Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ukash variant and fake chat popup


  • This topic is locked This topic is locked
14 replies to this topic

#1 dwywit

dwywit

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 04 March 2015 - 10:30 PM

Hi all. I've been lurking on this site for some time, reading about other people's issues, and I've managed to cure quite a few nasties in the past, largely due to the advice presented here.

 

I've finally come up against one I can't seem to cure. I realise it's against your advice, but I've already run a few of the recommended tools. Here's the story so far:

 

Customer calls and describes the Ukash malware, except it's "interpol", not "australian federal police". A bit strange, as I thought ukash was smart enough to know what country it was in. Anyway, I collect the computer (Toshiba Corei3 laptop with Win 7 home premium), and it looks like the usual - only it's NOT blocking all other access, it's only a web page that won't close. Task manager was able to run, Windows start button was functional, etc. So I killed iexplore.exe via task manager, then rebooted into safe mode, disabled Windows Security essentials, and loaded combofix from a USB stick. Before I ran combofix, I checked the registry - HKLM/Software/Microsoft/WindowsNT/Winlogon - and it hadn't substituted a different shell, as in the usual Ukash infection, so I think this one was coming from some amateurs.

 

Combofix removed a variety of files, all seemingly related to "myscrapnook" toolbar. Reboot, and ukash is gone, but there's a fake chat popup showing up in Internet Explorer - "Veronica: you've been naughty, can we chat?", and a few variants of that.

 

To cut a long story short, I installed and ran ADWCleaner, Malwarebytes, TDSSkiller, and combofix again. The first two found remnants of myscrapnook, and a java exploit, which were removed. TDSSkiller and the second combofix run found nothing - unfortunately I neglected to save the first combofix log.

 

The popups continued. I used the "inspect element" feature in IE to locate the URLs associated with the popups, then put those into the hosts file pointing to 127.0.0.1, and then the popups stopped - as I'd hoped.

 

While this fixed the symptom, it was no guarantee, so I removed the hosts file entries, and continued to research the issue.

 

Since then, I've re-set IE 11, removed and reinstalled IE 11, uninstalled skype click-to-call, uninstalled Java (hadn't been updated since 2012), but still the popups kept coming. I checked the popup blocker in IE 11, and "popupmgr" was in the "allowed sites" category, so I removed it. Maybe I should have done that first......  In the middle of this, the bloody ukash page popped up again! I killed that from task manager, then re-started IE. I haven't seen the popups or ukash since then.

 

My problem is that even though the popups haven't been seen in a couple of hours through multiple reboots, I don't trust the system. I haven't tracked down the cause of the popups, nor have I removed the ukash infection to my satisfaction.

 

Given the circumstances, I'm considering a format and re-install of Windows. I can acces the customer's files to back up, so she's not going to lose anything (except money, when she gets my bill :grinner: ). Is there anything you can suggest that I haven't already done? I'm not going to return the machine to the customer until I'm satisfied, and I've run out of other options.

 

cheers



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:20 PM

Posted 09 March 2015 - 09:14 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

Wait for further instructions.

#3 dwywit

dwywit
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 10 March 2015 - 12:35 AM

Hello nasdaq, and thansk for your reply.

 

FRST.txt pasted as requested, and Addidtion.txt attached.

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-03-2015 01
Ran by Kym Carter (administrator) on TOSHIBA-PC on 10-03-2015 15:27:19
Running from C:\Users\Kym Carter\Desktop\farbar
Loaded Profiles: Kym Carter (Available profiles: Kym Carter)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
() C:\Windows\System32\GFNEXSrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.77\ccSvcHst.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.77\ccSvcHst.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\PeakShift\TPSCMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\NDSTray.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\CFSwMgr.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12459112 2012-03-16] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2866960 2011-12-20] (Synaptics Incorporated)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-09-23] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1548208 2011-11-25] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-15] (TOSHIBA Corporation)
HKLM\...\Run: [TPSCMain] => C:\Program Files\TOSHIBA\PeakShift\TPSCMain.exe [740792 2011-12-21] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-12] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [598448 2011-06-29] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38824 2011-06-29] (TOSHIBA Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [NortonOnlineBackup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1110360 2010-05-04] (Symantec Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [] => [X]
HKLM Group Policy restriction on software: %programfiles(x86)%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.com <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.com <====== ATTENTION
HKLM Group Policy restriction on software: syskey.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *:\$Recycle.Bin <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: scsvserv.exe <====== ATTENTION
HKLM Group Policy restriction on software: cipher.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: lsassw86s.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: lsassvrtdbks.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: ** <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.com <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.scr <====== ATTENTION
HKLM Group Policy restriction on software: vssadmin.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.com <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.scr <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Appdata\Roaming\Microsoft\Windows\IEUpdate\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.com <====== ATTENTION
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.au/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll [2011-11-04] (<TOSHIBA>)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2010-05-28] (Hewlett-Packard Co.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->  No File
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-09-23] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll [2011-11-04] (<TOSHIBA>)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2010-05-28] (Hewlett-Packard Co.)
Toolbar: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-07] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-10] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-10] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2010-12-08] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-09-27] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-11-29]
FF HKU\S-1-5-21-1716261008-3710999165-130527589-1001\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR StartupUrls: Default -> ""
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java™ Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Profile: C:\Users\Kym Carter\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Kym Carter\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-03-04]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-10] ()
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-02-22] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-02-22] (Intel Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2782552 2010-05-04] (Symantec Corporation)
R2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [132504 2013-08-26] (Symantec Corporation)
R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.15.77\ccSvcHst.exe [126392 2011-09-14] (Symantec Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [43664 2015-03-05] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 TDEIO; \??\C:\Windows\SysWOW64\sysprep\BOOTPRIO\tdeio64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-10 15:27 - 2015-03-10 15:27 - 00000000 ____D () C:\FRST
2015-03-10 15:26 - 2015-03-10 15:27 - 00000000 ____D () C:\Users\Kym Carter\Desktop\farbar
2015-03-09 11:39 - 2015-03-09 11:39 - 00001424 _____ () C:\Users\Kym Carter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-05 12:30 - 2015-03-05 12:31 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Kym Carter\Downloads\tdsskiller.exe
2015-03-05 12:02 - 2015-03-05 12:02 - 00043664 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2015-03-05 12:01 - 2015-03-05 12:01 - 00000358 _____ () C:\windows\system32\.crusader
2015-03-05 11:52 - 2015-03-05 11:52 - 00000000 ____D () C:\Program Files\HitmanPro
2015-03-05 11:51 - 2015-03-05 12:01 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-03-05 11:49 - 2015-03-05 11:51 - 10995632 _____ (SurfRight B.V.) C:\Users\Kym Carter\Downloads\HitmanPro_x64.exe
2015-03-05 11:41 - 2015-03-05 11:41 - 02126848 _____ () C:\Users\Kym Carter\Downloads\AdwCleaner.exe
2015-03-05 11:27 - 2015-03-05 11:27 - 00022645 _____ () C:\ComboFix.txt
2015-03-05 09:53 - 2015-03-05 09:51 - 00004214 _____ () C:\mbamscanlog1.xml
2015-03-05 09:29 - 2015-03-09 13:35 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 09:29 - 2015-03-05 10:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-03-05 09:29 - 2015-03-05 09:29 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-03-05 09:29 - 2015-03-05 09:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-03-05 09:29 - 2015-03-05 09:29 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-05 09:29 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-03-05 09:29 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-03-05 09:29 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-03-05 09:23 - 2015-03-04 10:26 - 00000027 _____ () C:\windows\system32\Drivers\etc\hosts.org
2015-03-05 09:19 - 2015-03-05 09:20 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Kym Carter\Downloads\mbam-setup-2.0.4.1028.exe
2015-03-04 12:37 - 2015-03-05 11:46 - 00000000 ____D () C:\AdwCleaner
2015-03-04 12:28 - 2015-03-04 12:28 - 00053248 _____ () C:\windows\SysWOW64\zlib.dll
2015-03-04 12:28 - 2015-03-04 12:28 - 00001223 _____ () C:\Users\Public\Desktop\CryptoPrevent.lnk
2015-03-04 12:28 - 2015-03-04 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foolish IT
2015-03-04 12:28 - 2015-03-04 12:28 - 00000000 ____D () C:\ProgramData\Foolish IT
2015-03-04 12:28 - 2015-03-04 12:28 - 00000000 ____D () C:\Program Files (x86)\Foolish IT
2015-03-04 12:27 - 2015-03-04 12:27 - 00971528 _____ (Foolish IT LLC ) C:\Users\Kym Carter\Downloads\CryptoPreventSetup.exe
2015-03-04 10:11 - 2015-03-05 12:05 - 00000000 ____D () C:\windows\erdnt
2015-03-04 09:59 - 2015-03-10 15:23 - 00003490 _____ () C:\windows\System32\Tasks\AutoKMS
2015-02-26 08:28 - 2015-01-09 13:14 - 00950272 _____ (Microsoft Corporation) C:\windows\system32\perftrack.dll
2015-02-26 08:28 - 2015-01-09 13:14 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\wdi.dll
2015-02-26 08:28 - 2015-01-09 13:14 - 00029696 _____ (Microsoft Corporation) C:\windows\system32\powertracker.dll
2015-02-26 08:28 - 2015-01-09 12:48 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdi.dll
2015-02-25 16:14 - 2015-01-09 09:44 - 00419936 _____ () C:\windows\SysWOW64\locale.nls
2015-02-25 16:14 - 2015-01-09 09:43 - 00419936 _____ () C:\windows\system32\locale.nls
2015-02-25 12:49 - 2015-02-25 12:50 - 00001126 _____ () C:\Users\Kym Carter\AppData\Roaming\Microsoft\Windows\Start Menu\Brisbane Catholic Education - School Pastoral Worker- Chaplaincy - St Thomas More School, SUNSHINE BEACH - Letter of Application.website
2015-02-14 09:43 - 2015-02-14 09:43 - 00000267 _____ () C:\Users\Kym Carter\Desktop\Curcumin - iHerb.com.url
2015-02-13 08:02 - 2015-01-23 14:42 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-02-13 08:02 - 2015-01-23 14:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-13 08:02 - 2015-01-23 13:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-02-13 08:02 - 2015-01-23 13:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-02-11 09:00 - 2015-01-14 15:47 - 00389808 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-11 09:00 - 2015-01-14 15:09 - 00342712 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-02-11 09:00 - 2015-01-12 13:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-11 09:00 - 2015-01-12 13:05 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-02-11 09:00 - 2015-01-12 13:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-02-11 09:00 - 2015-01-12 12:49 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-02-11 09:00 - 2015-01-12 12:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-11 09:00 - 2015-01-12 12:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-11 09:00 - 2015-01-12 12:48 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-02-11 09:00 - 2015-01-12 12:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-11 09:00 - 2015-01-12 12:40 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-02-11 09:00 - 2015-01-12 12:39 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-02-11 09:00 - 2015-01-12 12:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-02-11 09:00 - 2015-01-12 12:34 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-02-11 09:00 - 2015-01-12 12:34 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-02-11 09:00 - 2015-01-12 12:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-02-11 09:00 - 2015-01-12 12:25 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-02-11 09:00 - 2015-01-12 12:21 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-02-11 09:00 - 2015-01-12 12:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-11 09:00 - 2015-01-12 12:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 09:00 - 2015-01-12 12:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-02-11 09:00 - 2015-01-12 12:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-02-11 09:00 - 2015-01-12 12:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-11 09:00 - 2015-01-12 12:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-02-11 09:00 - 2015-01-12 12:07 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-02-11 09:00 - 2015-01-12 12:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-02-11 09:00 - 2015-01-12 12:04 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-11 09:00 - 2015-01-12 12:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-02-11 09:00 - 2015-01-12 12:00 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-02-11 09:00 - 2015-01-12 11:59 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-02-11 09:00 - 2015-01-12 11:57 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-02-11 09:00 - 2015-01-12 11:55 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-02-11 09:00 - 2015-01-12 11:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-11 09:00 - 2015-01-12 11:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-11 09:00 - 2015-01-12 11:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-11 09:00 - 2015-01-12 11:46 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-02-11 09:00 - 2015-01-12 11:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-02-11 09:00 - 2015-01-12 11:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-11 09:00 - 2015-01-12 11:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 09:00 - 2015-01-12 11:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-02-11 09:00 - 2015-01-12 11:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-02-11 09:00 - 2015-01-12 11:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-02-11 09:00 - 2015-01-12 11:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-11 09:00 - 2015-01-12 11:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-02-11 09:00 - 2015-01-12 11:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-02-11 09:00 - 2015-01-12 11:22 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-02-11 09:00 - 2015-01-12 11:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-02-11 09:00 - 2015-01-12 11:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-11 09:00 - 2015-01-12 11:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-11 09:00 - 2015-01-12 11:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-02-11 09:00 - 2015-01-12 10:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-02-11 09:00 - 2015-01-12 10:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-02-11 08:59 - 2015-02-04 13:16 - 00894976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-11 08:59 - 2015-02-04 13:16 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-11 08:59 - 2015-02-04 13:16 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-11 08:59 - 2015-02-04 13:16 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-11 08:59 - 2015-02-04 13:16 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-11 08:59 - 2015-02-04 13:16 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-02-11 08:59 - 2015-02-04 13:13 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-11 08:59 - 2015-01-28 09:36 - 01239720 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2015-02-11 08:59 - 2015-01-10 16:48 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-02-11 08:59 - 2015-01-10 16:48 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-11 08:59 - 2015-01-10 16:48 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-02-11 08:59 - 2015-01-10 16:48 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-02-11 08:59 - 2015-01-10 16:48 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-02-11 08:59 - 2015-01-10 16:48 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-02-11 08:59 - 2015-01-10 16:48 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-02-11 08:59 - 2015-01-10 16:27 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-02-11 08:59 - 2015-01-10 16:27 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-02-11 08:59 - 2015-01-10 16:27 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-02-11 08:59 - 2015-01-10 16:27 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-02-11 08:59 - 2015-01-10 16:27 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-02-11 08:59 - 2015-01-10 16:27 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-02-11 08:59 - 2015-01-10 16:27 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-02-11 08:54 - 2015-01-15 18:14 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-11 08:54 - 2015-01-15 18:14 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-02-11 08:54 - 2015-01-15 18:09 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-11 08:54 - 2015-01-15 18:09 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-02-11 08:54 - 2015-01-15 18:09 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-02-11 08:54 - 2015-01-15 18:09 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-02-11 08:54 - 2015-01-15 18:09 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-02-11 08:54 - 2015-01-15 18:08 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-02-11 08:54 - 2015-01-15 18:06 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-11 08:54 - 2015-01-15 18:06 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-02-11 08:54 - 2015-01-15 18:04 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-11 08:54 - 2015-01-15 17:42 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-02-11 08:54 - 2015-01-15 17:42 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-02-11 08:54 - 2015-01-15 17:41 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-02-11 08:54 - 2015-01-15 17:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-02-11 08:54 - 2015-01-15 17:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-02-11 08:54 - 2015-01-15 17:37 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-02-11 08:54 - 2015-01-15 14:22 - 00458824 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-11 08:54 - 2015-01-13 13:10 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-11 08:54 - 2015-01-13 12:49 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-02-11 08:54 - 2014-12-12 15:31 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-02-11 08:54 - 2014-12-12 15:07 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-02-11 08:54 - 2014-11-26 13:53 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-02-11 08:54 - 2014-11-26 13:32 - 00571904 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2015-02-11 08:54 - 2014-07-07 12:07 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-02-11 08:54 - 2014-07-07 12:06 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-02-11 08:54 - 2014-07-07 11:40 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-02-11 08:54 - 2014-07-07 11:40 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-02-11 08:53 - 2015-01-14 16:09 - 05554112 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-11 08:53 - 2015-01-14 16:05 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-02-11 08:53 - 2015-01-14 16:05 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-02-11 08:53 - 2015-01-14 16:04 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-02-11 08:53 - 2015-01-14 15:44 - 03972544 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-02-11 08:53 - 2015-01-14 15:44 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-02-11 08:53 - 2015-01-14 15:41 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-02-11 08:53 - 2015-01-09 12:03 - 03201536 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-11 08:53 - 2014-12-08 13:09 - 00406528 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-11 08:53 - 2014-12-08 12:46 - 00308224 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-10 15:25 - 2012-08-01 06:35 - 01164957 _____ () C:\windows\WindowsUpdate.log
2015-03-10 15:24 - 2012-11-28 09:14 - 00000000 ____D () C:\Users\Kym Carter\AppData\Roaming\Skype
2015-03-10 15:22 - 2012-08-01 07:05 - 00000894 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-10 15:22 - 2012-08-01 06:34 - 00000828 _____ () C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2015-03-10 15:22 - 2009-07-14 15:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-03-10 15:22 - 2009-07-14 14:51 - 00102437 _____ () C:\windows\setupact.log
2015-03-10 14:38 - 2014-08-04 11:26 - 00000000 ____D () C:\Users\Kym Carter\Documents\Outlook Files
2015-03-10 13:51 - 2012-08-01 07:05 - 00000898 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-10 13:50 - 2012-04-10 13:56 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-03-10 13:03 - 2012-08-01 06:34 - 00000830 _____ () C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2015-03-10 11:54 - 2012-11-28 15:39 - 00000000 ____D () C:\Users\Kym Carter\Documents\My Scans
2015-03-10 09:05 - 2009-07-14 14:45 - 00025120 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-10 09:05 - 2009-07-14 14:45 - 00025120 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-05 12:06 - 2013-02-21 09:57 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-05 11:33 - 2010-11-21 13:47 - 00943050 _____ () C:\windows\PFRO.log
2015-03-05 11:16 - 2009-07-14 12:34 - 00000215 _____ () C:\windows\system.ini
2015-03-04 14:09 - 2009-07-14 15:13 - 00782510 _____ () C:\windows\system32\PerfStringBackup.INI
2015-03-04 12:43 - 2012-08-01 07:06 - 00000000 ____D () C:\Program Files\Google
2015-03-04 12:43 - 2012-08-01 07:05 - 00000000 ____D () C:\Program Files (x86)\Google
2015-03-04 10:43 - 2013-04-16 16:56 - 00000000 ____D () C:\Program Files (x86)\MyFree Codec
2015-03-04 10:41 - 2012-10-05 12:52 - 00000000 ____D () C:\Users\Kym Carter\AppData\Local\Google
2015-03-04 10:41 - 2012-08-01 07:06 - 00000000 ____D () C:\ProgramData\Google
2015-03-04 10:01 - 2012-11-28 17:16 - 00766820 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2015-03-03 23:17 - 2010-11-21 13:27 - 00295552 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2015-03-03 13:55 - 2013-01-08 12:06 - 00000000 ____D () C:\Users\Kym Carter\AppData\Local\CrashDumps
2015-03-02 09:27 - 2012-11-28 14:58 - 00004016 _____ () C:\windows\System32\Tasks\PC Checkup 3 Weekly Scan
2015-02-27 11:26 - 2014-11-11 16:26 - 00015129 _____ () C:\Users\Kym Carter\Documents\EXERCISES.odt
2015-02-27 08:31 - 2009-07-14 13:20 - 00000000 ____D () C:\windows\tracing
2015-02-26 08:05 - 2012-08-01 07:19 - 00000000 ____D () C:\ProgramData\Skype
2015-02-20 08:33 - 2009-07-14 15:08 - 00032574 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2015-02-14 10:47 - 2009-07-14 13:20 - 00000000 ____D () C:\windows\rescache
2015-02-12 08:32 - 2009-07-14 14:45 - 00409600 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-12 08:30 - 2014-12-11 08:31 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-12 08:30 - 2014-05-07 16:50 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-12 08:23 - 2013-04-02 17:12 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-12 08:23 - 2009-07-14 12:34 - 00000534 _____ () C:\windows\win.ini
2015-02-12 08:19 - 2012-11-28 19:00 - 00002128 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-02-12 08:19 - 2012-11-28 19:00 - 00001945 _____ () C:\windows\epplauncher.mif
2015-02-12 08:19 - 2012-11-28 19:00 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-02-12 08:19 - 2012-11-28 19:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2015-02-12 08:18 - 2013-08-14 16:50 - 00000000 ____D () C:\windows\system32\MRT
2015-02-12 08:10 - 2012-11-28 18:25 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-10 12:50 - 2012-04-10 13:56 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-10 12:50 - 2012-04-10 13:56 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-10 12:50 - 2012-04-10 13:56 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-10 12:46 - 2012-08-01 07:05 - 00003894 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-10 12:46 - 2012-08-01 07:05 - 00003642 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2012-11-29 09:28 - 2012-11-29 09:28 - 0000697 _____ () C:\Users\Kym Carter\AppData\Roaming\ConvAPIPlugin.log
2012-11-29 09:22 - 2012-11-29 09:35 - 0000942 _____ () C:\ProgramData\hpzinstall.log
ZeroAccess:
C:\Users\Kym Carter\AppData\Local\Google\Desktop\Install

Some content of TEMP:
====================
C:\Users\Kym Carter\AppData\Local\Temp\Quarantine.exe
C:\Users\Kym Carter\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-10 10:12

==================== End Of Log ============================

 

cheers

 

Bernie Dwyer

Attached Files



#4 dwywit

dwywit
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 10 March 2015 - 12:40 AM

I noticed the group policy restrictions flagged "ATTENTION" in FRST.txt - that's likely to be "Cryptoprevent" from Foolibleep, which I've taken to putting on all my customers' machines.

 

cheers

 

Bernie Dwyer



#5 dwywit

dwywit
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 10 March 2015 - 12:54 AM

Heh. I got filtered - it's "Cryptoprevent" from Foolish(capital I, capital T), not foolibleep :hysterical:

 

I can see how that would trip a "pottymouth" filter. Almost as good as expertsexchange.......



#6 nasdaq

nasdaq

  • Malware Response Team
  • 38,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:20 PM

Posted 10 March 2015 - 09:36 AM

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start

CloseProcesses:

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->  No File
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File
Toolbar: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 TDEIO; \??\C:\Windows\SysWOW64\sysprep\BOOTPRIO\tdeio64.sys [X]
AlternateDataStreams: C:\Users\Kym Carter\Documents\Charlie Young.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Christmas Newsletter from Livingstone.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Kara.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\lloyd.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Matusik on The Gold Coast Property Market.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Ray Clarke letter.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Re_ Door levers again ___.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Re_ Photos.eml:OECustomProperty
C:\Program Files (x86)\Splashtop

End
Save the files as fixlist.txt into the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Download Security Check by screen317 from here
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
p.s.
If the SecurityCheck program fails to run for any reason, run it as an Administrator.

If the site is busy or not available use this mirror site:
http://www.bleepingcomputer.com/download/securitycheck/

How is the computer running now?

======

#7 dwywit

dwywit
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 10 March 2015 - 05:43 PM

OK here's the logs:

************************************************************

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-03-2015 01
Ran by Kym Carter at 2015-03-11 08:13:44 Run:1
Running from C:\Users\Kym Carter\Desktop\farbar
Loaded Profiles: Kym Carter (Available profiles: Kym Carter)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start

CloseProcesses:

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->  No File
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File
Toolbar: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-1716261008-3710999165-130527589-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 TDEIO; \??\C:\Windows\SysWOW64\sysprep\BOOTPRIO\tdeio64.sys [X]
AlternateDataStreams: C:\Users\Kym Carter\Documents\Charlie Young.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Christmas Newsletter from Livingstone.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Kara.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\lloyd.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Matusik on The Gold Coast Property Market.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Ray Clarke letter.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Re_ Door levers again ___.eml:OECustomProperty
AlternateDataStreams: C:\Users\Kym Carter\Documents\Re_ Photos.eml:OECustomProperty
C:\Program Files (x86)\Splashtop

End
*****************

Processes closed successfully.
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe => No running process found
C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe => No running process found
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe => No running process found
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe => No running process found
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-1716261008-3710999165-130527589-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-1716261008-3710999165-130527589-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
"HKU\S-1-5-21-1716261008-3710999165-130527589-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key deleted successfully.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found.
HKU\S-1-5-21-1716261008-3710999165-130527589-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll not found.
C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll not found.
C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll not found.
C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll not found.
C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll not found.
c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll not found.
catchme => Service deleted successfully.
TDEIO => Service deleted successfully.
C:\Users\Kym Carter\Documents\Charlie Young.eml => ":OECustomProperty" ADS removed successfully.
C:\Users\Kym Carter\Documents\Christmas Newsletter from Livingstone.eml => ":OECustomProperty" ADS removed successfully.
C:\Users\Kym Carter\Documents\Kara.eml => ":OECustomProperty" ADS removed successfully.
C:\Users\Kym Carter\Documents\lloyd.eml => ":OECustomProperty" ADS removed successfully.
C:\Users\Kym Carter\Documents\Matusik on The Gold Coast Property Market.eml => ":OECustomProperty" ADS removed successfully.
C:\Users\Kym Carter\Documents\Ray Clarke letter.eml => ":OECustomProperty" ADS removed successfully.
C:\Users\Kym Carter\Documents\Re_ Door levers again ___.eml => ":OECustomProperty" ADS removed successfully.
C:\Users\Kym Carter\Documents\Re_ Photos.eml => ":OECustomProperty" ADS removed successfully.
C:\Program Files (x86)\Splashtop => Moved successfully.


The system needed a reboot.

==== End of Fixlog 08:13:45 ====

 

************************************************************

 Results of screen317's Security Check version 0.99.97  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Microsoft Security Essentials   
 Antivirus up to date!  
`````````Anti-malware/Other Utilities Check:`````````
  Java 64-bit 8 Update 31  
 Adobe Reader XI  
 Google Chrome (40.0.2214.111)
 Google Chrome (40.0.2214.115)
````````Process Check: objlist.exe by Laurent````````  
 Norton ccSvcHst.exe
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Symantec Norton Online Backup NOBuAgent.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````
 

 

************************************************************

 

I'll run the computer all day and see what happens. Last time I returned the computer to the customer, she said it was a few hours before anything popped up. Thanks for your help.



#8 dwywit

dwywit
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 10 March 2015 - 08:28 PM

Sadly, it's just popped up a new window pushing a porn site - http://adultcameras.info/.

 

I had IE browsing http://www.abc.net.au/news for a couple of hours, clicking on various links every few minutes, and it all seemed ok. Then, I clicked for a new tab and typed in www.bom.gov.au, which came up and a few seconds later the new window (not a new tab, a separate window) came up.

 

It seems to be clumsy/amateurish, as it's not re-sizeable, i.e. moving the cursor over the borders doesn't give the option to enlarge or shrink the window, and the maximise button is greyed out - but the content doesn't fit, so not all of the links are visible.

 

I can't post a screen dump directly - so I've attached the file popup.png

 

Here's the source code of the page (right-click, view source):

 

*********************************************************************************

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head><script type='text/javascript'>var _prvar=_prvar||new Object();    (function(pa,s){if(document.getElementById('pr4e5507b3'))return false;    pa=document.createElement('script');pa.type='text/javascript';pa.async=true;pa.id='pr4e5507b3';pa.src='//d.plugrush.com/pub.js';    s=document.getElementsByTagName('script')[0];s.parentNode.insertBefore(pa,s);})();</script><meta name="prVerify" content="42ab172ea147d36eeaf8acac5d7d63d9"/>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><script type="text/javascript">(window.NREUM||(NREUM={})).loader_config={xpid:"XA4BV1JVGwYJUllRAwQ="};window.NREUM||(NREUM={}),__nr_require=function(t,e,n){function r(n){if(!e[n]){var o=e[n]={exports:{}};t[n][0].call(o.exports,function(e){var o=t[n][1][e];return r(o?o:e)},o,o.exports)}return e[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var o=0;o<n.length;o++)r(n[o]);return r}({QJf3ax:[function(t,e){function n(t){function e(e,n,a){t&&t(e,n,a),a||(a={});for(var c=s(e),f=c.length,u=i(a,o,r),d=0;f>d;d++)c[d].apply(u,n);return u}function a(t,e){f[t]=s(t).concat(e)}function s(t){return f[t]||[]}function c(){return n(e)}var f={};return{on:a,emit:e,create:c,listeners:s,_events:f}}function r(){return{}}var o="nr@context",i=t("gos");e.exports=n()},{gos:"7eSDFh"}],ee:[function(t,e){e.exports=t("QJf3ax")},{}],3:[function(t){function e(t,e,n,i,s){try{c?c-=1:r("err",[s||new UncaughtException(t,e,n)])}catch(f){try{r("ierr",[f,(new Date).getTime(),!0])}catch(u){}}return"function"==typeof a?a.apply(this,o(arguments)):!1}function UncaughtException(t,e,n){this.message=t||"Uncaught error with no additional information",this.sourceURL=e,this.line=n}function n(t){r("err",[t,(new Date).getTime()])}var r=t("handle"),o=t(5),i=t("ee"),a=window.onerror,s=!1,c=0;t("loader").features.err=!0,window.onerror=e;try{throw new Error}catch(f){"stack"in f&&(t(1),t(4),"addEventListener"in window&&t(2),window.XMLHttpRequest&&XMLHttpRequest.prototype&&XMLHttpRequest.prototype.addEventListener&&t(3),s=!0)}i.on("fn-start",function(){s&&(c+=1)}),i.on("fn-err",function(t,e,r){s&&(this.thrown=!0,n®)}),i.on("fn-end",function(){s&&!this.thrown&&c>0&&(c-=1)}),i.on("internal-error",function(t){r("ierr",[t,(new Date).getTime(),!0])})},{1:8,2:5,3:9,4:7,5:22,ee:"QJf3ax",handle:"D5DuLP",loader:"G9z0Bl"}],4:[function(t){function e(){}if(window.performance&&window.performance.timing&&window.performance.getEntriesByType){var n=t("ee"),r=t("handle"),o=t(1);t("loader").features.stn=!0,t(2),n.on("fn-start",function(t){var e=t[0];e instanceof Event&&(this.bstStart=Date.now())}),n.on("fn-end",function(t,e){var n=t[0];n instanceof Event&&r("bst",[n,e,this.bstStart,Date.now()])}),o.on("fn-start",function(t,e,n){this.bstStart=Date.now(),this.bstType=n}),o.on("fn-end",function(t,e){r("bstTimer",[e,this.bstStart,Date.now(),this.bstType])}),n.on("pushState-start",function(){this.time=Date.now(),this.startPath=location.pathname+location.hash}),n.on("pushState-end",function(){r("bstHist",[location.pathname+location.hash,this.startPath,this.time])}),"addEventListener"in window.performance&&(window.performance.addEventListener("webkitresourcetimingbufferfull",function(){r("bstResource",[window.performance.getEntriesByType("resource")]),window.performance.webkitClearResourceTimings()},!1),window.performance.addEventListener("resourcetimingbufferfull",function(){r("bstResource",[window.performance.getEntriesByType("resource")]),window.performance.clearResourceTimings()},!1)),document.addEventListener("scroll",e,!1),document.addEventListener("keypress",e,!1),document.addEventListener("click",e,!1)}},{1:8,2:6,ee:"QJf3ax",handle:"D5DuLP",loader:"G9z0Bl"}],5:[function(t,e){function n(t){i.inPlace(t,["addEventListener","removeEventListener"],"-",r)}function r(t){return t[1]}var o=(t(1),t("ee").create()),i=t(2)(o),a=t("gos");if(e.exports=o,n(window),"getPrototypeOf"in Object){for(var s=document;s&&!s.hasOwnProperty("addEventListener");)s=Object.getPrototypeOf(s);s&&n(s);for(var c=XMLHttpRequest.prototype;c&&!c.hasOwnProperty("addEventListener");)c=Object.getPrototypeOf©;c&&n©}else XMLHttpRequest.prototype.hasOwnProperty("addEventListener")&&n(XMLHttpRequest.prototype);o.on("addEventListener-start",function(t){if(t[1]){var e=t[1];"function"==typeof e?this.wrapped=t[1]=a(e,"nr@wrapped",function(){return i(e,"fn-",null,e.name||"anonymous")}):"function"==typeof e.handleEvent&&i.inPlace(e,["handleEvent"],"fn-")}}),o.on("removeEventListener-start",function(t){var e=this.wrapped;e&&(t[1]=e)})},{1:22,2:23,ee:"QJf3ax",gos:"7eSDFh"}],6:[function(t,e){var n=(t(2),t("ee").create()),r=t(1)(n);e.exports=n,r.inPlace(window.history,["pushState"],"-")},{1:23,2:22,ee:"QJf3ax"}],7:[function(t,e){var n=(t(2),t("ee").create()),r=t(1)(n);e.exports=n,r.inPlace(window,["requestAnimationFrame","mozRequestAnimationFrame","webkitRequestAnimationFrame","msRequestAnimationFrame"],"raf-"),n.on("raf-start",function(t){t[0]=r(t[0],"fn-")})},{1:23,2:22,ee:"QJf3ax"}],8:[function(t,e){function n(t,e,n){var r=t[0];"string"==typeof r&&(r=new Function®),t[0]=o(r,"fn-",null,n)}var r=(t(2),t("ee").create()),o=t(1)®;e.exports=r,o.inPlace(window,["setTimeout","setInterval","setImmediate"],"setTimer-"),r.on("setTimer-start",n)},{1:23,2:22,ee:"QJf3ax"}],9:[function(t,e){function n(){c.inPlace(this,d,"fn-")}function r(t,e){c.inPlace(e,["onreadystatechange"],"fn-")}function o(t,e){return e}var i=t("ee").create(),a=t(1),s=t(2),c=s(i),f=s(a),u=window.XMLHttpRequest,d=["onload","onerror","onabort","onloadstart","onloadend","onprogress","ontimeout"];e.exports=i,window.XMLHttpRequest=function(t){var e=new u(t);try{i.emit("new-xhr",[],e),f.inPlace(e,["addEventListener","removeEventListener"],"-",function(t,e){return e}),e.addEventListener("readystatechange",n,!1)}catch®{try{i.emit("internal-error",[r])}catch(o){}}return e},window.XMLHttpRequest.prototype=u.prototype,c.inPlace(XMLHttpRequest.prototype,["open","send"],"-xhr-",o),i.on("send-xhr-start",r),i.on("open-xhr-start",r)},{1:5,2:23,ee:"QJf3ax"}],10:[function(t){function e(t){if("string"==typeof t&&t.length)return t.length;if("object"!=typeof t)return void 0;if("undefined"!=typeof ArrayBuffer&&t instanceof ArrayBuffer&&t.byteLength)return t.byteLength;if("undefined"!=typeof Blob&&t instanceof Blob&&t.size)return t.size;if("undefined"!=typeof FormData&&t instanceof FormData)return void 0;try{return JSON.stringify(t).length}catch(e){return void 0}}function n(t){var n=this.params,r=this.metrics;if(!this.ended){this.ended=!0;for(var i=0;c>i;i++)t.removeEventListener(s[i],this.listener,!1);if(!n.aborted){if(r.duration=(new Date).getTime()-this.startTime,4===t.readyState){n.status=t.status;var a=t.responseType,f="arraybuffer"===a||"blob"===a||"json"===a?t.response:t.responseText,u=e(f);if(u&&(r.rxSize=u),this.sameOrigin){var d=t.getResponseHeader("X-NewRelic-App-Data");d&&(n.cat=d.split(", ").pop())}}else n.status=0;r.cbTime=this.cbTime,o("xhr",[n,r,this.startTime])}}}function r(t,e){var n=i(e),r=t.params;r.host=n.hostname+":"+n.port,r.pathname=n.pathname,t.sameOrigin=n.sameOrigin}if(window.XMLHttpRequest&&XMLHttpRequest.prototype&&XMLHttpRequest.prototype.addEventListener&&!/CriOS/.test(navigator.userAgent)){t("loader").features.xhr=!0;var o=t("handle"),i=t(2),a=t("ee"),s=["load","error","abort","timeout"],c=s.length,f=t(1);t(4),t(3),a.on("new-xhr",function(){this.totalCbs=0,this.called=0,this.cbTime=0,this.end=n,this.ended=!1,this.xhrGuids={}}),a.on("open-xhr-start",function(t){this.params={method:t[0]},r(this,t[1]),this.metrics={}}),a.on("open-xhr-end",function(t,e){"loader_config"in NREUM&&"xpid"in NREUM.loader_config&&this.sameOrigin&&e.setRequestHeader("X-NewRelic-ID",NREUM.loader_config.xpid)}),a.on("send-xhr-start",function(t,n){var r=this.metrics,o=t[0],i=this;if(r&&o){var f=e(o);f&&(r.txSize=f)}this.startTime=(new Date).getTime(),this.listener=function(t){try{"abort"===t.type&&(i.params.aborted=!0),("load"!==t.type||i.called===i.totalCbs&&(i.onloadCalled||"function"!=typeof n.onload))&&i.end(n)}catch(e){try{a.emit("internal-error",[e])}catch®{}}};for(var u=0;c>u;u++)n.addEventListener(s[u],this.listener,!1)}),a.on("xhr-cb-time",function(t,e,n){this.cbTime+=t,e?this.onloadCalled=!0:this.called+=1,this.called!==this.totalCbs||!this.onloadCalled&&"function"==typeof n.onload||this.end(n)}),a.on("xhr-load-added",function(t,e){var n=""+f(t)+!!e;this.xhrGuids&&!this.xhrGuids[n]&&(this.xhrGuids[n]=!0,this.totalCbs+=1)}),a.on("xhr-load-removed",function(t,e){var n=""+f(t)+!!e;this.xhrGuids&&this.xhrGuids[n]&&(delete this.xhrGuids[n],this.totalCbs-=1)}),a.on("addEventListener-end",function(t,e){e instanceof XMLHttpRequest&&"load"===t[0]&&a.emit("xhr-load-added",[t[1],t[2]],e)}),a.on("removeEventListener-end",function(t,e){e instanceof XMLHttpRequest&&"load"===t[0]&&a.emit("xhr-load-removed",[t[1],t[2]],e)}),a.on("fn-start",function(t,e,n){e instanceof XMLHttpRequest&&("onload"===n&&(this.onload=!0),("load"===(t[0]&&t[0].type)||this.onload)&&(this.xhrCbStart=(new Date).getTime()))}),a.on("fn-end",function(t,e){this.xhrCbStart&&a.emit("xhr-cb-time",[(new Date).getTime()-this.xhrCbStart,this.onload,e],e)})}},{1:"XL7HBI",2:11,3:9,4:5,ee:"QJf3ax",handle:"D5DuLP",loader:"G9z0Bl"}],11:[function(t,e){e.exports=function(t){var e=document.createElement("a"),n=window.location,r={};e.href=t,r.port=e.port;var o=e.href.split("://");return!r.port&&o[1]&&(r.port=o[1].split("/")[0].split("@").pop().split(":")[1]),r.port&&"0"!==r.port||(r.port="https"===o[0]?"443":"80"),r.hostname=e.hostname||n.hostname,r.pathname=e.pathname,r.protocol=o[0],"/"!==r.pathname.charAt(0)&&(r.pathname="/"+r.pathname),r.sameOrigin=!e.hostname||e.hostname===document.domain&&e.port===n.port&&e.protocol===n.protocol,r}},{}],12:[function(t,e){function n(t){return function(){r(t,[(new Date).getTime()].concat(i(arguments)))}}var r=t("handle"),o=t(1),i=t(2);"undefined"==typeof window.newrelic&&(newrelic=window.NREUM);var a=["setPageViewName","trackUserAction","finished","traceEvent","inlineHit","noticeError"];o(a,function(t,e){window.NREUM[e]=n("api-"+e)}),e.exports=window.NREUM},{1:21,2:22,handle:"D5DuLP"}],gos:[function(t,e){e.exports=t("7eSDFh")},{}],"7eSDFh":[function(t,e){function n(t,e,n){if(r.call(t,e))return t[e];var o=n();if(Object.defineProperty&&Object.keys)try{return Object.defineProperty(t,e,{value:o,writable:!0,enumerable:!1}),o}catch(i){}return t[e]=o,o}var r=Object.prototype.hasOwnProperty;e.exports=n},{}],D5DuLP:[function(t,e){function n(t,e,n){return r.listeners(t).length?r.emit(t,e,n):(o[t]||(o[t]=[]),void o[t].push(e))}var r=t("ee").create(),o={};e.exports=n,n.ee=r,r.q=o},{ee:"QJf3ax"}],handle:[function(t,e){e.exports=t("D5DuLP")},{}],XL7HBI:[function(t,e){function n(t){var e=typeof t;return!t||"object"!==e&&"function"!==e?-1:t===window?0:i(t,o,function(){return r++})}var r=1,o="nr@id",i=t("gos");e.exports=n},{gos:"7eSDFh"}],id:[function(t,e){e.exports=t("XL7HBI")},{}],G9z0Bl:[function(t,e){function n(){var t=l.info=NREUM.info;if(t&&t.licenseKey&&t.applicationID&&f&&f.body){s(h,function(e,n){e in t||(t[e]=n)}),l.proto="https"===p.split(":")[0]||t.sslForHttp?"https://":"http://",a("mark",["onload",i()]);var e=f.createElement("script");e.src=l.proto+t.agent,f.body.appendChild(e)}}function r(){"complete"===f.readyState&&o()}function o(){a("mark",["domContent",i()])}function i(){return(new Date).getTime()}var a=t("handle"),s=t(1),c=(t(2),window),f=c.document,u="addEventListener",d="attachEvent",p=(""+location).split("?")[0],h={beacon:"bam.nr-data.net",errorBeacon:"bam.nr-data.net",agent:"js-agent.newrelic.com/nr-536.min.js"},l=e.exports={offset:i(),origin:p,features:{}};f[u]?(f[u]("DOMContentLoaded",o,!1),c[u]("load",n,!1)):(f[d]("onreadystatechange",r),c[d]("onload",n)),a("mark",["firstbyte",i()])},{1:21,2:12,handle:"D5DuLP"}],loader:[function(t,e){e.exports=t("G9z0Bl")},{}],21:[function(t,e){function n(t,e){var n=[],o="",i=0;for(o in t)r.call(t,o)&&(n[i]=e(o,t[o]),i+=1);return n}var r=Object.prototype.hasOwnProperty;e.exports=n},{}],22:[function(t,e){function n(t,e,n){e||(e=0),"undefined"==typeof n&&(n=t?t.length:0);for(var r=-1,o=n-e||0,i=Array(0>o?0:o);++r<o;)i[r]=t[e+r];return i}e.exports=n},{}],23:[function(t,e){function n(t){return!(t&&"function"==typeof t&&t.apply&&!t[i])}var r=t("ee"),o=t(1),i="nr@wrapper",a=Object.prototype.hasOwnProperty;e.exports=function(t){function e(t,e,r,a){function nrWrapper(){var n,i,s,f;try{i=this,n=o(arguments),s=r&&r(n,i)||{}}catch(d){u([d,"",[n,i,a],s])}c(e+"start",[n,i,a],s);try{return f=t.apply(i,n)}catch(p){throw c(e+"err",[n,i,p],s),p}finally{c(e+"end",[n,i,f],s)}}return n(t)?t:(e||(e=""),nrWrapper[i]=!0,f(t,nrWrapper),nrWrapper)}function s(t,r,o,i){o||(o="");var a,s,c,f="-"===o.charAt(0);for(c=0;c<r.length;c++)s=r[c],a=t[s],n(a)||(t[s]=e(a,f?s+o:o,i,s,t))}function c(e,n,r){try{t.emit(e,n,r)}catch(o){u([o,e,n,r])}}function f(t,e){if(Object.defineProperty&&Object.keys)try{var n=Object.keys(t);return n.forEach(function(n){Object.defineProperty(e,n,{get:function(){return t[n]},set:function(e){return t[n]=e,e}})}),e}catch®{u([r])}for(var o in t)a.call(t,o)&&(e[o]=t[o]);return e}function u(e){try{t.emit("internal-error",e)}catch(n){}}return t||(t=r),e.inPlace=s,e.flag=i,e}},{1:22,ee:"QJf3ax"}]},{},["G9z0Bl",3,10,4]);</script>
<meta name="verify-v1" content="8+tZZa8qv7Nv/4933aj3/EU0LYuRowvA/IJwmr9IwdU="/>
<meta name=description content="adultcamerasdelivers free sex movies and fast free porn videos (tube porn). Now 1 million+ sex vids available for free! Featuring hot pussy, sexy girls in xxx rated porn clips.">
<meta name=keywords content="porn,porn movies,free porn,free porn movies,sex,porno,free sex,tube porn,tube,videos,full porn,xxnx,xnxxx,xxx,pussy">
<title>Free Porn, Sex, Tube Videos, XXX Pics, Pussy in Porno Movies - adultcameras.info</title>
<link REL="SHORTCUT ICON" HREF="http://img100.xvideos.com/adultcameras.info/pics/favicon.ico" type="image/x-icon">
<link rel="meta" href="http://adultcameras.info/labels.rdf" type="application/rdf+xml" title="ICRA labels"/>
<meta http-equiv="pics-Label" content='(pics-1.1 "http://www.icra.org/pics/vocabularyv03/" l gen true for "http://adultcameras.info" r (n 3 s 3 v 0 l 3 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 3) gen true for "http://adultcameras.info" r (n 3 s 3 v 0 l 3 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 3))'/>
<meta name="RATING" content="RTA-5042-1996-1400-1577-RTA"/>
<style type="text/css">ul,ol{margin:0px;padding:0px;list-style-type:square;}.thumbs .ti li{padding:0;width:242px;min-height:210px;display:-moz-inline-stack;display:inline-block;vertical-align:top;margin:3px;zoom:1;*display:inline;_height:210px;position:relative;z-index:99;}.thumbs .ti *{vertical-align:top;}.thumbs .ti li img{position:relative;z-index:99;list-style-type:none;}.thumbs .ti li a img{border:1px solid #323630;}.thumbs .ti li a:hover img{border:1px solid #ffffff;}.thumbs .ti li p.right{width:19%;float:right;text-align:right;display:inline;}.thumbs .ti li p.left{width:80%;float:left;text-align:left;display:inline;}.thumbs span a:link,.thumbs span a:visited,.thumbs span a:active,.thumbs span a:hover{color:black;text-decoration:none;font-size:12px;}.thumbs span a:hover{text-decoration:none;}<!--
  body,td,th {
    color: #ffffff;
    font-size: 12px;
    font-family: Arial, Helvetica, sans-serif;
  }
  body {
    background-attachment:scroll;
    background-image:url(http://img100.xvideos.com/adultcameras.info/pics/xnb.gif);
    background-repeat:repeat-x;
    background-position:top;
    background-color: #e87b9a;
    margin-left: 0px;
    margin-top: 2px;
    margin-right: 0px;
    margin-bottom: 0px;
  }
  --></style>
<style type="text/css"><!--
  a:visited {
    color: #ffffff;
  }
  a:hover {
    color: #ffff00;
  }
  a:active {
    color: #ffffff;
  }
  a:link {
    color: #ffffff;
  }
 
  a.miniature:visited {
    color: #ffffff;
    text-decoration:none;
  }
  a.miniature:hover {
    color: #ffffff;
    text-decoration:none;
  }
  a.miniature:active {
    color: #ffffff;
    text-decoration:none;
  }
  a.miniature:link {
    color: #ffffff;
    text-decoration:none;
  }
 
  .pag,#pag{padding:0;margin:2.3em 0 0 0;float:left;width:100%}
  .pag:before,#pag:before,#results_area:after,#ab:before{content:".";display:block;clear:both;visibility:hidden;height:0}
  .pag a,#pag a{font-size:140%;display:block;float:left;cursor:pointer;text-decoration:none;display:inline-block;border:1px solid #004be8;padding:.2em .5em;margin:0 .20em 0 0;text-align:center}
  .pag a.pP,.pag a.nP,#pag a.pP,#pag a.nP{font-size:140%;padding:.2em .5em;border:none;text-decoration:underline;font-weight:700;background:#dd3a68}
  .pag a:hover,#pag a:hover{background:#004be8;border:1px solid #fff}
 
 
  .pag a.sel,#pag a.sel{color:#fff;font-weight:normal;background:#dd3a68;border:1px solid #fff}
  a:hover.pP,a:hover.nP,#pag a:hover.pP,#pag a:hover.nP{background:#004be8;border:none}
  .pag a.dis,#pag a.dis{display:none}
 
  p, div, h1, h2, h3, h4, h5, ul, li { margin: 0; padding: 0;    }
  ul { list-style: none;    }
 
  #siteNav { background: #dd3a68; width: 100%; height: 33px;}
 
  #siteNav a { text-decoration: none; display: block;    }
 
  #siteNav ul { margin-left: 1px; padding-top: 1px;    }
    
 
  #siteNav li { float: left; position: relative; font-size: 14px; text-align: center;    }
    #siteNav li a { padding: 8px 12px 8px 12px; border-right:1px dotted #dd3a68;}
    #siteNav li a:link { background: transparent no-repeat right bottom; color: #fff;    }
    #siteNav li a:visited { background: transparent no-repeat right bottom; color: #fff;    }
    #siteNav li a:hover { background: #0321AB ; color: #fff; }
    #siteNav li.current a { margin-bottom: -1px;    }
    #siteNav li.current a:link ,#siteNav li.current a:hover { background-color: #ffffff; background-image: none; cursor: default; color: #37454e; border-bottom: 1px solid #fff;    }
 
    #news #newsnav a
    { margin-bottom: -1px;    }
    
    #news #newsnav ul
    { padding-bottom: 1px;    }
    
    
  #topnav input.query {
    font: 129% arial;
    padding: 2px 5px;
    width: 200px;
    margin-right: 5px;
  }
 
  #topnav input.searchbutton {
    font: bold 114% arial;
    height: 26px;
    width: 80px;
  }    
  .Style1 {color:#FFFF00;font-weight:bold;;font-size:16px}
  .borderxn {
    height: 180px;
    width: 240px;
    border: 1px solid black;
  }
  --></style>
<script type="text/javascript" language="JavaScript">
  <!--
  function bookmarksite(title, url) {
  if (document.all) {
  window.external.AddFavorite(url, title);
  } else if (window.sidebar) {
  window.sidebar.addPanel(title, url, '');
  }
  }
  //-->
  </script>
<script type="text/javascript">
          var master_url = "adultcameras.info";
  </script>
<script type="text/javascript" language="JavaScript" src="http://static.xvideos.com/vote/displayFlash.js"></script>
<script type="text/javascript" language="JavaScript" src="http://static.xvideos.com/js/mobile.js"></script>
<script type="text/javascript">
      mobileRedirectIfMobile();
  </script>
<script language="javascript" type="text/javascript">
  <!--
  /* WPN ad configuration */
  var wpn_ad_configuration = [{"type":"tower","nb_ban":1,"div_id":"wpn_ad_tower"},{"type":"footer","nb_ban":1,"div_id":"wpn_ad_footer"}];
  var wpn_ad_site = "xvideos";
  var wpn_ad_category = "";
  -->
  </script>
<meta name="alexaVerifyID" content="MUONvntuOF8MyVlxsR4NrJ9QSiI"/></head>
<body>
<script language="JAVASCRIPT" type="text/javascript">
      if ("EU" == "TW" || "EU" == "DE") {
        displayDisclamer("adultcameras.info");
      }
          //document.write(unescape("%3Cscript src%3D%27%2Fin.php%3Freferer%3D") + escape(document.referrer) + unescape("%27 language%3D%27Javascript%27 type%3D%27text%2Fjavascript%27%3E%3C%2Fscript%3E"));
  </script>
<div align="center">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="925">
<tr>
<td width="150"><div align="left"></div></td>
<td width="310" id="topnav">
<form action="http://adultcameras.info/" method="get">
<table>
<tbody>
<tr>
</tr>
</tbody>
</table>
</form>
</td>
<td></td>
<td></td>
 
</tr>
</table>
<br clear="all">
<div id="siteNav" style="border-bottom:1px solid #dd3a68;">
<ul>
<li id="newsnav"><a href="http://adultcameras.info/new/">New Videos</a></li>
<li id="newsnav"><a href="http://adultcameras.info/best/">Best Of</a></li>
<li id="newsnav"><a href="http://adultcameras.info/hot/">Hot</a></li>
<li id="newsnav"><a href="http://adultcameras.info/hits/">Hits</a></li>
<li id="newsnav"><a href="http://adultcameras.info/tags/">Tags</a></li>
</ul>
</div>
<br>
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td width="167" valign="top" nowrap>
<p style="font-size:17px;">
<br>
<a href="http://adultcameras.info/"></a>
<br>
<br>
<b>ALL SEX VIDEOS:</b>
<br>
<a href="http://adultcameras.info/c/Teen-13">18</a><br>
<a href="http://adultcameras.info/c/Amateur-17">Amateur</a><br>
<a href="http://adultcameras.info/tags/american">American</a><br>
<a href="http://adultcameras.info/c/Anal-12">Anal Sex </a><br>
<a href="http://adultcameras.info/c/Anime-41">Anime</a><br>
<a href="http://adultcameras.info/tags/arab">Arab / Arabian</a><br>
<a href="http://adultcameras.info/c/Asian Woman-32">Asian Woman</a><br>
<a href="http://adultcameras.info/c/Ass-14">Ass</a><br>
<a href="http://adultcameras.info/tags/gape">Ass gaping</a><br>
<a href="http://adultcameras.info/c/Ass to Mouth-29">Ass to Mouth</a><br>
<a href="http://adultcameras.info/c/Anal-12">Ass bleeped</a><br>
<a href="http://adultcameras.info/tags/babysitter">Babysitter</a><br>
<a href="http://adultcameras.info/c/bbw-51">BBW</a><br>
<a href="http://adultcameras.info/c/BDSM-44">BDSM</a><br>
<a href="http://adultcameras.info/tags/beach">Beach Sex </a><br>
<a href="http://adultcameras.info/c/Big Ass-24">Big Ass</a><br>
<a href="http://adultcameras.info/c/Big Cock-34">Big Cock</a><br>
<a href="http://adultcameras.info/c/bbw-51">Big Girl</a><br>
<a href="http://adultcameras.info/c/Big Tits-23">Big Tits</a><br>
<a href="http://adultcameras.info/c/Black%20Woman-30">Black Girls</a><br>
<a href="http://adultcameras.info/c/Brunette-25">Black Hair</a><br>
<a href="http://adultcameras.info/c/Blonde-20">Blonde</a><br>
<a href="http://adultcameras.info/c/Blowjob-15">Blowjob</a><br>
<a href="http://adultcameras.info/tags/bondage">Bondage</a><br>
<a href="http://adultcameras.info/tags/brazilian">Brazilian</a><br>
<a href="http://adultcameras.info/c/Brunette-25">Brunette</a><br>
<a href="http://adultcameras.info/c/Ass-14">Butt</a><br>
<a href="http://adultcameras.info/tags/webcam">Cam videos</a><br>
<a href="http://adultcameras.info/tags/casting">Casting</a><br>
<a href="http://adultcameras.info/tags/chubby">Chubby</a><br>
<a href="http://adultcameras.info/">Classic View</a><br>
<a href="http://adultcameras.info/tags/classic">Classic Porn</a><br>
<a href="http://adultcameras.info/3thumbs/movie/d/on/small/all/index.html">Clips (small)</a><br>
<a href="http://adultcameras.info/tags/college">College</a><br>
<a href="http://adultcameras.info/tags/compilation">Compilation</a><br>
<a href="http://adultcameras.info/c/Creampie-40">Creampie</a><br>
<a href="http://adultcameras.info/c/Cumshot-18">Cumshot</a><br>
<a href="http://adultcameras.info/tags/deepthroat">Deepthroat</a><br>
<a href="http://adultcameras.info/tags/doctor">Doctor</a><br>
<a href="http://adultcameras.info/c/Black Woman-30">Ebony</a><br>
<a href="http://adultcameras.info/tags/girlfriend">Ex-Girlfriend</a><br>
<a href="http://adultcameras.info/tags/public">Exhibitionism</a><br>
<a href="http://adultcameras.info/tags/fat">Fat</a><br>
<a href="http://adultcameras.info/tags/squirting">Female Ejaculation</a><br>
<a href="http://adultcameras.info/tags/fisting">Fisting / Fist-bleep</a><br>
<a href="http://adultcameras.info/tags/french">French / France</a><br>
<a href="http://adultcameras.info/tags/bleeped">bleeped / bleep</a><br>
<a href="http://adultcameras.info/tags/gagging">Gagging</a><br>
<a href="http://adultcameras.info/">Galleries</a><br>
<a href="http://adultcameras.info/tags/gangbang">Gangbang</a><br>
<a href="http://adultcameras.info/tags/gaping">Gape / Gaping </a><br>
<a href="http://adultcameras.info/c/Gay-45">Gay Porn </a><br>
<a href="http://adultcameras.info/tags/german">German</a><br>
<a href="http://adultcameras.info/tags/girlfriend">Girlfriend / GF</a><br>
<a href="http://adultcameras.info/tags/granny">Granny</a><br>
<a href="http://adultcameras.info/tags/hairy">Hairy pussy</a><br>
<a href="http://adultcameras.info/tags/handjob">Handjob</a><br>
<a href="http://adultcameras.info/c/Hardcore-35">Hardcore</a><br>
<a href="http://adultcameras.info/c/Heels-43">Heels</a><br>
<a href="http://adultcameras.info/tags/homemade">Homemade</a><br>
<a href="http://adultcameras.info/c/Huge%20Tits-46">Huge Tits </a><br>
<a href="http://adultcameras.info/">Images (XXX) </a><br>
<a href="http://adultcameras.info/tags/indian">India / Indian girls</a><br>
<a href="http://adultcameras.info/c/Interracial-27">Interracial</a><br>
<a href="http://adultcameras.info/tags/italian">Italian</a><br>
<a href="http://adultcameras.info/tags/japanese">Jap / Japanese</a><br>
<a href="http://adultcameras.info/c/Latina-16">Latina</a><br>
<a href="http://adultcameras.info/c/Lesbian-26">Lesbian</a><br>
<a href="http://adultcameras.info/tags/maid">Maid</a><br>
<a href="http://adultcameras.info/tags/massage">Massage</a><br>
<a href="http://adultcameras.info/tags/masturbation">Masturbation</a><br>
<a href="http://adultcameras.info/tags/mature">Mature Women</a><br>
<a href="http://adultcameras.info/c/Milf-19">Milf</a><br>
<a href="http://adultcameras.info/tags/mom">Mom videos</a><br>
<a href="http://adultcameras.info/tags/nurse">Nurse</a><br>
<a href="http://adultcameras.info/tags/office">Office / Work</a><br>
<a href="http://adultcameras.info/c/Oiled-22">Oiled</a><br>
<a href="http://adultcameras.info/tags/orgasm">Orgasm (female)</a><br>
<a href="http://adultcameras.info/tags/orgy">Orgy</a><br>
<a href="http://adultcameras.info/tags/party">Party</a><br>
<a href="http://adultcameras.info/">Pics / Pictures </a><br>
<a href="http://adultcameras.info/">Photos</a><br>
<a href="http://adultcameras.info/tags/pornstar">Pornstar</a><br>
<a href="http://adultcameras.info/tags/POV">POV (Point of view)</a><br>
<a href="http://adultcameras.info/tags/pregnant">Pregnant</a><br>
<a href="http://adultcameras.info/tags/public">Public</a><br>
<a href="http://adultcameras.info/tags/pussy">Pussy</a><br>
<a href="http://adultcameras.info/tags/pussybleep">Pussy bleep</a><br>
<a href="http://adultcameras.info/tags/squirting">Pussy Squirting</a><br>
<a href="http://adultcameras.info/c/Amateur-17">REAL Amateur</a><br>
<a href="http://adultcameras.info/c/Redhead-31">Redhead</a><br>
<a href="http://adultcameras.info/tags/retro">Retro</a><br>
<a href="http://adultcameras.info/tags/russian">Russian</a><br>
<a href="http://adultcameras.info/tags/school">School</a><br>
<a href="http://adultcameras.info/tags/schoolgirl">Schoolgirl</a><br>
<a href="http://adultcameras.info/tags/secretary">Secretary</a><br>
<a href="http://adultcameras.info/c/Sexy-42">Sexy Girls</a><br>
<a href="http://adultcameras.info/c/Shaved%20Pussy-39">Shaved Pussy</a><br>
<a href="http://adultcameras.info/c/Shemale-36">Shemale</a><br>
<a href="http://adultcameras.info/3thumbs/movie/d/on/small/all/index.html">Small movies</a><br>
<a href="http://adultcameras.info/tags/smalltits">Small tits</a><br>
<a href="http://adultcameras.info/c/Solo & Masturbation-33">Solo Girls </a><br>
<a href="http://adultcameras.info/tags/squirting">Squirting</a><br>
<a href="http://adultcameras.info/c/Stockings-28">Stockings</a><br>
<a href="http://adultcameras.info/c/Blowjob-15">Sucking</a><br>
<a href="http://adultcameras.info/tags/">Tags (all)</a><br>
<a href="http://adultcameras.info/tags/teacher">Teacher</a><br>
<a href="http://adultcameras.info/c/Teen-13">Teen Porn</a><br>
<a href="http://adultcameras.info/tags/throatbleep">Throat-bleep</a><br>
<a href="http://adultcameras.info/c/Shemale-36">Transsexual, TS</a><br>
<a href="http://adultcameras.info/c/Shemale-36">Tranny, Trans</a><br>
<a href="http://adultcameras.info/tags/college">University</a><br>
<a href="http://adultcameras.info/tags/vintage">Vintage Porno </a><br>
<a href="http://adultcameras.info/tags/virgin">Virgin / Virginity</a><br>
<a href="http://adultcameras.info/c/Cam_Porn-58">Webcam videos</a><br>
<a href="http://adultcameras.info/tags/wife">Wife</a><br>
<a href="http://adultcameras.info/c/Teen-13">Young Girls (18+)</a><br>
<a href="http://adultcameras.info/tags/">More... (full list)</a><br>
<br>
<br>
<br>
<br>
</p>
</td>
<td valign="top">
<div style="border-bottom: 2px solid #dd3a68; border-top: 1px solid #dd3a68; background: #dd3a68; font-size:16px;">
<div style="border-bottom: 1px solid #dd3a68; border-top: 2px solid #dd3a68; padding: 5px;">
<div style="float: left; width: 70%;">
<strong>FREE PORN VIDEOS</strong> Showing most popular <b>60 / <a href="http://adultcameras.info/new/">6,032,732</a></b> videos total
</div>
<div style="text-align: center;">
<a href="http://adultcameras.info/hot/">More Hot Sex Videos</a>
</div>
</div>
</div>
<div id="content">
<div id="pag" style="margin: 0pt; padding: 0pt; ">
<a class="sel">You are here</a>
<a class="sel">1</a>
<a href="http://adultcameras.info/home/1">2</a>
<a href="http://adultcameras.info/home/2">3</a>
<a href="http://adultcameras.info/home/3">4</a>
<a href="http://adultcameras.info/home/4">5</a>
<a href="http://adultcameras.info/home/5">6</a>
<a href="http://adultcameras.info/home/6">7</a>
<a href="http://adultcameras.info/home/7">8</a>
<a href="http://adultcameras.info/home/8">9</a>
<a href="http://adultcameras.info/home/9">10</a>
</div>
</div>
<div style="border-left: 1px solid #000000; border-right: 1px solid #000000; padding: 2px; text-align: center;">
<div class="thumbs">
<ul class="ti">
 
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video2205791/0/02-big_wet_butts" class="miniature">
<img src="http://img100-791.xvideos.com/videos/thumbsl/3d/4e/09/3d4e09ea6d04bb5a0bf0a17bf85fb598/3d4e09ea6d04bb5a0bf0a17bf85fb598.16.jpg" onMouseOver="startThumbSlide('2205791', '16', 'http://img100-791.xvideos.com/videos/thumbs/3d/4e/09/3d4e09ea6d04bb5a0bf0a17bf85fb598/3d4e09ea6d04bb5a0bf0a17bf85fb598.')" onMouseOut='stopThumbSlide();' id='pic_2205791' onload="pictureserror_pictureLoaded(2205791)" onerror="pictureserror_pictureError(2205791)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="02-Big wet butts">02-Big wet butts</span><br>
<font color="#f8fbff">5 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10730852/0/hidden_cam_happy_ending_14" class="miniature">
<img src="http://img100-852.xvideos.com/videos/thumbsl/63/6e/c5/636ec5992927fea28a77f932f2307925/636ec5992927fea28a77f932f2307925.7.jpg" onMouseOver="startThumbSlide('10730852', '7', 'http://img100-852.xvideos.com/videos/thumbs/63/6e/c5/636ec5992927fea28a77f932f2307925/636ec5992927fea28a77f932f2307925.')" onMouseOut='stopThumbSlide();' id='pic_10730852' onload="pictureserror_pictureLoaded(10730852)" onerror="pictureserror_pictureError(10730852)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Hidden Cam Happy Ending 14">Hidden Cam Happy Ending 14</span><br>
<font color="#f8fbff">24 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10608682/0/vanessa_figueroa_bleep_perfection" class="miniature">
<img src="http://img100-682.xvideos.com/videos/thumbsl/1f/c3/08/1fc3084541e434a22f5dabb4bb0a7558/1fc3084541e434a22f5dabb4bb0a7558.17.jpg" onMouseOver="startThumbSlide('10608682', '17', 'http://img100-682.xvideos.com/videos/thumbs/1f/c3/08/1fc3084541e434a22f5dabb4bb0a7558/1fc3084541e434a22f5dabb4bb0a7558.')" onMouseOut='stopThumbSlide();' id='pic_10608682' onload="pictureserror_pictureLoaded(10608682)" onerror="pictureserror_pictureError(10608682)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Vanessa Figueroa bleep perfection">Vanessa Figueroa bleep perfection</span><br>
<font color="#f8fbff">26 min sex rated 99%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video9952025/0/busty_mommy_love_hard_banging_on_cam_clip-20" class="miniature">
<img src="http://img100-025.xvideos.com/videos/thumbsl/88/e9/0b/88e90b88f72e7031674f7bf7676322f0/88e90b88f72e7031674f7bf7676322f0.2.jpg" onMouseOver="startThumbSlide('9952025', '2', 'http://img100-025.xvideos.com/videos/thumbs/88/e9/0b/88e90b88f72e7031674f7bf7676322f0/88e90b88f72e7031674f7bf7676322f0.')" onMouseOut='stopThumbSlide();' id='pic_9952025' onload="pictureserror_pictureLoaded(9952025)" onerror="pictureserror_pictureError(9952025)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Busty Mommy Love Hard Banging On Cam clip-20">Busty Mommy Love Hard Banging On Cam clip-20</span><br>
<font color="#f8fbff">5 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video6935893/0/latina_gets_screwed_by_a_big_black_dick" class="miniature">
<img src="http://img100-893.xvideos.com/videos/thumbsl/ae/98/a9/ae98a907cba10daefce38263086d330c/ae98a907cba10daefce38263086d330c.28.jpg" onMouseOver="startThumbSlide('6935893', '28', 'http://img100-893.xvideos.com/videos/thumbs/ae/98/a9/ae98a907cba10daefce38263086d330c/ae98a907cba10daefce38263086d330c.')" onMouseOut='stopThumbSlide();' id='pic_6935893' onload="pictureserror_pictureLoaded(6935893)" onerror="pictureserror_pictureError(6935893)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Latina Gets Screwed By A Big Black Dick">Latina Gets Screwed By A Big Black Dick</span><br>
<font color="#f8fbff">13 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10723872/0/aaralyn_barra_takes_2_big_black_cocks_" class="miniature">
<img src="http://img100-872.xvideos.com/videos/thumbsl/a7/8e/8c/a78e8caf99ada76035b9471c104f1440/a78e8caf99ada76035b9471c104f1440.26.jpg" onMouseOver="startThumbSlide('10723872', '26', 'http://img100-872.xvideos.com/videos/thumbs/a7/8e/8c/a78e8caf99ada76035b9471c104f1440/a78e8caf99ada76035b9471c104f1440.')" onMouseOut='stopThumbSlide();' id='pic_10723872' onload="pictureserror_pictureLoaded(10723872)" onerror="pictureserror_pictureError(10723872)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Aaralyn Barra Takes 2 Big Black Cocks!!!">Aaralyn Barra Takes 2 Big Black Cocks!!!</span><br>
<font color="#f8fbff">25 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video8673274/0/sugar_babies_earn_their_keep" class="miniature">
<img src="http://img100-274.xvideos.com/videos/thumbsl/a2/6a/86/a26a86e2dacfd01ec44401fc6bb8cdd1/a26a86e2dacfd01ec44401fc6bb8cdd1.2.jpg" onMouseOver="startThumbSlide('8673274', '2', 'http://img100-274.xvideos.com/videos/thumbs/a2/6a/86/a26a86e2dacfd01ec44401fc6bb8cdd1/a26a86e2dacfd01ec44401fc6bb8cdd1.')" onMouseOut='stopThumbSlide();' id='pic_8673274' onload="pictureserror_pictureLoaded(8673274)" onerror="pictureserror_pictureError(8673274)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Sugar Babies Earn Their Keep">Sugar Babies Earn Their Keep</span><br>
<font color="#f8fbff">32 min sex rated 99%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10310411/0/mom_and_daughter_team_up_on_lucky_bf_bianka_sarai_4_82" class="miniature">
<img src="http://img100-411.xvideos.com/videos/thumbsl/de/cc/81/decc81b4415142d131c990b62010dd1a/decc81b4415142d131c990b62010dd1a.11.jpg" onMouseOver="startThumbSlide('10310411', '11', 'http://img100-411.xvideos.com/videos/thumbs/de/cc/81/decc81b4415142d131c990b62010dd1a/decc81b4415142d131c990b62010dd1a.')" onMouseOut='stopThumbSlide();' id='pic_10310411' onload="pictureserror_pictureLoaded(10310411)" onerror="pictureserror_pictureError(10310411)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Mom and daughter team up on lucky bf Bianka, Sarai 4 82">Mom and daughter team up on lucky bf Bian ...</span><br>
<font color="#f8fbff">6 min sex rated 84%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10734525/0/naive_babe_tricked_into_hardcore_sex" class="miniature">
<img src="http://img100-525.xvideos.com/videos/thumbsl/db/bc/1a/dbbc1a2b57cc5847cac9fc54fe4b981f/dbbc1a2b57cc5847cac9fc54fe4b981f.22.jpg" onMouseOver="startThumbSlide('10734525', '22', 'http://img100-525.xvideos.com/videos/thumbs/db/bc/1a/dbbc1a2b57cc5847cac9fc54fe4b981f/dbbc1a2b57cc5847cac9fc54fe4b981f.')" onMouseOut='stopThumbSlide();' id='pic_10734525' onload="pictureserror_pictureLoaded(10734525)" onerror="pictureserror_pictureError(10734525)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Na&iuml;ve Babe Tricked Into Hardcore Sex">Na&iuml;ve Babe Tricked Into Hardcore Sex</span><br>
<font color="#f8fbff">41 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video6042115/0/05_52521cec" class="miniature">
<img src="http://img100-115.xvideos.com/videos/thumbsl/4a/30/16/4a3016b53b232a958b8415d4a57b2f49/4a3016b53b232a958b8415d4a57b2f49.7.jpg" onMouseOver="startThumbSlide('6042115', '7', 'http://img100-115.xvideos.com/videos/thumbs/4a/30/16/4a3016b53b232a958b8415d4a57b2f49/4a3016b53b232a958b8415d4a57b2f49.')" onMouseOut='stopThumbSlide();' id='pic_6042115' onload="pictureserror_pictureLoaded(6042115)" onerror="pictureserror_pictureError(6042115)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="05 52521CEC">05 52521CEC</span><br>
<font color="#f8fbff">8 min sex rated ? %</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10712543/0/pov_anal_russian_girl_with_giorgio_grandi" class="miniature">
<img src="http://img100-543.xvideos.com/videos/thumbsl/6d/51/f3/6d51f34ca0b08c2266edc60e52a8c69a/6d51f34ca0b08c2266edc60e52a8c69a.6.jpg" onMouseOver="startThumbSlide('10712543', '6', 'http://img100-543.xvideos.com/videos/thumbs/6d/51/f3/6d51f34ca0b08c2266edc60e52a8c69a/6d51f34ca0b08c2266edc60e52a8c69a.')" onMouseOut='stopThumbSlide();' id='pic_10712543' onload="pictureserror_pictureLoaded(10712543)" onerror="pictureserror_pictureError(10712543)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="POV, anal russian girl with Giorgio Grandi">POV, anal russian girl with Giorgio Grandi</span><br>
<font color="#f8fbff">22 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10655416/0/molly_jane_kickass69" class="miniature">
<img src="http://img100-416.xvideos.com/videos/thumbsl/aa/75/7c/aa757ce31b68d46ad177d3516c07a8e8/aa757ce31b68d46ad177d3516c07a8e8.15.jpg" onMouseOver="startThumbSlide('10655416', '15', 'http://img100-416.xvideos.com/videos/thumbs/aa/75/7c/aa757ce31b68d46ad177d3516c07a8e8/aa757ce31b68d46ad177d3516c07a8e8.')" onMouseOut='stopThumbSlide();' id='pic_10655416' onload="pictureserror_pictureLoaded(10655416)" onerror="pictureserror_pictureError(10655416)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Molly Jane KICKASS69">Molly Jane KICKASS69</span><br>
<font color="#f8fbff">7 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10201299/0/august_ames_-_i_diddled_your_wife" class="miniature">
<img src="http://img100-299.xvideos.com/videos/thumbsl/00/8e/03/008e035bf9ec58d3e09ed3fac3dacb6b/008e035bf9ec58d3e09ed3fac3dacb6b.13.jpg" onMouseOver="startThumbSlide('10201299', '13', 'http://img100-299.xvideos.com/videos/thumbs/00/8e/03/008e035bf9ec58d3e09ed3fac3dacb6b/008e035bf9ec58d3e09ed3fac3dacb6b.')" onMouseOut='stopThumbSlide();' id='pic_10201299' onload="pictureserror_pictureLoaded(10201299)" onerror="pictureserror_pictureError(10201299)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="August Ames - I Diddled Your Wife">August Ames - I Diddled Your Wife</span><br>
<font color="#f8fbff">20 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video7367570/0/great_orgasm_of_mature_tied_and_anal_bleeped_with_toy" class="miniature">
<img src="http://img100-570.xvideos.com/videos/thumbsl/18/8a/4d/188a4da675bf175b01cfae865ad9d775/188a4da675bf175b01cfae865ad9d775.22.jpg" onMouseOver="startThumbSlide('7367570', '22', 'http://img100-570.xvideos.com/videos/thumbs/18/8a/4d/188a4da675bf175b01cfae865ad9d775/188a4da675bf175b01cfae865ad9d775.')" onMouseOut='stopThumbSlide();' id='pic_7367570' onload="pictureserror_pictureLoaded(7367570)" onerror="pictureserror_pictureError(7367570)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Great orgasm of mature tied and anal bleeped with toy">Great orgasm of mature tied and anal bleep ...</span><br>
<font color="#f8fbff">4 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10705558/0/amateur_squirt_redhead_slut_ass_bleeped_and_fisted_hard_in_threesome_outdoor" class="miniature">
<img src="http://img100-558.xvideos.com/videos/thumbsl/9d/6a/80/9d6a80065af514ce3f5d168b34f998d5/9d6a80065af514ce3f5d168b34f998d5.9.jpg" onMouseOver="startThumbSlide('10705558', '9', 'http://img100-558.xvideos.com/videos/thumbs/9d/6a/80/9d6a80065af514ce3f5d168b34f998d5/9d6a80065af514ce3f5d168b34f998d5.')" onMouseOut='stopThumbSlide();' id='pic_10705558' onload="pictureserror_pictureLoaded(10705558)" onerror="pictureserror_pictureError(10705558)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Amateur squirt redhead slut ass bleeped and fisted hard in threesome outdoor">Amateur squirt redhead slut ass bleeped an ...</span><br>
<font color="#f8fbff">30 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<script>thumbcastDisplayRandomThumb('<a href="http://adultcameras.info/video8208585/THUMBNUM/hot_first_time" class="miniature"><img src="http://img100-585.xvideos.com/videos/thumbs/b6/aa/9b/b6aa9bce8c539321716d8d8abf2c954e/b6aa9bce8c539321716d8d8abf2c954e.15.jpg" onMouseOver="startThumbSlide(\'8208585\', \'THUMBNUM\', \'http://img100-585.xvideos.com/videos/thumbs/b6/aa/9b/b6aa9bce8c539321716d8d8abf2c954e/b6aa9bce8c539321716d8d8abf2c954e.\')" onMouseOut=\'stopThumbSlide();\' id=\'pic_8208585\'  onload="pictureserror_pictureLoaded(8208585)" onerror="pictureserror_pictureError(8208585)" class="borderxn" border="0"></a>');
                  </script>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Hot first time">Hot first time</span><br>
<font color="#f8fbff">5 min sex rated 81%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10734209/0/rough_sex_for_a_little_teen_brunette_girl_and_a_big_cock" class="miniature">
<img src="http://img100-209.xvideos.com/videos/thumbsl/c9/0f/ca/c90fcad715abc8720c993b60d1cfcd18/c90fcad715abc8720c993b60d1cfcd18.13.jpg" onMouseOver="startThumbSlide('10734209', '13', 'http://img100-209.xvideos.com/videos/thumbs/c9/0f/ca/c90fcad715abc8720c993b60d1cfcd18/c90fcad715abc8720c993b60d1cfcd18.')" onMouseOut='stopThumbSlide();' id='pic_10734209' onload="pictureserror_pictureLoaded(10734209)" onerror="pictureserror_pictureError(10734209)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="rough sex for a little teen brunette girl and a big cock">rough sex for a little teen brunette girl ...</span><br>
<font color="#f8fbff">35 min sex rated 99%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video5775831/0/a_saga_de_uma_guerreira_africana" class="miniature">
<img src="http://img100-831.xvideos.com/videos/thumbsl/5b/27/4d/5b274d542079e6378e0287a80392a0b7/5b274d542079e6378e0287a80392a0b7.6.jpg" onMouseOver="startThumbSlide('5775831', '6', 'http://img100-831.xvideos.com/videos/thumbs/5b/27/4d/5b274d542079e6378e0287a80392a0b7/5b274d542079e6378e0287a80392a0b7.')" onMouseOut='stopThumbSlide();' id='pic_5775831' onload="pictureserror_pictureLoaded(5775831)" onerror="pictureserror_pictureError(5775831)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="A Saga de uma Guerreira &Aacute;fricana">A Saga de uma Guerreira &Aacute;fricana</span><br>
<font color="#f8fbff">30 sec sex rated 98%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video8733827/0/aunt_kathy_tries_pussy" class="miniature">
<img src="http://img100-827.xvideos.com/videos/thumbsl/2b/06/cc/2b06cc396c027e49b3f0049c011959f1/2b06cc396c027e49b3f0049c011959f1.27.jpg" onMouseOver="startThumbSlide('8733827', '27', 'http://img100-827.xvideos.com/videos/thumbs/2b/06/cc/2b06cc396c027e49b3f0049c011959f1/2b06cc396c027e49b3f0049c011959f1.')" onMouseOut='stopThumbSlide();' id='pic_8733827' onload="pictureserror_pictureLoaded(8733827)" onerror="pictureserror_pictureError(8733827)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Aunt Kathy Tries Pussy">Aunt Kathy Tries Pussy</span><br>
<font color="#f8fbff">27 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video9167016/0/xvideos.com_8f66e59f0cd3cbd1ffd763a83d98a3db" class="miniature">
<img src="http://img100-016.xvideos.com/videos/thumbsl/c5/68/c3/c568c32d5bae54e2faa84d4ebeb45e67/c568c32d5bae54e2faa84d4ebeb45e67.2.jpg" onMouseOver="startThumbSlide('9167016', '2', 'http://img100-016.xvideos.com/videos/thumbs/c5/68/c3/c568c32d5bae54e2faa84d4ebeb45e67/c568c32d5bae54e2faa84d4ebeb45e67.')" onMouseOut='stopThumbSlide();' id='pic_9167016' onload="pictureserror_pictureLoaded(9167016)" onerror="pictureserror_pictureError(9167016)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="xvideos.com 8f66e59f0cd3cbd1ffd763a83d98a3db">xvideos.com 8f66e59f0cd3cbd1ffd7</span><br>
<font color="#f8fbff">9 min sex rated 94%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10730802/0/black_babe_has_screaming_squirting_orgasms_w_white_masseuse" class="miniature">
<img src="http://img100-802.xvideos.com/videos/thumbsl/6c/15/be/6c15be636a8e3a2842c851d24c767368/6c15be636a8e3a2842c851d24c767368.25.jpg" onMouseOver="startThumbSlide('10730802', '25', 'http://img100-802.xvideos.com/videos/thumbs/6c/15/be/6c15be636a8e3a2842c851d24c767368/6c15be636a8e3a2842c851d24c767368.')" onMouseOut='stopThumbSlide();' id='pic_10730802' onload="pictureserror_pictureLoaded(10730802)" onerror="pictureserror_pictureError(10730802)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Black Babe Has Screaming Squirting Orgasms w/White Masseuse">Black Babe Has Screaming Squirting Orgasm ...</span><br>
<font color="#f8fbff">33 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video1655677/0/toys_black_cock_satisfied_slut" class="miniature">
<img src="http://img100-677.xvideos.com/videos/thumbsl/70/92/e4/7092e4de4c168977abea65408463a2e5/7092e4de4c168977abea65408463a2e5.28.jpg" onMouseOver="startThumbSlide('1655677', '28', 'http://img100-677.xvideos.com/videos/thumbs/70/92/e4/7092e4de4c168977abea65408463a2e5/7092e4de4c168977abea65408463a2e5.')" onMouseOut='stopThumbSlide();' id='pic_1655677' onload="pictureserror_pictureLoaded(1655677)" onerror="pictureserror_pictureError(1655677)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Toys   Black Cock = Satisfied Slut">Toys Black Cock = Satisfied Slut</span><br>
<font color="#f8fbff">34 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video9036114/0/black_dick_having_two_girls_bmp-4-04" class="miniature">
<img src="http://img100-114.xvideos.com/videos/thumbsl/77/00/55/77005576708b279da75e199466d8975d/77005576708b279da75e199466d8975d.16.jpg" onMouseOver="startThumbSlide('9036114', '16', 'http://img100-114.xvideos.com/videos/thumbs/77/00/55/77005576708b279da75e199466d8975d/77005576708b279da75e199466d8975d.')" onMouseOut='stopThumbSlide();' id='pic_9036114' onload="pictureserror_pictureLoaded(9036114)" onerror="pictureserror_pictureError(9036114)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Black dick having two girls BMP-4-04">Black dick having two girls BMP-4-04</span><br>
<font color="#f8fbff">46 min sex rated 98%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video3290150/0/older_guy_bleep_glamorous_young_blonde_in_stockings" class="miniature">
<img src="http://img100-150.xvideos.com/videos/thumbsl/f4/db/56/f4db56f451aa2d16321eb56cee609453/f4db56f451aa2d16321eb56cee609453.14.jpg" onMouseOver="startThumbSlide('3290150', '14', 'http://img100-150.xvideos.com/videos/thumbs/f4/db/56/f4db56f451aa2d16321eb56cee609453/f4db56f451aa2d16321eb56cee609453.')" onMouseOut='stopThumbSlide();' id='pic_3290150' onload="pictureserror_pictureLoaded(3290150)" onerror="pictureserror_pictureError(3290150)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Older guy bleep glamorous young blonde in stockings">Older guy bleep glamorous young blonde in ...</span><br>
<font color="#f8fbff">5 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10092597/0/schoolgirl_ono_bj_cum_on_face" class="miniature">
<img src="http://img100-597.xvideos.com/videos/thumbsl/37/f1/45/37f1452f4815d989dabedeb5c6c7705e/37f1452f4815d989dabedeb5c6c7705e.28.jpg" onMouseOver="startThumbSlide('10092597', '28', 'http://img100-597.xvideos.com/videos/thumbs/37/f1/45/37f1452f4815d989dabedeb5c6c7705e/37f1452f4815d989dabedeb5c6c7705e.')" onMouseOut='stopThumbSlide();' id='pic_10092597' onload="pictureserror_pictureLoaded(10092597)" onerror="pictureserror_pictureError(10092597)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="schoolgirl Ono BJ cum on face">schoolgirl Ono BJ cum on face</span><br>
<font color="#f8fbff">8 min sex rated 79%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video7344232/0/you_damn_right_i_pulled_out_thought_you_was_gettin_my_nut." class="miniature">
<img src="http://img100-232.xvideos.com/videos/thumbsl/c2/96/95/c296953a72b27d75c40df2a1ac774a48/c296953a72b27d75c40df2a1ac774a48.27.jpg" onMouseOver="startThumbSlide('7344232', '27', 'http://img100-232.xvideos.com/videos/thumbs/c2/96/95/c296953a72b27d75c40df2a1ac774a48/c296953a72b27d75c40df2a1ac774a48.')" onMouseOut='stopThumbSlide();' id='pic_7344232' onload="pictureserror_pictureLoaded(7344232)" onerror="pictureserror_pictureError(7344232)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="You DAMN right I pulled out, thought you was gettin my nut.">You DAMN right I pulled out, thought you ...</span><br>
<font color="#f8fbff">39 sec sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video8316100/0/sexy_dyke_fingering_her_girlfriends_box" class="miniature">
<img src="http://img100-100.xvideos.com/videos/thumbsl/86/2a/be/862abe8950789808ca3264726068c918/862abe8950789808ca3264726068c918.21.jpg" onMouseOver="startThumbSlide('8316100', '21', 'http://img100-100.xvideos.com/videos/thumbs/86/2a/be/862abe8950789808ca3264726068c918/862abe8950789808ca3264726068c918.')" onMouseOut='stopThumbSlide();' id='pic_8316100' onload="pictureserror_pictureLoaded(8316100)" onerror="pictureserror_pictureError(8316100)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Sexy dyke fingering her girlfriends box">Sexy dyke fingering her girlfriends box</span><br>
<font color="#f8fbff">7 min sex rated 98%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10734433/0/orgy_with_3_girls_very_sluts_french_amateur" class="miniature">
<img src="http://img100-433.xvideos.com/videos/thumbsl/dd/8a/6f/dd8a6fbac563f70588e05e5bef6ac40b/dd8a6fbac563f70588e05e5bef6ac40b.7.jpg" onMouseOver="startThumbSlide('10734433', '7', 'http://img100-433.xvideos.com/videos/thumbs/dd/8a/6f/dd8a6fbac563f70588e05e5bef6ac40b/dd8a6fbac563f70588e05e5bef6ac40b.')" onMouseOut='stopThumbSlide();' id='pic_10734433' onload="pictureserror_pictureLoaded(10734433)" onerror="pictureserror_pictureError(10734433)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Orgy with 3 girls very sluts!! French amateur">Orgy with 3 girls very sluts!! French amateur</span><br>
<font color="#f8fbff">21 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10733794/0/blonde_and_redhead_girls_bleep_in_a_threesome_with_a_big_cock" class="miniature">
<img src="http://img100-794.xvideos.com/videos/thumbsl/ed/85/f2/ed85f243afa66bd29c8259750825d7a1/ed85f243afa66bd29c8259750825d7a1.1.jpg" onMouseOver="startThumbSlide('10733794', '1', 'http://img100-794.xvideos.com/videos/thumbs/ed/85/f2/ed85f243afa66bd29c8259750825d7a1/ed85f243afa66bd29c8259750825d7a1.')" onMouseOut='stopThumbSlide();' id='pic_10733794' onload="pictureserror_pictureLoaded(10733794)" onerror="pictureserror_pictureError(10733794)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="blonde and redhead girls bleep in a threesome with a big cock">blonde and redhead girls bleep in a thr ...</span><br>
<font color="#f8fbff">22 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video3787284/0/the_babysitter" class="miniature">
<img src="http://img100-284.xvideos.com/videos/thumbsl/f2/99/99/f29999fb4e3b10fd93dfe884787bf759/f29999fb4e3b10fd93dfe884787bf759.5.jpg" onMouseOver="startThumbSlide('3787284', '5', 'http://img100-284.xvideos.com/videos/thumbs/f2/99/99/f29999fb4e3b10fd93dfe884787bf759/f29999fb4e3b10fd93dfe884787bf759.')" onMouseOut='stopThumbSlide();' id='pic_3787284' onload="pictureserror_pictureLoaded(3787284)" onerror="pictureserror_pictureError(3787284)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="The Babysitter">The Babysitter</span><br>
<font color="#f8fbff">19 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10727667/0/pornstar_bleep_her_pussy_and_ass" class="miniature">
<img src="http://img100-667.xvideos.com/videos/thumbsl/9f/af/b3/9fafb3fda52617a6243d42176f80fed3/9fafb3fda52617a6243d42176f80fed3.4.jpg" onMouseOver="startThumbSlide('10727667', '4', 'http://img100-667.xvideos.com/videos/thumbs/9f/af/b3/9fafb3fda52617a6243d42176f80fed3/9fafb3fda52617a6243d42176f80fed3.')" onMouseOut='stopThumbSlide();' id='pic_10727667' onload="pictureserror_pictureLoaded(10727667)" onerror="pictureserror_pictureError(10727667)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Pornstar bleep her pussy and ass">Pornstar bleep her pussy and ass</span><br>
<font color="#f8fbff">21 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10717788/0/two_girls_and_one_boy_violent_orgasm_french_amateur" class="miniature">
<img src="http://img100-788.xvideos.com/videos/thumbsl/53/7e/05/537e05371270ffafefb036b1edf05278/537e05371270ffafefb036b1edf05278.7.jpg" onMouseOver="startThumbSlide('10717788', '7', 'http://img100-788.xvideos.com/videos/thumbs/53/7e/05/537e05371270ffafefb036b1edf05278/537e05371270ffafefb036b1edf05278.')" onMouseOut='stopThumbSlide();' id='pic_10717788' onload="pictureserror_pictureLoaded(10717788)" onerror="pictureserror_pictureError(10717788)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Two girls and one boy violent orgasm!! French amateur">Two girls and one boy violent orgasm!! Fr ...</span><br>
<font color="#f8fbff">21 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10678986/0/default" class="miniature">
<img src="http://img100-986.xvideos.com/videos/thumbsl/83/42/17/834217c5c58a5cd5ba95a297d64c27fd/834217c5c58a5cd5ba95a297d64c27fd.24.jpg" onMouseOver="startThumbSlide('10678986', '24', 'http://img100-986.xvideos.com/videos/thumbs/83/42/17/834217c5c58a5cd5ba95a297d64c27fd/834217c5c58a5cd5ba95a297d64c27fd.')" onMouseOut='stopThumbSlide();' id='pic_10678986' onload="pictureserror_pictureLoaded(10678986)" onerror="pictureserror_pictureError(10678986)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="default">default</span><br>
<font color="#f8fbff">6 min sex rated 82%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<script>thumbcastDisplayRandomThumb('<a href="http://adultcameras.info/video9404342/THUMBNUM/free_live_cams_-_http_nolink.us_teenscam" class="miniature"><img src="http://img100-342.xvideos.com/videos/thumbs/72/83/8a/72838a65bda791f33d180bdd39b652e7/72838a65bda791f33d180bdd39b652e7.15.jpg" onMouseOver="startThumbSlide(\'9404342\', \'THUMBNUM\', \'http://img100-342.xvideos.com/videos/thumbs/72/83/8a/72838a65bda791f33d180bdd39b652e7/72838a65bda791f33d180bdd39b652e7.\')" onMouseOut=\'stopThumbSlide();\' id=\'pic_9404342\'  onload="pictureserror_pictureLoaded(9404342)" onerror="pictureserror_pictureError(9404342)" class="borderxn" border="0"></a>');
                  </script>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="free live cams - http://nolink.us/teenscam">free live cams - http://nolink.us/tee</span><br>
<font color="#f8fbff">1 min 38 sec sex rated ? %</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video5771724/0/what_can_i_get_if_i_pay_you_26" class="miniature">
<img src="http://img100-724.xvideos.com/videos/thumbsl/a2/21/60/a22160c72769c3ceaf616bcdce03bc47/a22160c72769c3ceaf616bcdce03bc47.8.jpg" onMouseOver="startThumbSlide('5771724', '8', 'http://img100-724.xvideos.com/videos/thumbs/a2/21/60/a22160c72769c3ceaf616bcdce03bc47/a22160c72769c3ceaf616bcdce03bc47.')" onMouseOut='stopThumbSlide();' id='pic_5771724' onload="pictureserror_pictureLoaded(5771724)" onerror="pictureserror_pictureError(5771724)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="What can i get if I pay you 26">What can i get if I pay you 26</span><br>
<font color="#f8fbff">7 min sex rated 51%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video2205214/0/virgin_pussy_stretched" class="miniature">
<img src="http://img100-214.xvideos.com/videos/thumbsl/f5/74/5a/f5745a9cf0c765b01fa6ffd2e83d3196/f5745a9cf0c765b01fa6ffd2e83d3196.8.jpg" onMouseOver="startThumbSlide('2205214', '8', 'http://img100-214.xvideos.com/videos/thumbs/f5/74/5a/f5745a9cf0c765b01fa6ffd2e83d3196/f5745a9cf0c765b01fa6ffd2e83d3196.')" onMouseOut='stopThumbSlide();' id='pic_2205214' onload="pictureserror_pictureLoaded(2205214)" onerror="pictureserror_pictureError(2205214)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Virgin pussy stretched">Virgin pussy stretched</span><br>
<font color="#f8fbff">5 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video7849565/0/fab_squirt" class="miniature">
<img src="http://img100-565.xvideos.com/videos/thumbsl/54/78/5f/54785f1373af6efd525d95aedfd604ab/54785f1373af6efd525d95aedfd604ab.23.jpg" onMouseOver="startThumbSlide('7849565', '23', 'http://img100-565.xvideos.com/videos/thumbs/54/78/5f/54785f1373af6efd525d95aedfd604ab/54785f1373af6efd525d95aedfd604ab.')" onMouseOut='stopThumbSlide();' id='pic_7849565' onload="pictureserror_pictureLoaded(7849565)" onerror="pictureserror_pictureError(7849565)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Fab Squirt">Fab Squirt</span><br>
<font color="#f8fbff">1 min 27 sec sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video7269683/0/college_slut_bleeped_and_cumshot_at_a_party" class="miniature">
<img src="http://img100-683.xvideos.com/videos/thumbsl/b2/bb/5d/b2bb5d653374fae78d1934a21bab2e26/b2bb5d653374fae78d1934a21bab2e26.23.jpg" onMouseOver="startThumbSlide('7269683', '23', 'http://img100-683.xvideos.com/videos/thumbs/b2/bb/5d/b2bb5d653374fae78d1934a21bab2e26/b2bb5d653374fae78d1934a21bab2e26.')" onMouseOut='stopThumbSlide();' id='pic_7269683' onload="pictureserror_pictureLoaded(7269683)" onerror="pictureserror_pictureError(7269683)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="College Slut bleeped And Cumshot At A Party">College Slut bleeped And Cumshot At A Party</span><br>
<font color="#f8fbff">5 min sex rated 99%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video10728831/0/nasty_blonds_love_atm_nl-14-03" class="miniature">
<img src="http://img100-831.xvideos.com/videos/thumbsl/33/de/6a/33de6aa77e377c4bc8ea3f9eebb859b5/33de6aa77e377c4bc8ea3f9eebb859b5.30.jpg" onMouseOver="startThumbSlide('10728831', '30', 'http://img100-831.xvideos.com/videos/thumbs/33/de/6a/33de6aa77e377c4bc8ea3f9eebb859b5/33de6aa77e377c4bc8ea3f9eebb859b5.')" onMouseOut='stopThumbSlide();' id='pic_10728831' onload="pictureserror_pictureLoaded(10728831)" onerror="pictureserror_pictureError(10728831)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Nasty blonds love ATM NL-14-03">Nasty blonds love ATM NL-14-03</span><br>
<font color="#f8fbff">48 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video1956116/0/real_naked_guy_cums_over_cfnm_babes_ass_in_reality_groupsex" class="miniature">
<img src="http://img100-116.xvideos.com/videos/thumbsl/69/14/c9/6914c9768badee5c50fed1cb7a277ee6/6914c9768badee5c50fed1cb7a277ee6.29.jpg" onMouseOver="startThumbSlide('1956116', '29', 'http://img100-116.xvideos.com/videos/thumbs/69/14/c9/6914c9768badee5c50fed1cb7a277ee6/6914c9768badee5c50fed1cb7a277ee6.')" onMouseOut='stopThumbSlide();' id='pic_1956116' onload="pictureserror_pictureLoaded(1956116)" onerror="pictureserror_pictureError(1956116)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Real naked guy cums over cfnm babes ass in reality groupsex">Real naked guy cums over cfnm babes ass i ...</span><br>
<font color="#f8fbff">5 min sex rated 94%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video9644308/0/big_chocolate_ass_nina_rotti" class="miniature">
<img src="http://img100-308.xvideos.com/videos/thumbsl/c3/7e/04/c37e04c89a2ef05795705a8e31c352ab/c37e04c89a2ef05795705a8e31c352ab.10.jpg" onMouseOver="startThumbSlide('9644308', '10', 'http://img100-308.xvideos.com/videos/thumbs/c3/7e/04/c37e04c89a2ef05795705a8e31c352ab/c37e04c89a2ef05795705a8e31c352ab.')" onMouseOut='stopThumbSlide();' id='pic_9644308' onload="pictureserror_pictureLoaded(9644308)" onerror="pictureserror_pictureError(9644308)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Big Chocolate Ass Nina Rotti">Big Chocolate Ass Nina Rotti</span><br>
<font color="#f8fbff">5 min sex rated 86%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video4777768/0/lavish_styles_and_thunder_katt" class="miniature">
<img src="http://img100-768.xvideos.com/videos/thumbsl/e0/dc/c1/e0dcc1cdb3d6a78619203717d3480573/e0dcc1cdb3d6a78619203717d3480573.7.jpg" onMouseOver="startThumbSlide('4777768', '7', 'http://img100-768.xvideos.com/videos/thumbs/e0/dc/c1/e0dcc1cdb3d6a78619203717d3480573/e0dcc1cdb3d6a78619203717d3480573.')" onMouseOut='stopThumbSlide();' id='pic_4777768' onload="pictureserror_pictureLoaded(4777768)" onerror="pictureserror_pictureError(4777768)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Lavish Styles &amp; Thunder Katt">Lavish Styles &amp; Thunder Katt</span><br>
<font color="#f8fbff">29 min sex rated 100%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video4071289/0/blindfolded_asian_bleep_with_hands_tied" class="miniature">
<img src="http://img100-289.xvideos.com/videos/thumbsl/10/99/44/1099440801844a1a09aac94e3b124ca8/1099440801844a1a09aac94e3b124ca8.3.jpg" onMouseOver="startThumbSlide('4071289', '3', 'http://img100-289.xvideos.com/videos/thumbs/10/99/44/1099440801844a1a09aac94e3b124ca8/1099440801844a1a09aac94e3b124ca8.')" onMouseOut='stopThumbSlide();' id='pic_4071289' onload="pictureserror_pictureLoaded(4071289)" onerror="pictureserror_pictureError(4071289)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Blindfolded asian bleep with hands tied">Blindfolded asian bleep with hands tied</span><br>
<font color="#f8fbff">15 min sex rated 81%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video2387890/0/girls_in_sport_uniforms_get_hard_bleep_video-10" class="miniature">
<img src="http://img100-890.xvideos.com/videos/thumbsl/a4/11/ce/a411cefed5fb6dbfe8116899b59cca69/a411cefed5fb6dbfe8116899b59cca69.17.jpg" onMouseOver="startThumbSlide('2387890', '17', 'http://img100-890.xvideos.com/videos/thumbs/a4/11/ce/a411cefed5fb6dbfe8116899b59cca69/a411cefed5fb6dbfe8116899b59cca69.')" onMouseOut='stopThumbSlide();' id='pic_2387890' onload="pictureserror_pictureLoaded(2387890)" onerror="pictureserror_pictureError(2387890)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Girls In Sport Uniforms Get Hard bleep video-10">Girls In Sport Uniforms Get Hard bleep vid ...</span><br>
<font color="#f8fbff">5 min sex rated 82%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<script>thumbcastDisplayRandomThumb('<a href="http://adultcameras.info/video10745408/THUMBNUM/punheta" class="miniature"><img src="http://img100-408.xvideos.com/videos/thumbs/69/f0/3e/69f03eb02b4b7444c0fc1805432cbc31/69f03eb02b4b7444c0fc1805432cbc31.15.jpg" onMouseOver="startThumbSlide(\'10745408\', \'THUMBNUM\', \'http://img100-408.xvideos.com/videos/thumbs/69/f0/3e/69f03eb02b4b7444c0fc1805432cbc31/69f03eb02b4b7444c0fc1805432cbc31.\')" onMouseOut=\'stopThumbSlide();\' id=\'pic_10745408\'  onload="pictureserror_pictureLoaded(10745408)" onerror="pictureserror_pictureError(10745408)" class="borderxn" border="0"></a>');
                  </script>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Punheta">Punheta</span><br>
<font color="#f8fbff">17 sec sex rated ? %</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<script>thumbcastDisplayRandomThumb('<a href="http://adultcameras.info/video10449882/THUMBNUM/naked_girls_opens_legs_to_get_dong_deep" class="miniature"><img src="http://img100-882.xvideos.com/videos/thumbs/5a/35/9b/5a359b8f76b997b873b024b486873297/5a359b8f76b997b873b024b486873297.15.jpg" onMouseOver="startThumbSlide(\'10449882\', \'THUMBNUM\', \'http://img100-882.xvideos.com/videos/thumbs/5a/35/9b/5a359b8f76b997b873b024b486873297/5a359b8f76b997b873b024b486873297.\')" onMouseOut=\'stopThumbSlide();\' id=\'pic_10449882\'  onload="pictureserror_pictureLoaded(10449882)" onerror="pictureserror_pictureError(10449882)" class="borderxn" border="0"></a>');
                  </script>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Naked girls opens legs to get dong deep">Naked girls opens legs to get dong deep</span><br>
<font color="#f8fbff">5 min sex rated ? %</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<script>thumbcastDisplayRandomThumb('<a href="http://adultcameras.info/video4886754/THUMBNUM/blonde_plays_with_sexy_dildo_on_the_bed" class="miniature"><img src="http://img100-754.xvideos.com/videos/thumbs/a8/7f/c2/a87fc29e8f050898fcf7651d41b6db43/a87fc29e8f050898fcf7651d41b6db43.15.jpg" onMouseOver="startThumbSlide(\'4886754\', \'THUMBNUM\', \'http://img100-754.xvideos.com/videos/thumbs/a8/7f/c2/a87fc29e8f050898fcf7651d41b6db43/a87fc29e8f050898fcf7651d41b6db43.\')" onMouseOut=\'stopThumbSlide();\' id=\'pic_4886754\'  onload="pictureserror_pictureLoaded(4886754)" onerror="pictureserror_pictureError(4886754)" class="borderxn" border="0"></a>');
                  </script>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Blonde plays with sexy dildo on the bed">Blonde plays with sexy dildo on the bed</span><br>
<font color="#f8fbff">6 min sex rated 81%</font>
</div>
</div></li>
<li><div align="center" style="font-size:12px">
<a href="http://adultcameras.info/video9726153/0/irina_bruni_dap_and_creampie_2_cocks_in_ass_gg414_exclusive_" class="miniature">
<img src="http://img100-153.xvideos.com/videos/thumbsl/c3/cc/c1/c3ccc1d773d3925c384b7761a6aaae4a/c3ccc1d773d3925c384b7761a6aaae4a.14.jpg" onMouseOver="startThumbSlide('9726153', '14', 'http://img100-153.xvideos.com/videos/thumbs/c3/cc/c1/c3ccc1d773d3925c384b7761a6aaae4a/c3ccc1d773d3925c384b7761a6aaae4a.')" onMouseOut='stopThumbSlide();' id='pic_9726153' onload="pictureserror_pictureLoaded(9726153)" onerror="pictureserror_pictureError(9726153)" class="borderxn" border="0">
</a>
<br>
<div class="t_all">
<span style="text-decoration:underline;" title="Irina Bruni DAP &amp; creampie (2 cocks in ass) gg414 (exclusive)">Irina Bruni DAP &amp; creampie (2 cocks in as ...</span><br>
<font color="#f8fbff">57 sec sex rated 81%</font>
</div>
</div></li>
</ul>
</div>
</div>
<table width="100%" border="0" cellpadding="2" cellspacing="0" style="border-left: 1px solid #000000;border-right: 1px solid #000000;">
<tr align="center" valign="top">
<td height="10"></td>
</tr>
</table>
<div style="border-left: 1px solid rgb(0, 0, 0); border-right: 1px solid rgb(0, 0, 0);border-bottom: 2px solid #dd3a68; padding: 20px 5px 5px; text-align: center;">
<div id="content">
<div id="pag" style="margin: 0pt; padding: 0pt; ">
<a class="sel">You are here</a>
<a class="sel">1</a>
<a href="http://adultcameras.info/home/1/">2</a>
<a href="http://adultcameras.info/home/2/">3</a>
<a href="http://adultcameras.info/home/3/">4</a>
<a href="http://adultcameras.info/home/4/">5</a>
<a href="http://adultcameras.info/home/5/">6</a>
<a href="http://adultcameras.info/home/6/">7</a>
<a href="http://adultcameras.info/home/7/">8</a>
<a href="http://adultcameras.info/home/8/">9</a>
<a href="http://adultcameras.info/home/9/">10</a>
</div>
</div>
<br><table width="930" border="0" style="border-bottom: 2px solid #dd3a68; border-top: 1px solid #dd3a68;" bgcolor="#dd3a68" align="center">
<tr>
<td>
<div align="center" style=" font-size:16px; "><strong>SEX CATEGORIES</strong> - Pick one or try our (very messy) <a href="http://adultcameras.info/tags/">Sex Tags</a> page</div>
</td>
</tr>
</table>
<p>&nbsp;</p>
<table width="0" height="0" border="0" cellpadding="0" cellspacing="1" bgcolor="#000000" align="center">
<tr>
<td bgcolor="#dd3a68">
<div style="display:none">
</div>
</td>
</tr>
</table>
<table width="930" border="0" cellpadding="0" cellspacing="0" align="center">
<tr>
<td style="text-align: center;">
</td>
</tr>
</table>
<div style="text-align: center;">
<p>&nbsp;</p>
<p style="font-size:24px; "> </p>
<p> </p>
<p> </p>
<p class="Style5"> </p>
</div>
<table width=760 border=0 align=center cellpadding=0 cellspacing=0>
<tr>
</td>
</tr>
</table>
<p> </p>
<table width=760 border=0 align=center cellpadding=0 cellspacing=0>
<tr>
<td align=center>
<p>
<font size=2>
<br>
<br>
<br>
</font>
</p>
</td>
</tr>
</table>
</div>
</td>
<td valign="top">
<p align="left"> </p>
<p align="center"><table width="0" border="0" cellpadding="0" cellspacing="0">
<tbody><tr>
</tr>
<tr>
<th scope="col"><hr width="100%" align="center" color="#0066ff">
</th>
</tr>
<tr>
<th scope="col"><a href="http://adultcameras.info/cartoon_of_the_day/cartoons/2015/2015-03-10-cartoon.htm" target="_blank"><img alt="" width="0" border="0" height="0"src="http://img100.xvideos.com/adultcameras.info/pics/cartoons/cartoons/2015/tmp_xnxx1904.jpg"></a></th>
  </tr>
  <tr>
    <th scope="col"><hr width="100%" align="center" color="#0066ff">

</th>
  </tr>
  <tr>
    <th scope="col"><a style="color: rgb(255, 255, 0);" href="http://adultcameras.info/cartoon_of_the_day/cartoons/2015/2015-03-10-cartoon.htm" target="_blank"></th>
  </tr>
  <tr>
    <th scope="col"><a href="http://adultcameras.info/cartoon_of_the_day/index.htm" target="_blank" style="color: rgb(255, 255, 0);"></small></th>
  </tr>

</tbody></table>
</p>
          <br>
          <p align="left"> </p>
          <div align="left"></div>
          <table height="0" border="0" cellpadding="0" cellspacing="0" width="0">
            <tr>
              <td>
                <div style="display:none">
                  
                </div>
                <p style="text-align:center;"></p>
              </td>
            </tr>
            <tr>
              <td valign="top">
                <table  border="0" cellspacing="0" cellpadding="0">
                  <tr>
                      <td width="180" height="732" valign="top" align="center" style="padding-top: 10px"><h2>XXX Pictures</h2>    <a href="http://adultcameras.info" target="_top"><img style="border: 1px solid #000000;" width="0" height="0" src="http://cdn.adultcameras.info/galleries/small/31/0a/a4/310aa4943d512820e5538f0b709ce000/8.jpg"></a><br />
    <a href="http://adultcameras.info" target="_top"><img style="border: 1px solid #000000;" width="0" height="0" src="http://cdn.adultcameras.info/galleries/small/70/6a/67/706a67c98e00f2f99085ec9fc2e19e90/6.jpg"></a><br />
    <a href="http://adultcameras.info" target="_top"><img style="border: 1px solid #000000;" width="0" height="0" src="http://cdn.adultcameras.info/galleries/small/21/11/bc/2111bc1590c38bd785b461b466fa864f/7.jpg"></a><br />
    <a href="http://adultcameras.info" target="_top"><img style="border: 1px solid #000000;" width="0" height="0" src="http://cdn.adultcameras.info/galleries/small/ad/5e/d4/ad5ed43ffbab1c039c91b3de1356461b/6.jpg"></a><br />
</td>
                  </tr>
                </table>
              </td>
            </tr>
          </table>
        </td>
      </tr>
    </table>
 
    <table width=100% height=30border=0 cellpadding=0 cellspacing=0>
      <tr>
        <td background=http://img100.xvideos.com/adultcameras.info/pics/bg.gif> </td>
      </tr>
    </table>
  </div>
  <!-- Last Round : 34 min -->
 
 
 
  <script type="text/javascript">
 
    var _gaq = _gaq || [];
    _gaq.push(['_setAccount', 'UA-24185438-1']);
    _gaq.push(['_setDomainName', '.adultcameras.info']);
    _gaq.push(['_trackPageview']);
    _gaq.push(['_setSampleRate', '1']);
 
    (function() {
      var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
      ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.';
      var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
    })();
 
  </script>
  <script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js"></script>
  <script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
  <script language="JAVASCRIPT" type="text/javascript">
          var script = document.createElement("script");
          script.src = "/in.php?referer=" + escape(document.referrer);
          script.type = "text/javascript";
          document.getElementsByTagName("head")[0].appendChild(script);
  </script>
 
</body>
</html><!-- Gen By 238 --><!--
 ID : 8661274f9b39dc46824eb6c6c691f8c4
O:8:"stdClass":3:{s:8:"sitename";s:4:"xnxx";s:4:"type";s:4:"main";s:5:"index";s:7:"general";}
Time : 0 d 0 h 0 m 2 s
-->

 

*********************************************************************************

 

What could be triggering this? It seems to be the request for a new tab, rather than clicking links in an existing tab.

 

I checked, and the pop-up blocker in IE is active, with nothing in the exceptions list. It's set to "medium" blocking level.

 

So, what's next?

Attached Files



#9 nasdaq

nasdaq

  • Malware Response Team
  • 38,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:20 PM

Posted 11 March 2015 - 08:32 AM

Reset the browsers that have been compromised.

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Restart Chrome.
====

Firefox:
Reset Default Browsing settings:
https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-problems?utm_expid=65912487-41.djHNRQY0RhaLvvtvcd0BQA.2&utm_referrer=https%3A%2F%2Fwww.google.ca%2F
===

Reset Internet Explorer:
Menu > Tools > Internet Options > Advanced Tab.
Click the Reset button on the bottom of the pane.
Click the Apply button.
Close IE.

===

Keep me posted.

#10 dwywit

dwywit
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 11 March 2015 - 04:05 PM

Will do, thanks. I've already reset IE, and uninstalled and reinstalled it, but I'll try the reset again.

 

i had an idea that might be worth exploring - what about I create a new user account for the owner, transfer files & photos, etc, then delete the old account? Let me know what you think.

 

cheers

 

Bernie Dwyer



#11 dwywit

dwywit
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 12 March 2015 - 12:52 AM

I talked the customer through doing the IE reset (she doesn't use Chrome or FF) earlier today. Six hours on, and no popups yet. I'll keep fingers and toes crossed.



#12 nasdaq

nasdaq

  • Malware Response Team
  • 38,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:20 PM

Posted 12 March 2015 - 08:19 AM

I will wait a few days before closing the topic.

#13 dwywit

dwywit
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 15 March 2015 - 11:13 PM

Customer just called with a different problem :smash:  No internet. She was away for the last few days and hadn't used the computer, so I've nothing to report re: popups. I'm about to go see her to deal with the internet issue (no ADSL sync) and I'll report back if I see anything.



#14 dwywit

dwywit
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:07:20 AM

Posted 17 March 2015 - 09:24 PM

Customer reports she hasn't seen a popup in the last 2 days. I think we can close this, thanks very much for your help.



#15 nasdaq

nasdaq

  • Malware Response Team
  • 38,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:20 PM

Posted 18 March 2015 - 07:10 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users