipg.it
127.0.0.1 uito.it
127.0.0.1 www.uito.it
127.0.0.1 umibo.it
127.0.0.1 www.umibo.it
127.0.0.1 umige.it
127.0.0.1 www.umige.it
127.0.0.1 umimi.it
127.0.0.1 www.umimi.it
127.0.0.1 umipd.it
127.0.0.1 www.umipd.it
127.0.0.1 umipv.it
127.0.0.1 www.umipv.it
127.0.0.1 umnibo.it
127.0.0.1 www.umnibo.it
127.0.0.1 unbo.it
127.0.0.1 www.unbo.it
127.0.0.1 unge.it
127.0.0.1 www.unge.it
127.0.0.1 unibno.it
127.0.0.1 www.unibno.it
127.0.0.1 unie.it
127.0.0.1 www.unie.it
127.0.0.1 unig.it
127.0.0.1 www.unig.it
127.0.0.1 unii.it
127.0.0.1 www.unii.it
127.0.0.1 unini.it
127.0.0.1 www.unini.it
127.0.0.1 univo.it
127.0.0.1 www.univo.it
127.0.0.1 unmibo.it
127.0.0.1 www.unmibo.it
127.0.0.1 unmi.it
127.0.0.1 www.unmi.it
127.0.0.1 unobo.it
127.0.0.1 www.unobo.it
127.0.0.1 unpd.it
127.0.0.1 www.unpd.it
127.0.0.1 unpg.it
127.0.0.1 www.unpg.it
127.0.0.1 unto.it
127.0.0.1 www.unto.it
127.0.0.1 unubo.it
127.0.0.1 www.unubo.it
127.0.0.1 upereva.it
127.0.0.1 www.upereva.it
127.0.0.1 v8irgilio.it
127.0.0.1 www.v8irgilio.it
127.0.0.1 v8rgilio.it
127.0.0.1 www.v8rgilio.it
127.0.0.1 v9irgilio.it
127.0.0.1 www.v9irgilio.it
127.0.0.1 v9rgilio.it
127.0.0.1 www.v9rgilio.it
127.0.0.1 vbirgilio.it
127.0.0.1 www.vbirgilio.it
127.0.0.1 vcirgilio.it
127.0.0.1 www.vcirgilio.it
127.0.0.1 vcorriere.it
127.0.0.1 www.vcorriere.it
127.0.0.1 vfirgilio.it
127.0.0.1 www.vfirgilio.it
127.0.0.1 vgazzetta.it
127.0.0.1 www.vgazzetta.it
127.0.0.1 vgirgilio.it
127.0.0.1 www.vgirgilio.it
127.0.0.1 vgoogle.it
127.0.0.1 www.vgoogle.it
127.0.0.1 vi4gilio.it
127.0.0.1 www.vi4gilio.it
127.0.0.1 vi4rgilio.it
127.0.0.1 www.vi4rgilio.it
127.0.0.1 vi5gilio.it
127.0.0.1 www.vi5gilio.it
127.0.0.1 vi5rgilio.it
127.0.0.1 www.vi5rgilio.it
127.0.0.1 vi8rgilio.it
127.0.0.1 www.vi8rgilio.it
127.0.0.1 vi9rgilio.it
127.0.0.1 www.vi9rgilio.it
127.0.0.1 vidrgilio.it
127.0.0.1 www.vidrgilio.it
127.0.0.1 viegilio.it
127.0.0.1 www.viegilio.it
127.0.0.1 viergilio.it
127.0.0.1 www.viergilio.it
127.0.0.1 vifgilio.it
127.0.0.1 www.vifgilio.it
127.0.0.1 vifrgilio.it
127.0.0.1 www.vifrgilio.it
127.0.0.1 vigrgilio.it
127.0.0.1 www.vigrgilio.it
127.0.0.1 vigrilio.it
127.0.0.1 www.vigrilio.it
127.0.0.1 vijrgilio.it
127.0.0.1 www.vijrgilio.it
127.0.0.1 vikrgilio.it
127.0.0.1 www.vikrgilio.it
127.0.0.1 vilrgilio.it
127.0.0.1 www.vilrgilio.it
127.0.0.1 viorgilio.it
127.0.0.1 www.viorgilio.it
127.0.0.1 vir4gilio.it
127.0.0.1 www.vir4gilio.it
127.0.0.1 vir5gilio.it
127.0.0.1 www.vir5gilio.it
127.0.0.1 virbgilio.it
127.0.0.1 www.virbgilio.it
127.0.0.1 virbilio.it
127.0.0.1 www.virbilio.it
127.0.0.1 virdgilio.it
127.0.0.1 www.virdgilio.it
127.0.0.1 viregilio.it
127.0.0.1 www.viregilio.it
127.0.0.1 virfgilio.it
127.0.0.1 www.virfgilio.it
127.0.0.1 virg8ilio.it
127.0.0.1 www.virg8ilio.it
127.0.0.1 virg8lio.it
127.0.0.1 www.virg8lio.it
127.0.0.1 virg9ilio.it
127.0.0.1 www.virg9ilio.it
127.0.0.1 virg9lio.it
127.0.0.1 www.virg9lio.it
127.0.0.1 virgbilio.it
127.0.0.1 www.virgbilio.it
127.0.0.1 virgfilio.it
127.0.0.1 www.virgfilio.it
127.0.0.1 virghilio.it
127.0.0.1 www.virghilio.it
127.0.0.1 virgi8lio.it
127.0.0.1 www.virgi8lio.it
127.0.0.1 virgi9lio.it
127.0.0.1 www.virgi9lio.it
127.0.0.1 virgiilo.it
127.0.0.1 www.virgiilo.it
127.0.0.1 virgiio.it
127.0.0.1 www.virgiio.it
127.0.0.1 virgijlio.it
127.0.0.1 www.virgijlio.it
127.0.0.1 virgiklio.it
127.0.0.1 www.virgiklio.it
127.0.0.1 virgil8io.it
127.0.0.1 www.virgil8io.it
127.0.0.1 virgil9io.it
127.0.0.1 www.virgil9io.it
127.0.0.1 virgili0.it
127.0.0.1 www.virgili0.it
127.0.0.1 virgili8o.it
127.0.0.1 www.virgili8o.it
127.0.0.1 virgili9.it
127.0.0.1 www.virgili9.it
127.0.0.1 virgili9o.it
127.0.0.1 www.virgili9o.it
127.0.0.1 virgilijo.it
127.0.0.1 www.virgilijo.it
127.0.0.1 virgiliko.it
127.0.0.1 www.virgiliko.it
127.0.0.1 virgilil.it
127.0.0.1 www.virgilil.it
127.0.0.1 virgililo.it
127.0.0.1 www.virgililo.it
127.0.0.1 virgilio0.it
127.0.0.1 www.virgilio0.it
127.0.0.1 virgilio9.it
127.0.0.1 www.virgilio9.it
127.0.0.1 virgilioi.it
127.0.0.1 www.virgilioi.it
127.0.0.1 virgiliok.it
127.0.0.1 www.virgiliok.it
127.0.0.1 virgiliol.it
127.0.0.1 www.virgiliol.it
127.0.0.1 virgiliop.it
127.0.0.1 www.virgiliop.it
127.0.0.1 virgilipo.it
127.0.0.1 www.virgilipo.it
127.0.0.1 virgiliuo.it
127.0.0.1 www.virgiliuo.it
127.0.0.1 virgiljio.it
127.0.0.1 www.virgiljio.it
127.0.0.1 virgilkio.it
127.0.0.1 www.virgilkio.it
127.0.0.1 virgiloio.it
127.0.0.1 www.virgiloio.it
127.0.0.1 virgiloo.it
127.0.0.1 www.virgiloo.it
127.0.0.1 virgilpio.it
127.0.0.1 www.virgilpio.it
127.0.0.1 virgiluio.it
127.0.0.1 www.virgiluio.it
127.0.0.1 virgiluo.it
127.0.0.1 www.virgiluo.it
127.0.0.1 virgioio.it
127.0.0.1 www.virgioio.it
127.0.0.1 virgiolio.it
127.0.0.1 www.virgiolio.it
127.0.0.1 virgiplio.it
127.0.0.1 www.virgiplio.it
127.0.0.1 virgiulio.it
127.0.0.1 www.virgiulio.it
127.0.0.1 virgjilio.it
127.0.0.1 www.virgjilio.it
127.0.0.1 virgkilio.it
127.0.0.1 www.virgkilio.it
127.0.0.1 virgklio.it
127.0.0.1 www.virgklio.it
127.0.0.1 virglilio.it
127.0.0.1 www.virglilio.it
127.0.0.1 virgoilio.it
127.0.0.1 www.virgoilio.it
127.0.0.1 virgtilio.it
127.0.0.1 www.virgtilio.it
127.0.0.1 virguilio.it
127.0.0.1 www.virguilio.it
127.0.0.1 virgvilio.it
127.0.0.1 www.virgvilio.it
127.0.0.1 virgyilio.it
127.0.0.1 www.virgyilio.it
127.0.0.1 virhgilio.it
127.0.0.1 www.virhgilio.it
127.0.0.1 virtgilio.it
127.0.0.1 www.virtgilio.it
127.0.0.1 virtilio.it
127.0.0.1 www.virtilio.it
127.0.0.1 virvgilio.it
127.0.0.1 www.virvgilio.it
127.0.0.1 virvilio.it
127.0.0.1 www.virvilio.it
127.0.0.1 virygilio.it
127.0.0.1 www.virygilio.it
127.0.0.1 vitrgilio.it
127.0.0.1 www.vitrgilio.it
127.0.0.1 viurgilio.it
127.0.0.1 www.viurgilio.it
127.0.0.1 vjirgilio.it
127.0.0.1 www.vjirgilio.it
127.0.0.1 vkirgilio.it
127.0.0.1 www.vkirgilio.it
127.0.0.1 vkrgilio.it
127.0.0.1 www.vkrgilio.it
127.0.0.1 vlirgilio.it
127.0.0.1 www.vlirgilio.it
127.0.0.1 voirgilio.it
127.0.0.1 www.voirgilio.it
127.0.0.1 vorriere.it
127.0.0.1 www.vorriere.it
127.0.0.1 vuirgilio.it
127.0.0.1 www.vuirgilio.it
127.0.0.1 walitalia.it
127.0.0.1 www.walitalia.it
127.0.0.1 wbay.it
127.0.0.1 www.wbay.it
127.0.0.1 wsupereva.it
127.0.0.1 www.wsupereva.it
127.0.0.1 xcorriere.it
127.0.0.1 www.xcorriere.it
127.0.0.1 xorriere.it
127.0.0.1 www.xorriere.it
127.0.0.1 ygoogle.it
127.0.0.1 www.ygoogle.it
127.0.0.1 yiscali.it
127.0.0.1 www.yiscali.it
127.0.0.1 yoogle.it
127.0.0.1 www.yoogle.it
127.0.0.1 ytiscali.it
127.0.0.1 www.ytiscali.it
127.0.0.1 ytrenitalia.it
127.0.0.1 www.ytrenitalia.it
127.0.0.1 yunibo.it
127.0.0.1 www.yunibo.it
127.0.0.1 zalitalia.it
127.0.0.1 www.zalitalia.it
127.0.0.1 zsupereva.it
127.0.0.1 www.zsupereva.it
127.0.0.1 owntibia.com
127.0.0.1 www.owntibia.com
127.0.0.1 activexaccessobject.com
127.0.0.1 www.activexaccessobject.com
127.0.0.1 imageaxaccesssoft.com
127.0.0.1 www.imageaxaccesssoft.com
127.0.0.1 play-ticket.com
127.0.0.1 www.play-ticket.com
127.0.0.1 de.drivecleaner.com
127.0.0.1 smart-security.biz
127.0.0.1 mezzicodec.net
127.0.0.1 l.mezzicodec.net
127.0.0.1 www.mezzicodec.net
127.0.0.1 attrezzi.biz
127.0.0.1 xp.attrezzi.biz
127.0.0.1 www.attrezzi.biz
127.0.0.1 sisdotnet.com
127.0.0.1 zero.sisdotnet.com
127.0.0.1 www.sisdotnet.com
127.0.0.1 j10.wrs.mcboo.com
127.0.0.1 wrs.mcboo.com
127.0.0.1 bestmanage.org
127.0.0.1 a.bestmanage.org
127.0.0.1 www.bestmanage.org
127.0.0.1 methasearch.info
127.0.0.1 www.methasearch.info
127.0.0.1 other-baccarat.info
127.0.0.1 www.other-baccarat.info
127.0.0.1 rfthud.com
127.0.0.1 www.rfthud.com
127.0.0.1 exflow.org
127.0.0.1 www.exflow.org
127.0.0.1 baccarat-other.info
127.0.0.1 www.baccarat-other.info
127.0.0.1 othergold.info
127.0.0.1 www.othergold.info
127.0.0.1 klikadvertising.com
127.0.0.1 klik.klikadvertising.com
127.0.0.1 www.klikadvertising.com
127.0.0.1 abnetsoft.info
127.0.0.1 www.abnetsoft.info
127.0.0.1 directporta.info
127.0.0.1 www.directporta.info
127.0.0.1 1shoppingcart.com
127.0.0.1 www.1shoppingcart.com
127.0.0.1 mygeek.com
127.0.0.1 www.mygeek.com
127.0.0.1 xmlsearch.mygeek.com
127.0.0.1 crapsgold.info
127.0.0.1 www.crapsgold.info
127.0.0.1 gold-craps.info
127.0.0.1 www.gold-craps.info
127.0.0.1 goldbaccarat.info
127.0.0.1 www.gocodec.com
127.0.0.1 gocodec.com
127.0.0.1 www.engine-ticket.com
127.0.0.1 engine-ticket.com
127.0.0.1 www.party-ticket.com
127.0.0.1 party-ticket.com
127.0.0.1 www.mediaprojectaccess.com
127.0.0.1 mediaprojectaccess.com
127.0.0.1 www.activexmediatour.com
127.0.0.1 activexmediatour.com
127.0.0.1 ygsondheks.info
127.0.0.1 www.ygsondheks.info
127.0.0.1 boom.com.vn
127.0.0.1 www.boom.com.vn
127.0.0.1 codecsoft.net
127.0.0.1 www.codecsoft.net
127.0.0.1 meizi7472831.com
127.0.0.1 www.meizi7472831.com
127.0.0.1 helpcodec.com
127.0.0.1 www.helpcodec.com
127.0.0.1 videoactivexlist.com
127.0.0.1 www.videoactivexlist.com
127.0.0.1 axmediasolutions.com
127.0.0.1 www.axmediasolutions.com
127.0.0.1 accessactivexvideo.com
127.0.0.1 www.accessactivexvideo.com
127.0.0.1 mediaactivextask.com
127.0.0.1 www.mediaactivextask.com
127.0.0.1 motioncodecs.com
127.0.0.1 www.motioncodecs.com
127.0.0.1 spycrush.com
127.0.0.1 www.spycrush.com
127.0.0.1 www-spybot.net
127.0.0.1 www.www-spybot.net
127.0.0.1 super-servers.net
127.0.0.1 www.super-servers.net
127.0.0.1 smetsys.net
127.0.0.1 www.smetsys.net
127.0.0.1 antispysolutions.com
127.0.0.1 www.antispysolutions.com
127.0.0.1 www2.p0rt2.com
127.0.0.1 www.www2.p0rt2.com
127.0.0.1 www7.logih.com
127.0.0.1 www.www7.logih.com
127.0.0.1 iugate.com
127.0.0.1 www.iugate.com
127.0.0.1 web-codec.com
127.0.0.1 www.web-codec.com
127.0.0.1 usecodec.com
127.0.0.1 www.usecodec.com
127.0.0.1 privateaxsoftware.com
127.0.0.1 www.privateaxsoftware.com
127.0.0.1 mediaactivexfile.com
127.0.0.1 www.mediaactivexfile.com
127.0.0.1 activexmediatool.com
127.0.0.1 www.activexmediatool.com
127.0.0.1 activexaccessvideo.com
127.0.0.1 www.activexaccessvideo.com
127.0.0.1 the-ticket.net
127.0.0.1 www.the-ticket.net
127.0.0.1 the-codec.com
127.0.0.1 www.the-codec.com
127.0.0.1 funcodec.com
127.0.0.1 www.funcodec.com
127.0.0.1 data-hoster.com
127.0.0.1 www.data-hoster.com
127.0.0.1 netsearchsoft.com
127.0.0.1 www.netsearchsoft.com
127.0.0.1 pcgewinnen.de
127.0.0.1 www.pcgewinnen.de
127.0.0.1 play3w.com
127.0.0.1 playon.play3w.com
127.0.0.1 www.play3w.com
127.0.0.1 Antispywaresuite.com
127.0.0.1 www.Antispywaresuite.com
127.0.0.1 Antiworm2008.com
127.0.0.1 www.Antiworm2008.com
127.0.0.1 Defensaantimalware.com
127.0.0.1 www.Defensaantimalware.com
127.0.0.1 Filtrodetrojan.com
127.0.0.1 www.Filtrodetrojan.com
127.0.0.1 Goldenantispy.com
127.0.0.1 www.Goldenantispy.com
127.0.0.1 Keinegefahr.com
127.0.0.1 www.Keinegefahr.com
127.0.0.1 Menacerescue.com
127.0.0.1 www.Menacerescue.com
127.0.0.1 Menacesecure.com
127.0.0.1 www.Menacesecure.com
127.0.0.1 Orantiespion.com
127.0.0.1 www.Orantiespion.com
127.0.0.1 Rescatedeamenazas.com
127.0.0.1 www.Rescatedeamenazas.com
127.0.0.1 Trojanerfilter.com
127.0.0.1 www.Trojanerfilter.com
127.0.0.1 Trojansfilter.com
127.0.0.1 www.Trojansfilter.com
127.0.0.1 Trojansfiltre.com
127.0.0.1 www.Trojansfiltre.com
127.0.0.1 Antiespiadorado.com
127.0.0.1 www.Antiespiadorado.com
127.0.0.1 Antiespionspack.com
127.0.0.1 www.Antiespionspack.com
127.0.0.1 Antigusanos2008.com
127.0.0.1 www.Antigusanos2008.com
127.0.0.1 Antispionage.com
127.0.0.1 www.Antispionage.com
127.0.0.1 Antispionagepro.com
127.0.0.1 www.Antispionagepro.com
127.0.0.1 Antiver2008.com
127.0.0.1 www.Antiver2008.com
127.0.0.1 Antiwurm2008.com
127.0.0.1 www.Antiwurm2008.com
127.0.0.1 onerateld.com
127.0.0.1 content.onerateld.com
127.0.0.1 www.onerateld.com
127.0.0.1 downloadvax.com
127.0.0.1 www.downloadvax.com
127.0.0.1 vaxdownload.com
127.0.0.1 www.vaxdownload.com
127.0.0.1 getvaxobject.com
127.0.0.1 www.getvaxobject.com
127.0.0.1 inc-codec.com
127.0.0.1 www.inc-codec.com
127.0.0.1 passtosites.net
127.0.0.1 www.passtosites.net
127.0.0.1 keratomir.biz
127.0.0.1 www.keratomir.biz
127.0.0.1 keratomir2.biz
127.0.0.1 www.keratomir2.biz
127.0.0.1 spylocked.com
127.0.0.1 www.spylocked.com
127.0.0.1 ucleaner.com
127.0.0.1 www.ucleaner.com
127.0.0.1 mediaaxsetup.com
127.0.0.1 www.mediaaxsetup.com
127.0.0.1 spyot.info
127.0.0.1 www.spyot.info
127.0.0.1 ads183.com
127.0.0.1 www.ads183.com
127.0.0.1 seobiz.us
127.0.0.1 www.seobiz.us
127.0.0.1 top100drugs.info
127.0.0.1 www.top100drugs.info
127.0.0.1 fr.drivecleaner.com
127.0.0.1 www.fr.drivecleaner.com
127.0.0.1 asafebrowser.com
127.0.0.1 www.asafebrowser.com
127.0.0.1 getbestloanrate.info
127.0.0.1 www.getbestloanrate.info
127.0.0.1 pipni.cz
127.0.0.1 www.pipni.cz
127.0.0.1 www3.pipni.cz
127.0.0.1 serverc.org
127.0.0.1 zero.serverc.org
127.0.0.1 www.serverc.org
127.0.0.1 dedsearch.com
127.0.0.1 feed.dedsearch.com
127.0.0.1 www.dedsearch.com
127.0.0.1 secure.ucleaner.com
127.0.0.1 softwarereferral.com
127.0.0.1 www.softwarereferral.com
127.0.0.1 vaxobjectinstall.com
127.0.0.1 www.vaxobjectinstall.com
127.0.0.1 analcord.com
127.0.0.1 www.analcord.com
127.0.0.1 gooogle.bz
127.0.0.1 www.gooogle.bz
127.0.0.1 internet-explorer.name
127.0.0.1 www.internet-explorer.name
127.0.0.1 click-codec.com
127.0.0.1 www.click-codec.com
127.0.0.1 antivirussecuritypro.com
127.0.0.1 www.antivirussecuritypro.com
127.0.0.1 sysprotect.com
127.0.0.1 www.sysprotect.com
127.0.0.1 pinaccesscode.com
127.0.0.1 www.pinaccesscode.com
127.0.0.1 ALL1COUNT.NET
127.0.0.1 www.ALL1COUNT.NET
127.0.0.1 4softget.com
127.0.0.1 www.4softget.com
127.0.0.1 traff.justcount.net
127.0.0.1 www.justcount.net
127.0.0.1 webtop100.net
127.0.0.1 www.webtop100.net
127.0.0.1 xathzesocc.com
127.0.0.1 www.xathzesocc.com
127.0.0.1 zfxaqzkevi.com
127.0.0.1 www.zfxaqzkevi.com
127.0.0.1 setup.bestmanage.org
127.0.0.1 f1.bestmanage.org
127.0.0.1 f2.bestmanage.org
127.0.0.1 f3.bestmanage.org
127.0.0.1 f4.bestmanage.org
127.0.0.1 f5.bestmanage.org
127.0.0.1 f6.bestmanage.org
127.0.0.1 f7.bestmanage.org
127.0.0.1 f8.bestmanage.org
127.0.0.1 f9.bestmanage.org
127.0.0.1 s1.bestmanage.org
127.0.0.1 s2.bestmanage.org
127.0.0.1 s3.bestmanage.org
127.0.0.1 s4.bestmanage.org
127.0.0.1 s5.bestmanage.org
127.0.0.1 s6.bestmanage.org
127.0.0.1 s7.bestmanage.org
127.0.0.1 s8.bestmanage.org
127.0.0.1 s9.bestmanage.org
127.0.0.1 setup.truth-is-out-there.org
127.0.0.1 www.truth-is-out-there.org
127.0.0.1 f1.truth-is-out-there.org
127.0.0.1 f2.truth-is-out-there.org
127.0.0.1 f3.truth-is-out-there.org
127.0.0.1 f4.truth-is-out-there.org
127.0.0.1 f5.truth-is-out-there.org
127.0.0.1 f7.truth-is-out-there.org
127.0.0.1 f8.truth-is-out-there.org
127.0.0.1 f9.truth-is-out-there.org
127.0.0.1 s1.truth-is-out-there.org
127.0.0.1 s2.truth-is-out-there.org
127.0.0.1 s3.truth-is-out-there.org
127.0.0.1 s4.truth-is-out-there.org
127.0.0.1 s5.truth-is-out-there.org
127.0.0.1 s6.truth-is-out-there.org
127.0.0.1 s7.truth-is-out-there.org
127.0.0.1 s8.truth-is-out-there.org
127.0.0.1 s9.truth-is-out-there.org
127.0.0.1 wwwsearch.biz
127.0.0.1 www.wwwsearch.biz
127.0.0.1 xat.com
127.0.0.1 www.xat.com
127.0.0.1 installobject.com
127.0.0.1 www.installobject.com
127.0.0.1 dl1.virusprotectpro.com
127.0.0.1 imagescontrol.com
127.0.0.1 www.imagescontrol.com
127.0.0.1 ufixer.com
127.0.0.1 www.ufixer.com
127.0.0.1 spyware-secure.com
127.0.0.1 www.spyware-secure.com
127.0.0.1 lordoftibia.pl
127.0.0.1 www.lordoftibia.pl
127.0.0.1 downloadpics.net
127.0.0.1 www.downloadpics.net
127.0.0.1 search2find.biz
127.0.0.1 www.search2find.biz
127.0.0.1 viewimageonline.com
127.0.0.1 www.viewimageonline.com
127.0.0.1 getphotosets.com
127.0.0.1 www.getphotosets.com
127.0.0.1 jackpot-advertising.info
127.0.0.1 www.jackpot-advertising.info
127.0.0.1 oddsjackpot.info
127.0.0.1 www.oddsjackpot.info
127.0.0.1 jackpotcheck.info
127.0.0.1 www.jackpotcheck.info
127.0.0.1 tv-codec.com
127.0.0.1 www.tv-codec.com
127.0.0.1 codec.ninoa.com
127.0.0.1 videoaxdownload.com
127.0.0.1 www.videoaxdownload.com
127.0.0.1 axvideosetup.com
127.0.0.1 www.axvideosetup.com
127.0.0.1 installvaxobject.com
127.0.0.1 www.installvaxobject.com
127.0.0.1 getimageactivex.com
127.0.0.1 www.getimageactivex.com
127.0.0.1 micro-codec.com
127.0.0.1 www.micro-codec.com
127.0.0.1 downloadmediaax.com
127.0.0.1 www.downloadmediaax.com
127.0.0.1 videoactivexsetup.com
127.0.0.1 www.videoactivexsetup.com
127.0.0.1 iaxobjectdownload.com
127.0.0.1 www.iaxobjectdownload.com
127.0.0.1 virtual-ticket.net
127.0.0.1 www.virtual-ticket.net
127.0.0.1 virtualcodec.com
127.0.0.1 www.virtualcodec.com
127.0.0.1 host-codec.com
127.0.0.1 www.host-codec.com
127.0.0.1 amediasource.com
127.0.0.1 www.amediasource.com
127.0.0.1 videossoftware.com
127.0.0.1 www.videossoftware.com
127.0.0.1 greatcodec.com
127.0.0.1 www.greatcodec.com
127.0.0.1 great-ticket.net
127.0.0.1 www.great-ticket.net
127.0.0.1 enhancevideos.com
127.0.0.1 www.enhancevideos.com
127.0.0.1 key-codec.com
127.0.0.1 www.key-codec.com
127.0.0.1 portal-ticket.com
127.0.0.1 www.portal-ticket.com
127.0.0.1 mega-codec.com
127.0.0.1 www.mega-codec.com
127.0.0.1 avideosurfer.com
127.0.0.1 www.avideosurfer.com
127.0.0.1 key-ticket.com
127.0.0.1 www.key-ticket.com
127.0.0.1 imagespecials.com
127.0.0.1 www.imagespecials.com
127.0.0.1 pilotcodec.com
127.0.0.1 www.pilotcodec.com
127.0.0.1 movietooklit.com
127.0.0.1 www.movietooklit.com
127.0.0.1 flrx-tools.net
127.0.0.1 www.flrx-tools.net
127.0.0.1 flrxtools.greatnuke.com
127.0.0.1 upx.tsx.org
127.0.0.1 spybot-uk.com
127.0.0.1 www.spybot-uk.com
127.0.0.1 www.miaminews365.net
127.0.0.1 miaminews365.net
127.0.0.1 www.adscontex.com
127.0.0.1 adscontex.com
127.0.0.1 www.redir.ws
127.0.0.1 redir.ws
127.0.0.1 yourcodec.com
127.0.0.1 www.yourcodec.com
127.0.0.1 hotelcodec.com
127.0.0.1 www.hotelcodec.com
127.0.0.1 toohs.com
127.0.0.1 www.toohs.com
127.0.0.1 spyware-browser.com
127.0.0.1 www.spyware-browser.com
127.0.0.1 iesecuritybar.com
127.0.0.1 www.iesecuritybar.com
127.0.0.1 spydefenderpro.com
127.0.0.1 www.spydefenderpro.com
127.0.0.1 download.spy-shredder.com
127.0.0.1 remsys.org
127.0.0.1 de98.remsys.org
127.0.0.1 nameservicedirect.com
127.0.0.1 www.nameservicedirect.com
127.0.0.1 onlinesecurityworld.com
127.0.0.1 www.onlinesecurityworld.com
127.0.0.1 mediabusnetwork.com
127.0.0.1 www.mediabusnetwork.com
127.0.0.1 attackware.com
127.0.0.1 www.attackware.com
127.0.0.1 picturesspot.com
127.0.0.1 www.picturesspot.com
127.0.0.1 tamotua.com
127.0.0.1 www.tamotua.com
127.0.0.1 2every.net
127.0.0.1 www.2every.net
127.0.0.1 official--software.com
127.0.0.1 www.official--software.com
127.0.0.1 acrobat-2007.com
127.0.0.1 www.acrobat-2007.com
127.0.0.1 antivir2007.com
127.0.0.1 www.antivir2007.com
127.0.0.1 spybot2007.com
127.0.0.1 www.spybot2007.com
127.0.0.1 spybot-ib.com
127.0.0.1 www.spybot-ib.com
127.0.0.1 onlineplayer.tv
127.0.0.1 www.onlineplayer.tv
127.0.0.1 interactivebrands.com
127.0.0.1 www.interactivebrands.com
127.0.0.1 watchonline.tv
127.0.0.1 www.watchonline.tv
127.0.0.1 tvsatellitepourpc.com
127.0.0.1 www.tvsatellitepourpc.com
127.0.0.1 liveplayer.tv
127.0.0.1 www.liveplayer.tv
127.0.0.1 tv-en-pc.es
127.0.0.1 www.tv-en-pc.es
127.0.0.1 premiumtvchannels.com
127.0.0.1 www.premiumtvchannels.com
127.0.0.1 tv-sur-pc.com
127.0.0.1 www.tv-sur-pc.com
127.0.0.1 acrobat-center.com
127.0.0.1 www.acrobat-center.com
127.0.0.1 avast-downloads.com
127.0.0.1 www.avast-downloads.com
127.0.0.1 hq-downloads.com
127.0.0.1 www.hq-downloads.com
127.0.0.1 downloadservicearea.com
127.0.0.1 www.downloadservicearea.com
127.0.0.1 avast-2007.com
127.0.0.1 www.avast-2007.com
127.0.0.1 freedownloadpage.com
127.0.0.1 www.freedownloadpage.com
127.0.0.1 limewire-download-pro.com
127.0.0.1 www.limewire-download-pro.com
127.0.0.1 mcafee-antivirus-2007.com
127.0.0.1 www.mcafee-antivirus-2007.com
127.0.0.1 acrobatreader-8.com
127.0.0.1 www.acrobatreader-8.com
127.0.0.1 pandaantivirus-2007.com
127.0.0.1 www.pandaantivirus-2007.com
127.0.0.1 adobe-reader-8.fr
127.0.0.1 www.adobe-reader-8.fr
127.0.0.1 acrobat-reader-8.de
127.0.0.1 www.acrobat-reader-8.de
127.0.0.1 tv-auf-dem-pc.de
127.0.0.1 www.tv-auf-dem-pc.de
127.0.0.1 online-fernsehen.tv
127.0.0.1 www.online-fernsehen.tv
127.0.0.1 free-program-download.com
127.0.0.1 www.free-program-download.com
127.0.0.1 freedownloadhq.com
127.0.0.1 www.freedownloadhq.com
127.0.0.1 downloadfreeway.com
127.0.0.1 www.downloadfreeway.com
127.0.0.1 get-ipod-music.com
127.0.0.1 www.get-ipod-music.com
127.0.0.1 winzip-11.com
127.0.0.1 www.winzip-11.com
127.0.0.1 mp3musichq.com
127.0.0.1 www.mp3musichq.com
127.0.0.1 quicktime.downloadzcenter.com
127.0.0.1 www.quicktime.downloadzcenter.com
127.0.0.1 xtremesoftware-ltd.com
127.0.0.1 wwwxtremesoftware-ltd.com
127.0.0.1 yahoo.downloadznow.net
127.0.0.1 wwwyahoo.downloadznow.net
127.0.0.1 fullsoftwaredownloadz.com
127.0.0.1 www.fullsoftwaredownloadz.com
127.0.0.1 software-club.com
127.0.0.1 www.software-club.com
127.0.0.1 downloadwizard.com
127.0.0.1 wwwdownloadwizard.com
127.0.0.1 adobe-download-now.com
127.0.0.1 wwwadobe-download-now.com
127.0.0.1 downloadfreesoft.com
127.0.0.1 www.downloadfreesoft.com
127.0.0.1 all-edonkey.com
127.0.0.1 www.all-edonkey.com
127.0.0.1 freedownloadzone.com
127.0.0.1 www.freedownloadzone.com
127.0.0.1 free-download-support.com
127.0.0.1 www.free-download-support.com
127.0.0.1 winamp-download-now.com
127.0.0.1 www.winamp-download-now.com
127.0.0.1 winamp-hq.com
127.0.0.1 www.winamp-hq.com
127.0.0.1 limewirenetwork.com
127.0.0.1 www.limewirenetwork.com
127.0.0.1 adobe-downloads.com
127.0.0.1 www.adobe-downloads.com
127.0.0.1 click-to-download.com
127.0.0.1 www.click-to-download.com
127.0.0.1 limewire2007pro.info
127.0.0.1 www.limewire2007pro.info
127.0.0.1 download-all-area.com
127.0.0.1 www.download-all-area.com
127.0.0.1 realplayer-hq.com
127.0.0.1 www.realplayer-hq.com
127.0.0.1 firefoxdownload-now.com
127.0.0.1 www.firefoxdownload-now.com
127.0.0.1 pandadownload-now.com
127.0.0.1 www.pandadownload-now.com
127.0.0.1 my-music-space.com
127.0.0.1 www.my-music-space.com
127.0.0.1 skype-download-now.com
127.0.0.1 www.skype-download-now.com
127.0.0.1 skype-stop.com
127.0.0.1 www.skype-stop.com
127.0.0.1 winrar-download-now.com
127.0.0.1 www.winrar-download-now.com
127.0.0.1 skype-free-calls.com
127.0.0.1 www.skype-free-calls.com
127.0.0.1 download-all-4-free.com
127.0.0.1 www.download-all-4-free.com
127.0.0.1 emule-freebie.com
127.0.0.1 www.emule-freebie.com
127.0.0.1 downloadcorporation.com
127.0.0.1 www.downloadcorporation.com
127.0.0.1 irfanview-download-now.com
127.0.0.1 www.irfanview-download-now.com
127.0.0.1 getdvdshrink2007.com
127.0.0.1 www.getdvdshrink2007.com
127.0.0.1 mediaplayer-download-now.com
127.0.0.1 www.mediaplayer-download-now.com
127.0.0.1 ipod-music-store.com
127.0.0.1 www.ipod-music-store.com
127.0.0.1 realplayer-download-now.com
127.0.0.1 www.realplayer-download-now.com
127.0.0.1 panda-hq.com
127.0.0.1 www.panda-hq.com
127.0.0.1 directdvdpro.com
127.0.0.1 www.directdvdpro.com
127.0.0.1 free-download-place.com
127.0.0.1 www.free-download-place.com
127.0.0.1 free-avg-download.com
127.0.0.1 www.free-avg-download.com
127.0.0.1 itunesandipods.com
127.0.0.1 www.itunesandipods.com
127.0.0.1 winrar-hq.com
127.0.0.1 www.winrar-hq.com
127.0.0.1 freemp3access.com
127.0.0.1 www.freemp3access.com
127.0.0.1 download-winrar.com
127.0.0.1 www.download-winrar.com
127.0.0.1 acrobat-8.com
127.0.0.1 www.acrobat-8.com
127.0.0.1 powerdvd-7.com
127.0.0.1 www.powerdvd-7.com
127.0.0.1 photoshop.softwarecenterz.com
127.0.0.1 www.photoshop.softwarecenterz.com
127.0.0.1 winmx-freebie.com
127.0.0.1 www.winmx-freebie.com
127.0.0.1 aresultra.com
127.0.0.1 www.aresultra.com
127.0.0.1 my-software-space.com
127.0.0.1 www.my-software-space.com
127.0.0.1 antivirus.fastfreedownload.com
127.0.0.1 www.antivirus.fastfreedownload.com
127.0.0.1 mymusicaccessories.com
127.0.0.1 www.mymusicaccessories.com
127.0.0.1 free-bearshares.com
127.0.0.1 www.free-bearshares.com
127.0.0.1 download-real-player.com
127.0.0.1 www.download-real-player.com
127.0.0.1 winrar-stop.com
127.0.0.1 www.winrar-stop.com
127.0.0.1 etomi.all-downloads-now.com
127.0.0.1 www.etomi.all-downloads-now.com
127.0.0.1 azureus-freebie.com
127.0.0.1 www.azureus-freebie.com
127.0.0.1 emuledownloadhome.com
127.0.0.1 www.emuledownloadhome.com
127.0.0.1 bearshare-usa.com
127.0.0.1 www.bearshare-usa.com
127.0.0.1 downloadimesh.com
127.0.0.1 www.downloadimesh.com
127.0.0.1 bearsharelive.co.uk
127.0.0.1 www.bearsharelive.co.uk
127.0.0.1 all-bittorrent.com
127.0.0.1 www.all-bittorrent.com
127.0.0.1 downloadanysong.com
127.0.0.1 www.downloadanysong.com
127.0.0.1 free-avg.org
127.0.0.1 www.free-avg.org
127.0.0.1 bitcomet-freebie.com
127.0.0.1 www.bitcomet-freebie.com
127.0.0.1 ipod-tunes-download.com
127.0.0.1 www.ipod-tunes-download.com
127.0.0.1 incredimail-hq.com
127.0.0.1 www.incredimail-hq.com
127.0.0.1 2007-download.com
127.0.0.1 www.2007-download.com
127.0.0.1 skype-hq.com
127.0.0.1 www.skype-hq.com
127.0.0.1 downloadlost.tv
127.0.0.1 www.downloadlost.tv
127.0.0.1 ares-freebie.com
127.0.0.1 www.ares-freebie.com
127.0.0.1 incredimailpro.com
127.0.0.1 www.incredimailpro.com
127.0.0.1 avast.free-software-center.com
127.0.0.1 www.avast.free-software-center.com
127.0.0.1 irfanview-stop.com
127.0.0.1 www.irfanview-stop.com
127.0.0.1 www-free-tunes.com
127.0.0.1 www.www-free-tunes.com
127.0.0.1 irfanview-center.com
127.0.0.1 www.irfanview-center.com
127.0.0.1 zonealarm-download-now.com
127.0.0.1 www.zonealarm-download-now.com
127.0.0.1 mysoftwareprovider.com
127.0.0.1 www.mysoftwareprovider.com
127.0.0.1 free-music-network.com
127.0.0.1 www.free-music-network.com
127.0.0.1 mytunes.lets-get-it.net
127.0.0.1 www.mytunes.lets-get-it.net
127.0.0.1 bearshare.mp3-muzic.com
127.0.0.1 www.bearshare.mp3-muzic.com
127.0.0.1 mediaplayer-2007.com
127.0.0.1 www.mediaplayer-2007.com
127.0.0.1 download-trillian.com
127.0.0.1 www.download-trillian.com
127.0.0.1 quickiefilez.com
127.0.0.1 www.quickiefilez.com
127.0.0.1 ares-usa.com
127.0.0.1 www.ares-usa.com
127.0.0.1 free-software-center.com
127.0.0.1 www.free-software-center.com
127.0.0.1 itunesfreebies.com
127.0.0.1 www.itunesfreebies.com
127.0.0.1 lets-get-it.org
127.0.0.1 www.lets-get-it.org
127.0.0.1 avg-secure.com
127.0.0.1 www.avg-secure.com
127.0.0.1 start-downloading.com
127.0.0.1 www.start-downloading.com
127.0.0.1 all-downloads-now.com
127.0.0.1 www.all-downloads-now.com
127.0.0.1 k-litetk.com
127.0.0.1 www.k-litetk.com
127.0.0.1 download-this.us
127.0.0.1 www.download-this.us
127.0.0.1 get-winrar.com
127.0.0.1 www.get-winrar.com
127.0.0.1 download-windvd.com
127.0.0.1 www.download-windvd.com
127.0.0.1 outlook-express-utilities.com
127.0.0.1 www.outlook-express-utilities.com
127.0.0.1 acrobat-hq.com
127.0.0.1 www.acrobat-hq.com
127.0.0.1 lets-get-it.info
127.0.0.1 www.lets-get-it.info
127.0.0.1 download-limewire.org
127.0.0.1 www.download-limewire.org
127.0.0.1 limewire-mp3-share.com
127.0.0.1 www.limewire-mp3-share.com
127.0.0.1 downloadzfree.com
127.0.0.1 www.downloadzfree.com
127.0.0.1 musicmatch.free-software-center.com
127.0.0.1 www.musicmatch.free-software-center.com
127.0.0.1 bearshare-download.org
127.0.0.1 www.bearshare-download.org
127.0.0.1 easymp3musicnow.com
127.0.0.1 www.easymp3musicnow.com
127.0.0.1 limewire-pro-downloads.com
127.0.0.1 www.limewire-pro-downloads.com
127.0.0.1 prisonbreakseason.tv
127.0.0.1 www.prisonbreakseason.tv
127.0.0.1 download-for-free.net
127.0.0.1 www.download-for-free.net
127.0.0.1 bearshare.download-me.info
127.0.0.1 www.bearshare.download-me.info
127.0.0.1 mylimewirenetwork.com
127.0.0.1 www.mylimewirenetwork.com
127.0.0.1 bearshare-music-downloads.com
127.0.0.1 www.bearshare-music-downloads.com
127.0.0.1 download-2007.com
127.0.0.1 www.download-2007.com
127.0.0.1 arespro2007.com
127.0.0.1 www.arespro2007.com
127.0.0.1 bearsharepro2007.com
127.0.0.1 www.bearsharepro2007.com
127.0.0.1 azureusclub.com
127.0.0.1 www.azureusclub.com
127.0.0.1 download-zone-free.com
127.0.0.1 www.download-zone-free.com
127.0.0.1 free-adobe-download-support.com
127.0.0.1 www.free-adobe-download-support.com
127.0.0.1 limewirezone.com
127.0.0.1 www.limewirezone.com
127.0.0.1 winzip-hq.com
127.0.0.1 www.winzip-hq.com
127.0.0.1 www-win-mx.com
127.0.0.1 www.www-win-mx.com
127.0.0.1 klitepro.com
127.0.0.1 www.klitepro.com
127.0.0.1 mp3-music-source.com
127.0.0.1 www.mp3-music-source.com
127.0.0.1 emule.mp3-muzic.com
127.0.0.1 www.emule.mp3-muzic.com
127.0.0.1 downloads-free.org
127.0.0.1 www.downloads-free.org
127.0.0.1 acrobat-stop.com
127.0.0.1 www.acrobat-stop.com
127.0.0.1 download-mcafee.com
127.0.0.1 www.download-mcafee.com
127.0.0.1 powerdvd2007.info
127.0.0.1 www.powerdvd2007.info
127.0.0.1 myeasymp3downloadsnow.com
127.0.0.1 www.myeasymp3downloadsnow.com
127.0.0.1 winamp2007.com
127.0.0.1 www.winamp2007.com
127.0.0.1 official-avg-download-now.com
127.0.0.1 www.official-avg-download-now.com
127.0.0.1 avg.grab-it-today.net
127.0.0.1 www.avg.grab-it-today.net
127.0.0.1 zonealarm-stop.com
127.0.0.1 www.zonealarm-stop.com
127.0.0.1 adawarenow.com
127.0.0.1 www.adawarenow.com
127.0.0.1 download-zone-free.net
127.0.0.1 www.download-zone-free.net
127.0.0.1 mp3winmx.com
127.0.0.1 www.mp3winmx.com
127.0.0.1 yim-stop.com
127.0.0.1 www.yim-stop.com
127.0.0.1 winmxfrance.com
127.0.0.1 www.winmxfrance.com
127.0.0.1 mp3bearshare.com
127.0.0.1 www.mp3bearshare.com
127.0.0.1 mp3-morpheus.com
127.0.0.1 www.mp3-morpheus.com
127.0.0.1 ipod-itunes-download-now.com
127.0.0.1 www.ipod-itunes-download-now.com
127.0.0.1 get-mp3-onlined.com
127.0.0.1 www.get-mp3-onlined.com
127.0.0.1 telecharger-avast.com
127.0.0.1 www.telecharger-avast.com
127.0.0.1 thelimewiredownload.com
127.0.0.1 www.thelimewiredownload.com
127.0.0.1 download-ad-aware.com
127.0.0.1 www.download-ad-aware.com
127.0.0.1 stuff-your-ipod.com
127.0.0.1 www.stuff-your-ipod.com
127.0.0.1 avast-hq.com
127.0.0.1 www.avast-hq.com
127.0.0.1 winmx-music-download.com
127.0.0.1 www.winmx-music-download.com
127.0.0.1 bearshare-downloads.net
127.0.0.1 www.bearshare-downloads.net
127.0.0.1 antivirus-hq.net
127.0.0.1 www.antivirus-hq.net
127.0.0.1 photoshop.downloadzcentral.com
127.0.0.1 www.photoshop.downloadzcentral.com
127.0.0.1 mp3-muzic.com
127.0.0.1 www.mp3-muzic.com
127.0.0.1 avg.softwarecenterz.com
127.0.0.1 www.avg.softwarecenterz.com
127.0.0.1 freeunlimitedskype.com
127.0.0.1 www.freeunlimitedskype.com
127.0.0.1 antivirus-stop.com
127.0.0.1 www.antivirus-stop.com
127.0.0.1 tutorial-hq.com
127.0.0.1 www.tutorial-hq.com
127.0.0.1 photoshop-stop.com
127.0.0.1 www.photoshop-stop.com
127.0.0.1 k-litegold.com
127.0.0.1 www.k-litegold.com
127.0.0.1 all-limewire.com
127.0.0.1 www.all-limewire.com
127.0.0.1 download-antivir.com
127.0.0.1 www.download-antivir.com
127.0.0.1 mediaplayer-download.org
127.0.0.1 www.mediaplayer-download.org
127.0.0.1 download-dvdshrink.com
127.0.0.1 www.download-dvdshrink.com
127.0.0.1 getanysoftware.com
127.0.0.1 www.getanysoftware.com
127.0.0.1 spybotdownload-now.com
127.0.0.1 www.spybotdownload-now.com
127.0.0.1 www-audacity.com
127.0.0.1 www.www-audacity.com
127.0.0.1 downloadsglobe.com
127.0.0.1 www.downloadsglobe.com
127.0.0.1 incredimail-download-now.com
127.0.0.1 www.incredimail-download-now.com
127.0.0.1 download-avast.com
127.0.0.1 www.download-avast.com
127.0.0.1 download-itunes-now.com
127.0.0.1 www.download-itunes-now.com
127.0.0.1 quicktime-download-now.com
127.0.0.1 www.quicktime-download-now.com
127.0.0.1 get-realplayer.com
127.0.0.1 www.get-realplayer.com
127.0.0.1 searchinmates.org
127.0.0.1 www.searchinmates.org
127.0.0.1 idolikemovies.com
127.0.0.1 www.idolikemovies.com

Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files

C:\WINDOWS\Tasks\At?.job Deleted
C:\WINDOWS\Tasks\At??.job Deleted

DNS

Description: Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler Miniport
DNS Server Search Order: 154.11.129.59
DNS Server Search Order: 154.11.129.187

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C25D7B0D-94AE-4A04-A4B4-FCED794C6A78}: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C25D7B0D-94AE-4A04-A4B4-FCED794C6A78}: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CS2\Services\Tcpip\..\{C25D7B0D-94AE-4A04-A4B4-FCED794C6A78}: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=154.11.129.59 154.11.129.187
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=154.11.129.59 154.11.129.187


Deleting Temp Files


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


Registry Cleaning

Registry Cleaning done.

SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End
















Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:49:20 PM, on 9/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Garmin\gStart.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1188967321984
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://www.walmartphotocentre.ca/activex/PCAXSetup.cab?
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 7268 bytes














ComboFix 07-08-30.3 - "David" 2007-09-07 16:50:43.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.222 [GMT -6:00]


((((((((((((((((((((((((( Files Created from 2007-08-07 to 2007-09-07 )))))))))))))))))))))))))))))))


2007-09-07 14:42 2,188 --a------ C:\WINDOWS\system32\tmp.reg
2007-09-05 00:44 <DIR> d--h----- C:\BJPrinter
2007-09-04 09:28 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-09-04 03:21 0 --a------ C:\WINDOWS\nsreg.dat
2007-09-04 00:39 <DIR> d-------- C:\VundoFix Backups
2007-09-04 00:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-04 00:09 <DIR> d-------- C:\Program Files\Safer Networking
2007-09-03 23:31 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-03 23:11 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\WinRAR
2007-09-03 13:45 <DIR> d-------- C:\Program Files\Winamp
2007-09-03 10:08 <DIR> d-------- C:\Program Files\Real Alternative
2007-09-03 10:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
2007-09-03 09:46 <DIR> d-------- C:\Program Files\QuickTime Alternative
2007-09-02 19:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-09-02 18:12 <DIR> d-------- C:\Program Files\Bonjour
2007-09-02 17:13 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-09-02 14:25 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Media Player Classic
2007-09-02 13:24 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2007-09-02 13:13 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Ahead
2007-09-02 13:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
2007-09-02 13:05 <DIR> d-------- C:\Program Files\Nero
2007-09-02 13:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-09-02 12:21 <DIR> d-------- C:\Program Files\uTorrent
2007-09-02 12:21 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\uTorrent
2007-09-02 11:57 <DIR> d-------- C:\Program Files\Sunbelt Software
2007-08-29 21:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\vsosdk
2007-08-20 01:52 87,608 --a------ C:\DOCUME~1\David\APPLIC~1\inst.exe
2007-08-20 01:52 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-08-20 01:52 47,360 --a------ C:\DOCUME~1\David\APPLIC~1\pcouffin.sys
2007-08-20 01:52 217,127 --a------ C:\WINDOWS\system32\drv43260.dll
2007-08-20 01:52 208,935 --a------ C:\WINDOWS\system32\drv33260.dll
2007-08-20 01:52 176,165 --a------ C:\WINDOWS\system32\drv23260.dll
2007-08-20 01:52 <DIR> d-------- C:\Program Files\VSO
2007-08-20 01:52 <DIR> d-------- C:\DOCUME~1\David\APPLIC~1\Vso
2007-08-19 18:08 <DIR> d-------- C:\WINDOWS\pss


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-07 15:10 --------- d-------- C:\DOCUME~1\David\APPLIC~1\U3
2007-09-07 01:27 5735 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-09-06 14:56 --------- d-------- C:\DOCUME~1\David\APPLIC~1\AdobeUM
2007-09-04 22:46 --------- d-------- C:\Program Files\Canon
2007-09-04 22:27 --------- d-------- C:\Program Files\Logitech
2007-09-03 10:06 --------- d-------- C:\Program Files\Common Files\Real
2007-09-03 10:06 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Real
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Apple Computer
2007-09-03 09:46 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-09-02 14:55 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Webshots
2007-09-02 13:10 --------- d-------- C:\Program Files\Common Files\Ahead
2007-09-02 12:20 --------- d-------- C:\Program Files\Azureus
2007-09-02 12:19 --------- d-------- C:\DOCUME~1\David\APPLIC~1\Azureus
2007-09-02 11:54 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-02 11:37 --------- d-------- C:\Program Files\Symantec
2007-09-02 11:37 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-09-02 11:35 --------- d-------- C:\Program Files\Ahead
2007-08-03 14:30 --------- d-------- C:\DOCUME~1\David\APPLIC~1\NewspaperDirect
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-21 23:46 --------- d-------- C:\Program Files\The_Pussycat_Dolls_-_PCD-[HwC]
2007-06-26 14:12 972072 --a------ C:\WINDOWS\UNNeroVision.exe
2007-01-25 00:50 3508069 --a------ C:\Program Files\Adobe Illustrator - Teach Yourself Illustrator in 24 hours - Sam' s (eBook).pdf
2007-01-22 00:50 9795648 --a------ C:\Program Files\Azureus_2.5.0.2_Win32.setup.exe
2006-12-09 13:11 0 --a------ C:\Program Files\AdbeRdrUpd707_all_incr.exe
2006-09-05 16:50 27136 --a------ C:\WINDOWS\Fonts.\Afiutil.exe
2004-10-18 17:04 16706160 --a------ C:\Program Files\AdbeRdr60_enu_full.exe
2004-10-18 17:02 6811656 --a------ C:\Program Files\psa201se_us.exe
2004-10-01 16:00 40960 --a------ C:\Program Files\Uninstall_CDS.exe
2001-11-22 22:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL


((((((((((((((((((((((((((((( snapshot_2007-09-04_ 94153.60 )))))))))))))))))))))))))))))))))))))))))

----a-r 65,536 2007-09-06 20:35:36 C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\ARPPRODUCTICON.exe
----a-r 65,536 2007-09-06 20:35:36 C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\NewShortcut2_4BDFD2CE632942E498019B3D1F10D79B.exe
----a-r 65,536 2007-09-06 20:35:36 C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\NewShortcut3_4BDFD2CE632942E498019B3D1F10D79B.exe
----a-r 295,606 2007-09-06 20:53:08 C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A81000000003}\SC_Reader.exe
----a-w 86,016 2004-06-05 06:34:36 C:\WINDOWS\system32\CNMCP69.exe
----a-w 7,680 2004-06-07 20:00:00 C:\WINDOWS\system32\CNMVS69.DLL
----a-w 1,419,600 2007-09-07 04:30:05 C:\WINDOWS\system32\FNTCACHE.DAT
----a-w 1,415,680 2003-06-23 08:44:36 C:\WINDOWS\system32\wmv9vcm.dll
-c--a-w 92,504 2007-07-31 01:19:20 C:\WINDOWS\system32\dllcache\cdm.dll
-c--a-w 549,720 2007-07-31 01:19:36 C:\WINDOWS\system32\dllcache\wuapi.dll
-c--a-w 53,080 2007-07-31 01:19:16 C:\WINDOWS\system32\dllcache\wuauclt.exe
-c--a-w 1,712,984 2007-07-31 01:19:42 C:\WINDOWS\system32\dllcache\wuaueng.dll
-c--a-w 325,976 2007-07-31 01:19:32 C:\WINDOWS\system32\dllcache\wucltui.dll
-c--a-w 33,624 2007-07-31 01:18:40 C:\WINDOWS\system32\dllcache\wups.dll
-c--a-w 203,096 2007-07-31 01:19:46 C:\WINDOWS\system32\dllcache\wuweb.dll
----a-w 549,720 2007-07-31 01:19:36 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wuapi.dll\7.0.6000.381\wuapi.dll
----a-w 33,624 2007-07-31 01:18:40 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\wups.dll
----a-w 43,352 2007-07-31 01:19:12 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.0.6000.381\wups2.dll
----a-w 66,560 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMCP69.DLL
----a-w 153,600 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMD569.DLL
----a-w 397,824 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMDR69.DLL
----a-w 19,456 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMFU69.DLL
----a-w 15,872 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMOP69.DLL
----a-w 23,280 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP069.DAT
----a-w 27,140 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP169.DAT
----a-w 30,320 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP269.DAT
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPI69.DLL
----a-w 80,896 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV69.EXE
----a-w 863,744 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSB69.DLL
----a-w 8,704 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD69.EXE
----a-w 130,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM69.EXE
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ69.EXE
----a-w 110,592 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSR69.DLL
----a-w 322,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUI69.DLL
----a-w 219,648 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUR69.DLL
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMW369.DLL
----a-w 66,560 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMCP69.DLL
----a-w 153,600 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMD569.DLL
----a-w 397,824 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMDR69.DLL
----a-w 19,456 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMFU69.DLL
----a-w 15,872 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMOP69.DLL
----a-w 23,280 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP069.DAT
----a-w 27,140 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP169.DAT
----a-w 30,320 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP269.DAT
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPI69.DLL
----a-w 80,896 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPV69.EXE
----a-w 863,744 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSB69.DLL
----a-w 8,704 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSD69.EXE
----a-w 130,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSM69.EXE
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSQ69.EXE
----a-w 110,592 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSR69.DLL
----a-w 322,048 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUI69.DLL
----a-w 219,648 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUR69.DLL
----a-w 6,656 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMW369.DLL
----a-w 54,272 2004-06-07 20:00:00 C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP69.DLL

----a-r 86,016 2004-06-04 15:34:36 C:\WINDOWS\system32\CNMCP69.exe
----a-w 7,680 2004-06-07 05:00:00 C:\WINDOWS\system32\CNMVS69.DLL
----a-w 1,423,360 2007-09-03 01:36:36 C:\WINDOWS\system32\FNTCACHE.DAT
-c--a-w 75,544 2005-05-26 10:16:24 C:\WINDOWS\system32\dllcache\cdm.dll
-c--a-w 465,176 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuapi.dll
-c--a-w 124,184 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuauclt.exe
-c--a-w 1,343,768 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuaueng.dll
-c--a-w 127,256 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wucltui.dll
-c--a-w 41,240 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wups.dll
-c--a-w 173,536 2005-05-26 10:16:30 C:\WINDOWS\system32\dllcache\wuweb.dll
----a-w 66,560 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMCP69.DLL
----a-w 153,600 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMD569.DLL
----a-w 397,824 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMDR69.DLL
----a-w 19,456 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMFU69.DLL
----a-w 15,872 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMOP69.DLL
----a-w 23,280 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP069.DAT
----a-w 27,140 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP169.DAT
----a-w 30,320 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMP269.DAT
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPI69.DLL
----a-w 80,896 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMPV69.EXE
----a-w 863,744 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSB69.DLL
----a-w 8,704 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSD69.EXE
----a-w 130,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSM69.EXE
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSQ69.EXE
----a-w 110,592 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMSR69.DLL
----a-w 322,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUI69.DLL
----a-w 219,648 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMUR69.DLL
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\3\CNMW369.DLL
----a-w 66,560 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMCP69.DLL
----a-w 153,600 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMD569.DLL
----a-w 397,824 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMDR69.DLL
----a-w 19,456 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMFU69.DLL
----a-w 15,872 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMOP69.DLL
----a-w 23,280 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP069.DAT
----a-w 27,140 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP169.DAT
----a-w 30,320 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMP269.DAT
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPI69.DLL
----a-w 80,896 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMPV69.EXE
----a-w 863,744 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSB69.DLL
----a-w 8,704 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSD69.EXE
----a-w 130,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSM69.EXE
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSQ69.EXE
----a-w 110,592 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMSR69.DLL
----a-w 322,048 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUB69.DLL
----a-w 1,571,840 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUI69.DLL
----a-w 219,648 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMUR69.DLL
----a-w 6,656 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\drivers\w32x86\canonip6000db50d\CNMW369.DLL
----a-w 54,272 2004-06-07 05:00:00 C:\WINDOWS\system32\spool\prtprocs\w32x86\CNMPP69.DLL

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-13 19:10]
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 03:50 C:\WINDOWS\LOGI_MWX.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-02 11:59]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2007-08-07 20:46]
"gStart"="C:\Garmin\gStart.exe" [2005-07-25 09:05]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Symantec NetDriver Monitor"=C:\PROGRA~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe
"<NO NAME>"=
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"PDUiP6000DMon"=C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
"PDUiP6000DTskbr"=C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys


Contents of the 'Scheduled Tasks' folder
2007-09-03 21:38:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-09-07 19:47:00 C:\WINDOWS\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-07 16:54:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

C:\WINDOWS\system32\cmd.exe [2576] 0x820DE868


scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-07 16:56:29
C:\ComboFix-quarantined-files.txt ... 2007-09-07 16:56
C:\ComboFix2.txt ... 2007-09-06 13:29
C:\ComboFix3.txt ... 2007-09-05 22:39

--- E O F ---

#14 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:29 AM

Posted 09 September 2007 - 06:49 AM

Sorry for the delay; I wasn't feeling well yesterday mostly just slept the entire day..

Are you using MVPS hosts file or other modified hosts to boost security?

I think I'm starting to need help with this. Lemme ask some of the other staff to see if I'm missing something... :thumbsup:
Hi there, stranger!

#15 Rawe

Rawe

  • Members
  • 2,363 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:29 AM

Posted 09 September 2007 - 11:11 AM

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 2 and save it to your desktop.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6u2...allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Read the License Agreement and then check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name. They should have next icon next to it: Posted Image
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u2-windows-i586-p.exe to install the newest version.
------

Did you or your uncle download an e-card before this started?
Hi there, stranger!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users