Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

"system Has Detected A Number Of" - Malware Help


  • This topic is locked This topic is locked
4 replies to this topic

#1 beasty_in_the_easty

beasty_in_the_easty

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:55 PM

Posted 27 June 2007 - 08:13 PM

OK, I think I contracted something from a darn ActiveX component. I've tried HouseCall and removed lots of kinds of Malware but something still remains, I've tried Norton Anti Virus updated but it is still searching now.

I did an altavista search on the name of the topic and found some information from earlier this year.

I will post my Hijackthis Log and then the smitfraud log.

Any help would be appreciated.


Logfile of HijackThis v1.99.1
Scan saved at 10:12:53, on 28/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\PROGRA~1\mcafee.com\agent\mcagent.exe
E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
E:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
E:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
E:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
E:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
E:\WINDOWS\CTHELPER.EXE
E:\WINDOWS\System32\CTsvcCDA.exe
E:\Program Files\Network Associates\Common Framework\FrameworkService.exe
e:\program files\mcafee.com\agent\mcdetect.exe
E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
E:\WINDOWS\System32\NMSSvc.exe
E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
E:\WINDOWS\system32\nvsvc32.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
E:\WINDOWS\system32\WgaTray.exe
E:\WINDOWS\system32\wuauclt.exe
E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
E:\Program Files\Network Associates\VirusScan\Mcshield.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\conime.exe
E:\WINDOWS\explorer.exe
E:\Program Files\Network Associates\VirusScan\scan32.exe
E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Documents and Settings\Kieran\Desktop\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - E:\Program Files\DAP\DAPBHO.DLL
O2 - BHO: (no name) - {36ADA89D-2440-4DC4-820A-3A05E8630935} - E:\Program Files\Video ActiveX Access\iesplg.dll
O2 - BHO: ALTAVISTA - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - E:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - E:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - E:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: ALTAVISTA - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - E:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MCAgentExe] e:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] e:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SsAAD.exe] E:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ShStatEXE] "E:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "E:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "E:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [Disc Detector] E:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CanonMyPrinter] E:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [IMEKRMIG6.1] E:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] E:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: PowerReg Scheduler V3.exe
O8 - Extra context menu item: &Download with &DAP - E:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///E:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: AltaVista Search - file://E:\Program Files\ALTAVISTA Toolbar\Cache\SelectedContextSearch.htm
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - E:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint ?? - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint ???? - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint ????? - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint ???????? - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate - file://E:\Program Files\ALTAVISTA Toolbar\Cache\SelectedContextTranslation.htm
O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///E:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///E:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///E:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - E:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - E:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - E:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} (ALTAVISTA) - http://toolbar.altavista.com/static/toolba...ab?r=1182153066
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1162811016921
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1162180273058
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/.../ymmapi_416.dll
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...059/mcfscan.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15026/CTPID.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - E:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - e:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - E:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - E:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - E:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
O23 - Service: MSCSPTISRV - Sony Corporation - E:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - E:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - E:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - E:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - E:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe





SmitFraudFix v2.197

Scan done at 9:49:54.57, 28/06/2007
Run from E:\Documents and Settings\Kieran\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode

ササササササササササササササササササササササササ Process

E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\PROGRA~1\mcafee.com\agent\mcagent.exe
E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
E:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
E:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
E:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
E:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
E:\WINDOWS\CTHELPER.EXE
E:\WINDOWS\System32\CTsvcCDA.exe
E:\Program Files\Network Associates\Common Framework\FrameworkService.exe
e:\program files\mcafee.com\agent\mcdetect.exe
E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
E:\WINDOWS\System32\NMSSvc.exe
E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
E:\WINDOWS\system32\nvsvc32.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
E:\WINDOWS\system32\WgaTray.exe
E:\WINDOWS\system32\wuauclt.exe
E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
E:\Program Files\Network Associates\VirusScan\Mcshield.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\conime.exe
E:\WINDOWS\explorer.exe
E:\Program Files\Network Associates\VirusScan\scan32.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
E:\WINDOWS\system32\cmd.exe

ササササササササササササササササササササササササ hosts

hosts file corrupted !

127.0.0.1 www.bullguard.com

ササササササササササササササササササササササササ E:\


ササササササササササササササササササササササササ E:\WINDOWS


ササササササササササササササササササササササササ E:\WINDOWS\system


ササササササササササササササササササササササササ E:\WINDOWS\Web


ササササササササササササササササササササササササ E:\WINDOWS\system32

E:\WINDOWS\system32\afkvvy.dll FOUND !

ササササササササササササササササササササササササ E:\WINDOWS\system32\LogFiles


ササササササササササササササササササササササササ E:\Documents and Settings\Kieran


ササササササササササササササササササササササササ E:\Documents and Settings\Kieran\Application Data


ササササササササササササササササササササササササ Start Menu

E:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
E:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

ササササササササササササササササササササササササ E:\DOCUME~1\KIERAN\FAVORI~1

E:\DOCUME~1\KIERAN\FAVORI~1\Online Security Test.url FOUND !

ササササササササササササササササササササササササ Desktop


ササササササササササササササササササササササササ E:\Program Files

E:\Program Files\Video ActiveX Access\ FOUND !

ササササササササササササササササササササササササ Corrupted keys


ササササササササササササササササササササササササ Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


ササササササササササササササササササササササササ Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4688f900-0d0c-4788-b297-59cc10e70ccc}"="bipinnatifid"

[HKEY_CLASSES_ROOT\CLSID\{4688f900-0d0c-4788-b297-59cc10e70ccc}\InProcServer32]
@="E:\WINDOWS\system32\afkvvy.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{4688f900-0d0c-4788-b297-59cc10e70ccc}\InProcServer32]
@="E:\WINDOWS\system32\afkvvy.dll"



ササササササササササササササササササササササササ AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


ササササササササササササササササササササササササ Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


ササササササササササササササササササササササササ Rustock



ササササササササササササササササササササササササ DNS

Description: Intel® PRO/100 VE Network Connection - Packet Scheduler Miniport
DNS Server Search Order: 192.168.1.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C5081C12-9F20-4FAA-B3B1-13FF10B46180}: DhcpNameServer=192.168.1.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C5081C12-9F20-4FAA-B3B1-13FF10B46180}: DhcpNameServer=192.168.1.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.2


ササササササササササササササササササササササササ Scanning for wininet.dll infection


ササササササササササササササササササササササササ End


What do I do now? Sorry to be such a newbie,.

BC AdBot (Login to Remove)

 


#2 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:07:55 AM

Posted 27 June 2007 - 10:02 PM

Hello beasty_in_the_easty,

I am SifuMike and I will be helping you.

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
Once in Safe Mode, double-click SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of the SmitfraudFix report into your next reply along with a new HijackThis log.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Edited by SifuMike, 27 June 2007 - 10:03 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 beasty_in_the_easty

beasty_in_the_easty
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:55 PM

Posted 28 June 2007 - 04:56 PM

OK, I just followed your instructions.

At this time, the message isn't appearing, my desktop picture was removed though.

Anyway, here are the logs. Hijack then smithfraud

Logfile of HijackThis v1.99.1
Scan saved at 06:44:02, on 29/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\CTsvcCDA.exe
E:\Program Files\Network Associates\Common Framework\FrameworkService.exe
e:\program files\mcafee.com\agent\mcdetect.exe
E:\Program Files\Network Associates\VirusScan\Mcshield.exe
E:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
E:\WINDOWS\System32\NMSSvc.exe
E:\WINDOWS\system32\nvsvc32.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\MsPMSPSv.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\WgaTray.exe
E:\WINDOWS\system32\wuauclt.exe
E:\PROGRA~1\mcafee.com\agent\mcagent.exe
E:\Documents and Settings\Kieran\Desktop\HijackThis.exe
E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
E:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
E:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
E:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
E:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
E:\WINDOWS\CTHELPER.EXE
E:\Program Files\Canon\MyPrinter\BJMyPrt.exe
E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
E:\WINDOWS\system32\wuauclt.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - E:\Program Files\DAP\DAPBHO.DLL
O2 - BHO: ALTAVISTA - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - E:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - E:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - E:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: ALTAVISTA - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - E:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MCAgentExe] e:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SsAAD.exe] E:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ShStatEXE] "E:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "E:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "E:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [Disc Detector] E:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CanonMyPrinter] E:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [IMEKRMIG6.1] E:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] E:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: PowerReg Scheduler V3.exe
O8 - Extra context menu item: &Download with &DAP - E:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///E:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: AltaVista Search - file://E:\Program Files\ALTAVISTA Toolbar\Cache\SelectedContextSearch.htm
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - E:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint ?? - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint ???? - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint ????? - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint ???????? - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate - file://E:\Program Files\ALTAVISTA Toolbar\Cache\SelectedContextTranslation.htm
O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///E:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///E:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///E:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - E:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - E:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - E:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} (ALTAVISTA) - http://toolbar.altavista.com/static/toolba...ab?r=1182153066
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1162811016921
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1162180273058
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/.../ymmapi_416.dll
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...059/mcfscan.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15026/CTPID.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - E:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - E:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - e:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - E:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - E:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - E:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
O23 - Service: MSCSPTISRV - Sony Corporation - E:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - E:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - E:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - E:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - E:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe


SmitFraudFix v2.197

Scan done at 6:35:09.81, 29/06/2007
Run from E:\Documents and Settings\Kieran\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in safe mode

ササササササササササササササササササササササササ SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{4688f900-0d0c-4788-b297-59cc10e70ccc}"="bipinnatifid"

[HKEY_CLASSES_ROOT\CLSID\{4688f900-0d0c-4788-b297-59cc10e70ccc}\InProcServer32]
@="E:\WINDOWS\system32\afkvvy.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{4688f900-0d0c-4788-b297-59cc10e70ccc}\InProcServer32]
@="E:\WINDOWS\system32\afkvvy.dll"


ササササササササササササササササササササササササ Killing process


ササササササササササササササササササササササササ hosts

127.0.0.1 localhost
127.0.0.1 www.altnet.com
127.0.0.1 search.kazaa.com
127.0.0.1 www.kazaaplus.com
127.0.0.1 ssa.kazaa.com
127.0.0.1 ssm.kazaa.com
127.0.0.1 www.cydoor.com
127.0.0.1 ads.kazaa.com
127.0.0.1 www.certifiedkazaa.com
127.0.0.1 puma.kazaa.com
127.0.0.1 www.bns2.net
127.0.0.1 www.bns1.net
127.0.0.1 www.rgs2.net
127.0.0.1 www.rgs1.net
127.0.0.1 www.cms2.net
127.0.0.1 www.cms1.net
127.0.0.1 cys3.net
127.0.0.1 cys2.net
127.0.0.1 cys1.net
127.0.0.1 www.kapsules.org
127.0.0.1 images.kazaa.com
127.0.0.1 desktop.kazaa.com
127.0.0.1 http://desktop.kazaa.com/us/kmdstart.htm?c...kmd&ver=260
127.0.0.1 www.altnetp2p.com
127.0.0.1 alpha.kazaa.com
127.0.0.1 shop.kazaa.com
127.0.0.1 www.bonzi.com
127.0.0.1 www.brilliantdigital.com
127.0.0.1 www.b3d.com
127.0.0.1 media.altnet.com
127.0.0.1 dev.bde.com.au
127.0.0.1 update.kazaa.com
127.0.0.1 bravo.kazaa.com
127.0.0.1 www.k-lite.tk
127.0.0.1 http://www.kazanon.com/
127.0.0.1 litetk.com
127.0.0.1 kazaa.ishareit.com
127.0.0.1 www.kazaagold.com
127.0.0.1 www.kazaa-gold.com
127.0.0.1 kazaagold.com
127.0.0.1 www.k-lite.com
127.0.0.1 www.kazaa-download.de
127.0.0.1 www.mp3downloadhq.com
127.0.0.1 www.easymusicdownload.com
127.0.0.1 easymusicdownload.com
127.0.0.1 www.mp3madeeasy.com
127.0.0.1 www.monstershare.com
127.0.0.1 monstershare.com
127.0.0.1 www.kazaa-plus.net
127.0.0.1 kazaa-plus.net
127.0.0.1 www.kazaa-plus.com
127.0.0.1 www.edonkey.com
127.0.0.1 www.kazaa-file-sharing-downloads.com
127.0.0.1 www.kazaaplatinum.com
127.0.0.1 www.madeformusic.com
127.0.0.1 www.ikazaa.net
127.0.0.1 ikazaa.net
127.0.0.1 www.ondemandmp3.com
127.0.0.1 www.mp3u.com
127.0.0.1 www.mp3specialty.com
127.0.0.1 music-download-world.com
127.0.0.1 song-download-world.com
127.0.0.1 www.flixs.net
127.0.0.1 www.ishareit.net
127.0.0.1 www.ishareit.com
127.0.0.1 www.download-doctor.com
127.0.0.1 www.ezmp3download.com
127.0.0.1 www.freesoftusa.com
127.0.0.1 www.kazaamedia.com
127.0.0.1 mp3-network.com
127.0.0.1 www.mp3-network.com
127.0.0.1 www.mp3grandcentral.net
127.0.0.1 www.mp333.com
127.0.0.1 www.kazaamate.com
127.0.0.1 www.emule.biz
127.0.0.1 www.kazaam8.tk
127.0.0.1 www.rippro.com
127.0.0.1 k-lite-legal.com
127.0.0.1 www.kaaza.com
127.0.0.1 secure.Webstartz.com
127.0.0.1 www.kazaalite.de
127.0.0.1 www.kazza.de
127.0.0.1 kazza.com
127.0.0.1 www.kazaalite.at
127.0.0.1 www.kazaalite.ch
127.0.0.1 www.kazaa-hilfe.de
127.0.0.1 www.edonkey-2000.de
127.0.0.1 www.edonkey-bot.de
127.0.0.1 www.edonkey-edonkey2000.de
127.0.0.1 www.edonkey-hilfe.de
127.0.0.1 www.edonkey-morpheus-forum.de
127.0.0.1 www.emule-hilfe.de
127.0.0.1 www.file-sharing-forum.de
127.0.0.1 www.filesharing-forum.de
127.0.0.1 www.imesh-download.de
127.0.0.1 www.kazaa-kaza.de
127.0.0.1 www.kazaa-lite.info
127.0.0.1 www.kazaa-lite-download.de
127.0.0.1 www.1md.de
127.0.0.1 www.mariodolzer.de
127.0.0.1 www.morpheus-forum.de
127.0.0.1 www.overnet-download.de
127.0.0.1 www.overnet-hilfe.de
127.0.0.1 www.winmx-download.de
127.0.0.1 www.winmx-hilfe.de
127.0.0.1 www.download-und-hilfe.de
127.0.0.1 www.filesharing-hilfe-forum.de
127.0.0.1 www.musik-download.biz
127.0.0.1 www.mp3downloads.ch
127.0.0.1 www.songfly.com
127.0.0.1 www.kazaa.nl
127.0.0.1 1stsoftwaredownloads.com
127.0.0.1 morpheus-download-morpheus.com
127.0.0.1 www.icisnet.org
127.0.0.1 software.global-netcom.de
127.0.0.1 www.filesharing-download.de
127.0.0.1 www.p2p.tm
127.0.0.1 www.filesharing-center.de
127.0.0.1 www.filesharing-tools.de
127.0.0.1 kazaa-download-kazaa.com
127.0.0.1 www.interscilsa.com
127.0.0.1 www.dvd-download-free.com
127.0.0.1 www.howtominibooks.com
127.0.0.1 www.internetmovies.com
127.0.0.1 www.rippro.net
127.0.0.1 www.musicmoviesbooks.com
127.0.0.1 www.kazaalite.org
127.0.0.1 www.getmp3music.com
127.0.0.1 www1.ishareit.com
127.0.0.1 www.filesharing-software.de
127.0.0.1 www.firewarez.com
127.0.0.1 www.k-lite.co.uk
127.0.0.1 kazzaa.info
127.0.0.1 www.morpheusp2p.com
127.0.0.1 www.mudima.com
127.0.0.1 www.download-central.com
127.0.0.1 kazaaplatinum.com
127.0.0.1 www.dingosoft.net
127.0.0.1 www.kazaa-advance.com
127.0.0.1 www.downloads-unlimited.com
127.0.0.1 klserver.port5.com
127.0.0.1 rippro.net
127.0.0.1 www.findkazaalite.com
127.0.0.1 www.freegoldkazaa.com
127.0.0.1 www.freekazaalite.com
127.0.0.1 www.kazaalitekpp.com
127.0.0.1 kazaa.filez.ws
127.0.0.1 www.kazaalite-download.com
127.0.0.1 www.kazaavip.com
127.0.0.1 compgenie.host.sk
127.0.0.1 www.musicdownloadcenter.com
127.0.0.1 www.kazza-lite.net
127.0.0.1 sitefinder.Verisign.com # Verisign has joined the game
127.0.0.1 sitefinder-idn.Verisign.com # of trying to hijack mistyped
127.0.0.1 # URLs to their site.
127.0.0.1 #up CSS on livejournal
127.0.0.1 # problems with NPR.org
127.0.0.1 06272002-dbase.hitcountz.net # Web bugs in spam
127.0.0.1 1ca.cqcounter.com
127.0.0.1 2001-007.com
127.0.0.1 ad-logics.com
127.0.0.1 ad.trafficmp.com
127.0.0.1 adclient.rottentomatoes.com
127.0.0.1 adcodes.aim4media.com
127.0.0.1 adcounter.globeandmail.com
127.0.0.1 adcounter.theglobeandmail.com
127.0.0.1 adlog.com.com # Used by Ziff Davis to serve
127.0.0.1 admanmail.com
127.0.0.1 ads.specificpop.com
127.0.0.1 ads.tiscali.com
127.0.0.1 ads.tiscali.it
127.0.0.1 adtech.de
127.0.0.1 anm.intelli-direct.com
127.0.0.1 askmen.thruport.com
127.0.0.1 banner.0catch.com
127.0.0.1 best-search.cc #spyware
127.0.0.1 bilbo.counted.com
127.0.0.1 bluestreak.com
127.0.0.1 c1.statcounter.com
127.0.0.1 c1.thecounter.com
127.0.0.1 c1.xxxcounter.com
127.0.0.1 c2.gostats.com
127.0.0.1 c2.thecounter.com
127.0.0.1 c3.gostats.com
127.0.0.1 c3.thecounter.com
127.0.0.1 c3.xxxcounter.com
127.0.0.1 cashcounter.com
127.0.0.1 cgi.hotstat.nl
127.0.0.1 click.atdmt.com
127.0.0.1 click.fivemtn.com
127.0.0.1 click.payserve.com
127.0.0.1 click.silvercash.com
127.0.0.1 clickspring.net #used by a spyware product called PurityScan
127.0.0.1 clit13.sextracker.com
127.0.0.1 clit15.sextracker.com
127.0.0.1 clit2.sextracker.com
127.0.0.1 clit6.sextracker.com
127.0.0.1 clit8.sextracker.com
127.0.0.1 clk.aboxdeal.com
127.0.0.1 cnn.entertainment.printthis.clickability.com
127.0.0.1 collector.deepmetrix.com
127.0.0.1 cookies.cmpnet.com
127.0.0.1 count.paycounter.com
127.0.0.1 counter.aaddzz.com
127.0.0.1 counter.bloke.com
127.0.0.1 counter.digits.com
127.0.0.1 counter.hitslink.com
127.0.0.1 counter.rambler.ru
127.0.0.1 counter.yadro.ru
127.0.0.1 counter10.bravenet.com
127.0.0.1 counter12.sextracker.com
127.0.0.1 counter13.sextracker.com
127.0.0.1 counter14.sextracker.com
127.0.0.1 counter15.sextracker.com
127.0.0.1 counter16.bravenet.com
127.0.0.1 counter17.bravenet.com
127.0.0.1 counter19.bravenet.com
127.0.0.1 counter2.freeware.de
127.0.0.1 counter2.hitslink.com
127.0.0.1 counter2.sextracker.com
127.0.0.1 counter26.bravenet.com
127.0.0.1 counter27.bravenet.com
127.0.0.1 counter3.sextracker.com
127.0.0.1 counter32.bravenet.com
127.0.0.1 counter34.bravenet.com
127.0.0.1 counter39.bravenet.com
127.0.0.1 counter4.sextracker.com
127.0.0.1 counter41.bravenet.com
127.0.0.1 counter43.bravenet.com
127.0.0.1 counter45.bravenet.com
127.0.0.1 counter47.bravenet.com
127.0.0.1 counter49.bravenet.com
127.0.0.1 counter5.sextracker.com
127.0.0.1 counter50.bravenet.com
127.0.0.1 counter6.sextracker.com
127.0.0.1 counter7.sextracker.com
127.0.0.1 counter8.bravenet.com
127.0.0.1 counter9.sextracker.com
127.0.0.1 counters.honesty.com
127.0.0.1 counters.xaraonline.com
127.0.0.1 data.coremetrics.com
127.0.0.1 data.webads.co.nz
127.0.0.1 dclk.themarketer.com
127.0.0.1 delivery.loopingclick.com
127.0.0.1 dimeprice.com # "spam bugs"
127.0.0.1 directads.mcafee.com
127.0.0.1 dwclick.com
127.0.0.1 ebay.doubleclick.net
127.0.0.1 economisttestcollect.insightfirst.com
127.0.0.1 ehg-amerix.hitbox.com
127.0.0.1 ehg-ati.hitbox.com
127.0.0.1 ehg-bestbuy.hitbox.com
127.0.0.1 ehg-bskyb.hitbox.com
127.0.0.1 ehg-cafepress.hitbox.com
127.0.0.1 ehg-cbs.hitbox.com
127.0.0.1 ehg-closetmaid.hitbox.com
127.0.0.1 ehg-crain.hitbox.com
127.0.0.1 ehg-dig.hitbox.com
127.0.0.1 ehg-eckounlimited.hitbox.com
127.0.0.1 ehg-espn.hitbox.com # Visits to espn.com
127.0.0.1 ehg-foundation.hitbox.com
127.0.0.1 ehg-foxsports.hitbox.com
127.0.0.1 ehg-groceryworks.hitbox.com
127.0.0.1 ehg-idg.hitbox.com
127.0.0.1 ehg-ignitemedia.hitbox.com
127.0.0.1 ehg-liveperson.hitbox.com
127.0.0.1 ehg-mindshare.hitbox.com
127.0.0.1 ehg-mybc.hitbox.com
127.0.0.1 ehg-oreilley.hitbox.com
127.0.0.1 ehg-oreilly.hitbox.com
127.0.0.1 ehg-sonybssc.hitbox.com
127.0.0.1 ehg-sonyelec.hitbox.com
127.0.0.1 ehg-sonyny.hitbox.com
127.0.0.1 ehg-space.hitbox.com
127.0.0.1 ehg-sportsline.hitbox.com
127.0.0.1 ehg-techtarget.hitbox.com
127.0.0.1 ehg-tigerdirect.hitbox.com
127.0.0.1 ehg-uniontrib.hitbox.com
127.0.0.1 ehg-viacom.hitbox.com
127.0.0.1 ehg-wachovia.hitbox.com
127.0.0.1 ehg.commjun.hitbox.com
127.0.0.1 ehg.hitbox.com # Many sites including espn.com
127.0.0.1 ehg.mindshare.hitbox.com
127.0.0.1 fastclick.net
127.0.0.1 fastcounter.bcentral.com
127.0.0.1 fcstats.bcentral.com
127.0.0.1 flycast.com
127.0.0.1 g-wizzads.net
127.0.0.1 gator.com
127.0.0.1 gcrim.cincinnati.com
127.0.0.1 gcrim.flatoday.com
127.0.0.1 gcrim.idehostatesman.com
127.0.0.1 gcrim.tennessean.com
127.0.0.1 gcrim.thedailyjournal.com
127.0.0.1 gcrim.thejournalnews.com
127.0.0.1 gostats.com
127.0.0.1 gtcc1.acecounter.com
127.0.0.1 hc2.humanclick.com
127.0.0.1 hit2.hotlog.ru
127.0.0.1 hit37.chark.dk
127.0.0.1 hit37.chart.dk
127.0.0.1 hit39.chart.dk
127.0.0.1 hit5.hotlog.ru
127.0.0.1 hitbox.com
127.0.0.1 hits.webstat.com
127.0.0.1 http300.edge.ru4.com
127.0.0.1 images.dailydiscounts.com # "spam bugs"
127.0.0.1 imp.clickability.com
127.0.0.1 impacts.alliancehub.com # "spam bugs"
127.0.0.1 impit.tradedouble.com
127.0.0.1 insightfirst.com
127.0.0.1 int.sitestat.com
127.0.0.1 jkearns.freestats.com
127.0.0.1 kt4.kliptracker.com
127.0.0.1 linktrack.bravenet.com
127.0.0.1 log.btopenworld.com
127.0.0.1 logs.comics.com
127.0.0.1 logs.eresmas.com
127.0.0.1 logv18.xiti.com
127.0.0.1 logv32.xiti.com
127.0.0.1 logv4.xiti.com
127.0.0.1 m1.nedstatbasic.net
127.0.0.1 mailcheckisp.biz # "spam bugs"
127.0.0.1 media101.sitebrand.com
127.0.0.1 mediatrack.revenue.net
127.0.0.1 mt122.mtree.com
127.0.0.1 multi1.rmuk.co.uk
127.0.0.1 mvs.mediavantage.de
127.0.0.1 nedstat.s0.nl
127.0.0.1 nl.sitestat.com
127.0.0.1 okcounter.com
127.0.0.1 p.reuters.com
127.0.0.1 partner.alerts.aol.com
127.0.0.1 paxito.sitetracker.com
127.0.0.1 perso.estat.com
127.0.0.1 pmg.ad-logics.com
127.0.0.1 postclick.adcentriconline.com
127.0.0.1 prof.estat.com
127.0.0.1 s10.sitemeter.com
127.0.0.1 s11.sitemeter.com
127.0.0.1 s12.sitemeter.com
127.0.0.1 s13.sitemeter.com
127.0.0.1 s14.sitemeter.com
127.0.0.1 s15.sitemeter.com
127.0.0.1 s16.sitemeter.com
127.0.0.1 s17.sitemeter.com
127.0.0.1 s18.sitemeter.com
127.0.0.1 s2.statcounter.com
127.0.0.1 scrooge.channelcincinnati.com
127.0.0.1 scrooge.channeloklahoma.com
127.0.0.1 scrooge.click10.com
127.0.0.1 scrooge.clickondetroit.com
127.0.0.1 scrooge.nbcsandiego.com
127.0.0.1 scrooge.newsnet5.com
127.0.0.1 scrooge.thebostonchannel.com
127.0.0.1 scrooge.thedenverchannel.com
127.0.0.1 scrooge.theindychannel.com
127.0.0.1 scrooge.thekansascitychannel.com
127.0.0.1 scrooge.theomahachannel.com
127.0.0.1 scrooge.wesh.com
127.0.0.1 scrooge.wftv.com
127.0.0.1 scrooge.wsoctv.com
127.0.0.1 scrooge.wtov9.com
127.0.0.1 servedby.valuead.com
127.0.0.1 sm1.sitemeter.com
127.0.0.1 sm2.sitemeter.com
127.0.0.1 sm3.sitemeter.com
127.0.0.1 sm4.sitemeter.com
127.0.0.1 sm5.sitemeter.com
127.0.0.1 sm6.sitemeter.com
127.0.0.1 sm7.sitemeter.com
127.0.0.1 sm8.sitemeter.com
127.0.0.1 sm9.sitemeter.com
127.0.0.1 sovereign.sitetracker.com
127.0.0.1 spinbox.maccentral.com
127.0.0.1 ss.tiscali.com
127.0.0.1 ss.tiscali.it
127.0.0.1 st.sageanalyst.net
127.0.0.1 stat.onestat.com
127.0.0.1 stat.webmedia.pl
127.0.0.1 stat.www.fi
127.0.0.1 stat1.z-stat.com
127.0.0.1 stat3.cybermonitor.com
127.0.0.1 static.smni.com # Santa Monica - popunders
127.0.0.1 statik.topica.com
127.0.0.1 stats.absol.co.za
127.0.0.1 stats.clickability.com
127.0.0.1 stats.groupninetyfour.com
127.0.0.1 stats.idsoft.com
127.0.0.1 stats.jippii.com
127.0.0.1 stats.klsoft.com
127.0.0.1 stats.revenue.net
127.0.0.1 stats.surfaid.ihost.com
127.0.0.1 stats.www.ibm.com
127.0.0.1 stats1.clicktracks.com
127.0.0.1 statse.webtrendslive.com # Fortune.com among others
127.0.0.1 superstats.com
127.0.0.1 targetnet.com
127.0.0.1 tates.freestats.com
127.0.0.1 te.newsday.com # web bugs
127.0.0.1 te.suntimes.com # web bugs
127.0.0.1 te.thestar.ca # web bugs
127.0.0.1 te.thestar.com # web bugs
127.0.0.1 te.trb.com # web bugs
127.0.0.1 the.sextracker.com
127.0.0.1 track.directleads.com
127.0.0.1 track.domainsponsor.com
127.0.0.1 track.ft.com
127.0.0.1 track.homestead.com
127.0.0.1 tracker.clicktrade.com
127.0.0.1 tracker.tradedoubler.com
127.0.0.1 tracking.iol.co.za
127.0.0.1 truehits1.gits.net.th
127.0.0.1 u3102.47.spylog.com
127.0.0.1 u3608.20.spylog.com
127.0.0.1 u4056.56.spylog.com
127.0.0.1 u574.07.spylog.com
127.0.0.1 u977.40.spylog.com
127.0.0.1 valueclick.com
127.0.0.1 valueclick.net
127.0.0.1 visit.theglobeandmail.com # Visits to theglobeandmail.com
127.0.0.1 vsii.spindox.net
127.0.0.1 w104.hitbox.com
127.0.0.1 w113.hitbox.com
127.0.0.1 w128.hitbox.com
127.0.0.1 w131.hitbox.com
127.0.0.1 w25.hitbox.com
127.0.0.1 web1.realtracker.com
127.0.0.1 web2.realtracker.com
127.0.0.1 web3.realtracker.com
127.0.0.1 web4.realtracker.com
127.0.0.1 webbug.seatreport.com # web bugs
127.0.0.1 webcounter.goweb.de
127.0.0.1 webhit.aftenposten.no
127.0.0.1 webhit.afterposten.no
127.0.0.1 webmasterkai.sitetracker.com
127.0.0.1 webpdp.gator.com
127.0.0.1 www.2001-007.com
127.0.0.1 www.247realmedia.com
127.0.0.1 www.addfreestats.com
127.0.0.1 www.bar.ry2002.02-ry014.snpr.hotmx.hair.zaam.net # In spam
127.0.0.1 www.bigbadted.com
127.0.0.1 www.bluestreak.com
127.0.0.1 www.clickclick.com
127.0.0.1 www.clickspring.net #used by a spyware product called PurityScan
127.0.0.1 www.clixgalore.com
127.0.0.1 www.directgrowthhormone.com
127.0.0.1 www.dwclick.com
127.0.0.1 www.emaildeals.biz
127.0.0.1 www.estats4all.com
127.0.0.1 www.fxcounters.com
127.0.0.1 www.gator.com
127.0.0.1 www.hitbox.com
127.0.0.1 www.metareward.com # web bugs in spam
127.0.0.1 www.naturalgrowthstore.biz
127.0.0.1 www.nedstat.com
127.0.0.1 www.originalicons.com # installs IE extension
127.0.0.1 www.popuptrafic.com
127.0.0.1 www.premiumsmail.net
127.0.0.1 www.rightstats.com
127.0.0.1 www.specificclick.com
127.0.0.1 www.specificpop.com
127.0.0.1 www.statcount.com
127.0.0.1 www.statcounter.com
127.0.0.1 www.statsession.com
127.0.0.1 www.trafficmagnet.net # web bugs in spam
127.0.0.1 www.v61.com
127.0.0.1 www.web-stat.com
127.0.0.1 www.whereugetxxx.com
127.0.0.1 www1.addfreestats.com
127.0.0.1 www101.coolsavings.com
127.0.0.1 www2.addfreestats.com
127.0.0.1 www2.pagecount.com
127.0.0.1 www3.addfreestats.com
127.0.0.1 www3.click-fr.com
127.0.0.1 www6.click-fr.com
127.0.0.1 www60.valueclick.com
127.0.0.1 www7.counter.bloke.com
127.0.0.1 ad.au.doubleclick.net
127.0.0.1 ad.br.doubleclick.net
127.0.0.1 ad.ca.doubleclick.net
127.0.0.1 ad.de.doubleclick.net
127.0.0.1 ad.doubleclick.net
127.0.0.1 ad.fi.doubleclick.net
127.0.0.1 ad.fr.doubleclick.net
127.0.0.1 ad.it.doubleclick.net
127.0.0.1 ad.jp.doubleclick.net
127.0.0.1 ad.nl.doubleclick.net
127.0.0.1 ad.no.doubleclick.net
127.0.0.1 ad.se.doubleclick.net
127.0.0.1 ad.sg.doubleclick.net
127.0.0.1 ad.uk.doubleclick.net
127.0.0.1 ad.za.doubleclick.net
127.0.0.1 ad2.doubleclick.net
127.0.0.1 doubleclick.com
127.0.0.1 doubleclick.net
127.0.0.1 iv.doubleclick.net
127.0.0.1 ln.doubleclick.net
127.0.0.1 m.doubleclick.net
127.0.0.1 m1.doubleclick.net
127.0.0.1 m2.doubleclick.net
127.0.0.1 m3.doubleclick.net
127.0.0.1 m4.doubleclick.net
127.0.0.1 m5.doubleclick.net
127.0.0.1 m6.doubleclick.net
127.0.0.1 m7.doubleclick.net
127.0.0.1 m8.doubleclick.net
127.0.0.1 m9.doubleclick.net
127.0.0.1 rd.intl.doubleclick.net
127.0.0.1 devfw.imrworldwide.com
127.0.0.1 fe1-au.imrworldwide.com
127.0.0.1 fe1-fi.imrworldwide.com
127.0.0.1 fe1-it.imrworldwide.com
127.0.0.1 fe2-au.imrworldwide.com
127.0.0.1 fe3-au.imrworldwide.com
127.0.0.1 fe3-gc.imrworldwide.com
127.0.0.1 fe3-uk.imrworldwide.com
127.0.0.1 fe4-uk.imrworldwide.com
127.0.0.1 imrworldwide.com
127.0.0.1 ninemsn.imrworldwide.com
127.0.0.1 rc-au.imrworldwide.com
127.0.0.1 redsheriff.com
127.0.0.1 server-au.imrworldwide.com
127.0.0.1 server-br.imrworldwide.com
127.0.0.1 server-ca.imrworldwide.com
127.0.0.1 server-de.imrworldwide.com
127.0.0.1 server-dk.imrworldwide.com
127.0.0.1 server-fi.imrworldwide.com
127.0.0.1 server-fr.imrworldwide.com
127.0.0.1 server-hk.imrworldwide.com
127.0.0.1 server-it.imrworldwide.com
127.0.0.1 server-jp.imrworldwide.com
127.0.0.1 server-no.imrworldwide.com
127.0.0.1 server-nz.imrworldwide.com
127.0.0.1 server-se.imrworldwide.com
127.0.0.1 server-sg.imrworldwide.com
127.0.0.1 server-stockh.imrworldwide.com
127.0.0.1 server-uk.imrworldwide.com
127.0.0.1 server-us.imrworldwide.com
127.0.0.1 telstra.imrworldwide.com
127.0.0.1 www.imrworldwide.com
127.0.0.1 www.imrworldwide.com.au
127.0.0.1 www.redsheriff.com
127.0.0.1 102.112.2o7.net
127.0.0.1 192.168.112.2o7.net
127.0.0.1 ancestrymsn.112.2o7.net
127.0.0.1 angmar.112.2o7.net
127.0.0.1 angts.112.2o7.net
127.0.0.1 angvac.112.2o7.net
127.0.0.1 canwest.112.2o7.net
127.0.0.1 cbaol.112.2o7.net
127.0.0.1 cbsncaasports.112.2o7.net
127.0.0.1 cbspgatour.112.2o7.net
127.0.0.1 cbsspln.112.2o7.net
127.0.0.1 cfrfa.112.2o7.net
127.0.0.1 classifiedscanada.112.2o7.net
127.0.0.1 cnetnews.112.2o7.net
127.0.0.1 denverpost.112.2o7.net
127.0.0.1 dischannel.112.2o7.net
127.0.0.1 execulink.112.2o7.net
127.0.0.1 f2nsmh.112.2o7.net
127.0.0.1 f2ntheage.112.2o7.net
127.0.0.1 georgewbush.112.2o7.net
127.0.0.1 georgewbushcom.112.2o7.net
127.0.0.1 gpaper108.112.2o7.net
127.0.0.1 gpaper109.112.2o7.net
127.0.0.1 gpaper110.112.2o7.net
127.0.0.1 gpaper111.112.2o7.net
127.0.0.1 gpaper112.112.2o7.net
127.0.0.1 gpaper113.112.2o7.net
127.0.0.1 gpaper114.112.2o7.net
127.0.0.1 gpaper115.112.2o7.net
127.0.0.1 gpaper116.112.2o7.net
127.0.0.1 gpaper117.112.2o7.net
127.0.0.1 gpaper118.112.2o7.net
127.0.0.1 gpaper119.112.2o7.net
127.0.0.1 gpaper120.112.2o7.net
127.0.0.1 gpaper121.112.2o7.net
127.0.0.1 gpaper122.112.2o7.net
127.0.0.1 gpaper123.112.2o7.net
127.0.0.1 gpaper124.112.2o7.net
127.0.0.1 gpaper125.112.2o7.net
127.0.0.1 gpaper126.112.2o7.net
127.0.0.1 gpaper127.112.2o7.net
127.0.0.1 gpaper128.112.2o7.net
127.0.0.1 gpaper129.112.2o7.net
127.0.0.1 gpaper133.112.2o7.net
127.0.0.1 gpaper138.112.2o7.net
127.0.0.1 gpaper144.112.2o7.net
127.0.0.1 gpaper147.112.2o7.net
127.0.0.1 gpaper151.112.2o7.net
127.0.0.1 gpaper154.112.2o7.net
127.0.0.1 gpaper158.112.2o7.net
127.0.0.1 gpaper164.112.2o7.net
127.0.0.1 gpaper166.112.2o7.net
127.0.0.1 gpaper176.112.2o7.net
127.0.0.1 gpaper177.112.2o7.net
127.0.0.1 gpaper180.112.2o7.net
127.0.0.1 gpaper183.112.2o7.net
127.0.0.1 gpaper202.112.2o7.net
127.0.0.1 gpaper204.112.2o7.net
127.0.0.1 hchrmain.112.2o7.net
127.0.0.1 homesclick.112.2o7.net
127.0.0.1 hpglobal.112.2o7.net
127.0.0.1 hphqglobal.112.2o7.net
127.0.0.1 intelglobal.112.2o7.net
127.0.0.1 laxpsd.112.2o7.net
127.0.0.1 mgtbo.112.2o7.net
127.0.0.1 mlbglobal.112.2o7.net
127.0.0.1 mngidmn.112.2o7.net
127.0.0.1 mngislctrib.112.2o7.net
127.0.0.1 mxmacromedia.112.2o7.net
127.0.0.1 neber.112.2o7.net
127.0.0.1 nmcommancomedia.112.2o7.net
127.0.0.1 nmkawartha.112.2o7.net
127.0.0.1 nmminneapolis.112.2o7.net
127.0.0.1 nmsacramento.112.2o7.net
127.0.0.1 novellcom.112.2o7.net
127.0.0.1 nytbglobe.112.2o7.net
127.0.0.1 nytglobe.112.2o7.net
127.0.0.1 nythglobe.112.2o7.net
127.0.0.1 nytimesglobal.112.2o7.net
127.0.0.1 nytimesnonsampled.112.2o7.net
127.0.0.1 nytimesnoonsampled.112.2o7.net
127.0.0.1 nytrlakeland.112.2o7.net
127.0.0.1 nytrsarasota.112.2o7.net
127.0.0.1 pulpantagraph.112.2o7.net
127.0.0.1 rckymtnnws.112.2o7.net
127.0.0.1 thinkgeek.112.2o7.net
127.0.0.1 verisonwildcard.112.2o7.net
127.0.0.1 2.marketbanker.com
127.0.0.1 207-87-18-203.wsmg.digex.net
127.0.0.1 3ad.doubleclick.net
127.0.0.1 a.as-eu.falkag.net
127.0.0.1 a.as-us.falkag.net
127.0.0.1 a.mktw.net
127.0.0.1 a.tribalfusion.com
127.0.0.1 a.websponsors.com
127.0.0.1 a3.suntimes.com
127.0.0.1 abcnews.footprint.net
127.0.0.1 ac.rnm.ca
127.0.0.1 actionflash.com
127.0.0.1 actionsplash.com
127.0.0.1 ad-adex3.flycast.com
127.0.0.1 ad-souk.com
127.0.0.1 ad.3au.doubleclick.net
127.0.0.1 ad.71i.de
127.0.0.1 ad.abcnews.com
127.0.0.1 ad.aboutwebservices.com
127.0.0.1 ad.adex3.flycast.com
127.0.0.1 ad.adition.de
127.0.0.1 ad.adition.net
127.0.0.1 ad.adsmart.net
127.0.0.1 ad.aftonbladet.se
127.0.0.1 ad.asv.de
127.0.0.1 ad.deviantart.com
127.0.0.1 ad.es.doubleclick.net
127.0.0.1 ad.espn.starwave.com
127.0.0.1 ad.eurosport.com
127.0.0.1 ad.horvitznewspapers.net
127.0.0.1 ad.howstuffworks.com
127.0.0.1 ad.iwin.com
127.0.0.1 ad.leadcrunch.com
127.0.0.1 ad.linkexchange.com
127.0.0.1 ad.linksynergy.com
127.0.0.1 ad.moscowtimes.ru
127.0.0.1 ad.nate.com
127.0.0.1 ad.network60.com
127.0.0.1 ad.preferences.com
127.0.0.1 ad.pro-advertising.com
127.0.0.1 ad.repubblica.it
127.0.0.1 ad.showbizz.net
127.0.0.1 ad.sma.punto.net
127.0.0.1 ad.smni.com
127.0.0.1 ad.suprnova.org
127.0.0.1 ad.tbn.ru
127.0.0.1 ad.tv2.no
127.0.0.1 ad.uk.tangozebra.com
127.0.0.1 ad.usatoday.com
127.0.0.1 ad.ve.doubleclick.net
127.0.0.1 ad.webprovider.com
127.0.0.1 ad01.focalink.com
127.0.0.1 ad01.mediacorpsingapore.com
127.0.0.1 ad02.focalink.com
127.0.0.1 ad03.focalink.com
127.0.0.1 ad04.focalink.com
127.0.0.1 ad05.focalink.com
127.0.0.1 ad06.focalink.com
127.0.0.1 ad07.focalink.com
127.0.0.1 ad08.focalink.com
127.0.0.1 ad09.focalink.com
127.0.0.1 ad1.hotel.com
127.0.0.1 ad1.lbn.ru
127.0.0.1 ad1.peel.com
127.0.0.1 ad10.focalink.com
127.0.0.1 ad11.focalink.com
127.0.0.1 ad12.focalink.com
127.0.0.1 ad13.focalink.com
127.0.0.1 ad14.focalink.com
127.0.0.1 ad15.focalink.com
127.0.0.1 ad16.focalink.com
127.0.0.1 ad17.focalink.com
127.0.0.1 ad18.focalink.com
127.0.0.1 ad19.focalink.com
127.0.0.1 ad2.hotel.com
127.0.0.1 ad2.lbn.ru
127.0.0.1 ad2.pamedia.com
127.0.0.1 ad2.peel.com
127.0.0.1 ad2.smni.com
127.0.0.1 ad3.lbn.ru
127.0.0.1 ad4.lbn.ru
127.0.0.1 ad5.lbn.ru
127.0.0.1 adbot.theonion.com
127.0.0.1 adcentric.randomseed.com
127.0.0.1 adcentriconline.com
127.0.0.1 adcontent.gamespy.com
127.0.0.1 adcontroller.unicast.com
127.0.0.1 adcreative.tribuneinteractive.com
127.0.0.1 adcycle.icpeurope.net
127.0.0.1 adex1.flycast.com
127.0.0.1 adex2.flycast.com
127.0.0.1 adex3.flycast.com
127.0.0.1 adfarm.mediaplex.com
127.0.0.1 adforce.ads.imgis.com
127.0.0.1 adforce.adtech.de
127.0.0.1 adforce.imgis.com
127.0.0.1 adfu.blockstackers.com
127.0.0.1 adgraphics.theonion.com
127.0.0.1 adgroup.naver.com
127.0.0.1 adi.mainichi.co.jp
127.0.0.1 adimage.asia1.com.sg
127.0.0.1 adimage.asiaone.com
127.0.0.1 adimage.asiaone.com.sg
127.0.0.1 adimage.blm.net
127.0.0.1 adimages.earthweb.com
127.0.0.1 adimages.go.com
127.0.0.1 adimages.mp3.com
127.0.0.1 adincl.gopher.com
127.0.0.1 adj1.thruport.com
127.0.0.1 adj10.thruport.com
127.0.0.1 adj11.thruport.com
127.0.0.1 adj12.thruport.com
127.0.0.1 adj13.thruport.com
127.0.0.1 adj14.thruport.com
127.0.0.1 adj15.thruport.com
127.0.0.1 adj16.thruport.com
127.0.0.1 adj16r1.thruport.com
127.0.0.1 adj17.thruport.com
127.0.0.1 adj18.thruport.com
127.0.0.1 adj2.thruport.com
127.0.0.1 adj3.thruport.com
127.0.0.1 adj4.thruport.com
127.0.0.1 adj5.thruport.com
127.0.0.1 adj6.thruport.com
127.0.0.1 adj7.thruport.com
127.0.0.1 adj8.thruport.com
127.0.0.1 adj9.thruport.com
127.0.0.1 adjuggler.yourdictionary.com
127.0.0.1 adman.freeze.com
127.0.0.1 admanager.btopenworld.com
127.0.0.1 admedia.xoom.com
127.0.0.1 admin.digitalacre.com
127.0.0.1 adnet.chicago.tribune.com
127.0.0.1 adnetwork.nextgen.net
127.0.0.1 adng.ascii24.com
127.0.0.1 adpepper.dk
127.0.0.1 adpick.switchboard.com
127.0.0.1 adpulse.ads.targetnet.com
127.0.0.1 adpush.dreamscape.com
127.0.0.1 adremote.pathfinder.com
127.0.0.1 adremote.timeinc.net
127.0.0.1 ads-direct.prodigy.net
127.0.0.1 ads.accelerator-media.com
127.0.0.1 ads.active.com
127.0.0.1 ads.ad-flow.com
127.0.0.1 ads.adcorps.com
127.0.0.1 ads.addesktop.com
127.0.0.1 ads.addynamix.com
127.0.0.1 ads.admaximize.com
127.0.0.1 ads.admonitor.net
127.0.0.1 ads.adsag.com
127.0.0.1 ads.adtegrity.net
127.0.0.1 ads.adviva.net
127.0.0.1 ads.adworldnetwork.com
127.0.0.1 ads.ah-ha.com
127.0.0.1 ads.allsites.com
127.0.0.1 ads.amazingmedia.com
127.0.0.1 ads.anm.co.uk
127.0.0.1 ads.as4x.tmcs.net
127.0.0.1 ads.as4x.tmcs.ticketmaster.ca
127.0.0.1 ads.asia1.com
127.0.0.1 ads.asia1.com.sg
127.0.0.1 ads.astalavista.us
127.0.0.1 ads.auctioncity.co.nz
127.0.0.1 ads.bangkokpost.co.th
127.0.0.1 ads.banner.t-online.de
127.0.0.1 ads.beliefnet.com
127.0.0.1 ads.belointeractive.com
127.0.0.1 ads.bfast.com
127.0.0.1 ads.bigcitytools.com
127.0.0.1 ads.bloomberg.com
127.0.0.1 ads.bluemountain.com
127.0.0.1 ads.bonnint.net
127.0.0.1 ads.box.sk
127.0.0.1 ads.businessweek.com
127.0.0.1 ads.camrecord.com
127.0.0.1 ads.canoe.ca
127.0.0.1 ads.cbc.ca
127.0.0.1 ads.champs-elysees.com
127.0.0.1 ads.channel4.com
127.0.0.1 ads.checkm8.co.za
127.0.0.1 ads.chumcity.com
127.0.0.1 ads.clickability.com
127.0.0.1 ads.clickad.com.pl
127.0.0.1 ads.clickagents.com
127.0.0.1 ads.clickhouse.com
127.0.0.1 ads.clickthru.net
127.0.0.1 ads.collegemix.com
127.0.0.1 ads.coopson.com
127.0.0.1 ads.courierpostonline.com
127.0.0.1 ads.cpsgsoftware.com
127.0.0.1 ads.democratandchronicle.com
127.0.0.1 ads.dennisnet.co.uk
127.0.0.1 ads.desmoinesregister.com
127.0.0.1 ads.developershed.com
127.0.0.1 ads.deviantart.com
127.0.0.1 ads.digital-digest.com
127.0.0.1 ads.digitalacre.com
127.0.0.1 ads.digitalhealthcare.com
127.0.0.1 ads.digitalmedianet.com
127.0.0.1 ads.discovery.com
127.0.0.1 ads.drf.com
127.0.0.1 ads.economist.com
127.0.0.1 ads.enliven.com
127.0.0.1 ads.euniverseads.com
127.0.0.1 ads.examiner.net
127.0.0.1 ads.exhedra.com
127.0.0.1 ads.fairfax.com.au
127.0.0.1 ads.flabber.nl
127.0.0.1 ads.fool.com
127.0.0.1 ads.forbes.com
127.0.0.1 ads.fortunecity.com
127.0.0.1 ads.fredericksburg.com
127.0.0.1 ads.freshmeat.net
127.0.0.1 ads.ft.com
127.0.0.1 ads.gamespy.com
127.0.0.1 ads.gamespyid.com
127.0.0.1 ads.gateway.com
127.0.0.1 ads.globeandmail.com
127.0.0.1 ads.gorillanation.com
127.0.0.1 ads.granadamedia.com
127.0.0.1 ads.greenvilleonline.com
127.0.0.1 ads.guardian.co.uk
127.0.0.1 ads.guardianunlimited.co.uk
127.0.0.1 ads.hamptonroads.com
127.0.0.1 ads.hamtonroads.com
127.0.0.1 ads.hardwarezone.com
127.0.0.1 ads.heraldsun.com
127.0.0.1 ads.hitcents.com
127.0.0.1 ads.hollywood.com
127.0.0.1 ads.i33.com
127.0.0.1 ads.icq.com
127.0.0.1 ads.ign.com
127.0.0.1 ads.illuminatednation.com
127.0.0.1 ads.indiatimes.com
127.0.0.1 ads.indystar.com
127.0.0.1 ads.inetdirectories.com
127.0.0.1 ads.infi.net
127.0.0.1 ads.injersey.com
127.0.0.1 ads.iol.co.il
127.0.0.1 ads.isat-tech.com
127.0.0.1 ads.isoftmarketing.com
127.0.0.1 ads.jacksonville.com
127.0.0.1 ads.jeneauempire.com
127.0.0.1 ads.jpost.com
127.0.0.1 ads.jwtt3.com
127.0.0.1 ads.kleinman.com
127.0.0.1 ads.ksl.com
127.0.0.1 ads.link4ads.com
127.0.0.1 ads.linksponsor.com
127.0.0.1 ads.linktracking.net
127.0.0.1 ads.list-universe.com
127.0.0.1 ads.lycos.com
127.0.0.1 ads.madison.com
127.0.0.1 ads.mcafee.com
127.0.0.1 ads.mdchoice.com
127.0.0.1 ads.mediaodyssey.com
127.0.0.1 ads.mediaturf.net
127.0.0.1 ads.mgnetwork.com
127.0.0.1 ads.mindsetnetwork.com
127.0.0.1 ads.mircx.com
127.0.0.1 ads.mm.ap.org
127.0.0.1 ads.mouseplanet.com
127.0.0.1 ads.mustangworks.com
127.0.0.1 ads.mytelus.com
127.0.0.1 ads.nandomedia.com
127.0.0.1 ads.nationalreview.com
127.0.0.1 ads.nerve.com
127.0.0.1 ads.newcity.com
127.0.0.1 ads.newsint.co.uk
127.0.0.1 ads.newsquest.co.uk
127.0.0.1 ads.newtimes.com
127.0.0.1 ads.northjersey.com
127.0.0.1 ads.ntadvice.com
127.0.0.1 ads.nwsource.com
127.0.0.1 ads.nyjournalnews.com
127.0.0.1 ads.nypost.com
127.0.0.1 ads.nytimes.com
127.0.0.1 ads.omaha.com
127.0.0.1 ads.orsm.net
127.0.0.1 ads.osdn.com
127.0.0.1 ads.parrysound.com
127.0.0.1 ads.peel.com
127.0.0.1 ads.pennyweb.com
127.0.0.1 ads.pg.valueclick.net
127.0.0.1 ads.pilotonline.com
127.0.0.1 ads.pointroll.com
127.0.0.1 ads.premiumnetwork.com
127.0.0.1 ads.pressdemo.com
127.0.0.1 ads.prisacom.com
127.0.0.1 ads.pro-market.net
127.0.0.1 ads.queendom.com
127.0.0.1 ads.quicken.com
127.0.0.1 ads.rackshack.net
127.0.0.1 ads.realcities.com
127.0.0.1 ads.rediff.com
127.0.0.1 ads.register.com
127.0.0.1 ads.revenue.net
127.0.0.1 ads.roanoke.com
127.0.0.1 ads.rodale.com
127.0.0.1 ads.rondomondo.com
127.0.0.1 ads.savannahnow.com
127.0.0.1 ads.scabee.com
127.0.0.1 ads.schwabtrader.com
127.0.0.1 ads.seattletimes.com
127.0.0.1 ads.simtel.com
127.0.0.1 ads.sitemeter.com
127.0.0.1 ads.smartclicks.com
127.0.0.1 ads.smartclicks.net
127.0.0.1 ads.snowball.com
127.0.0.1 ads.sohh.com
127.0.0.1 ads.space.com
127.0.0.1 ads.specificclick.com
127.0.0.1 ads.sptimes.com
127.0.0.1 ads.spymac.net
127.0.0.1 ads.starbanner.com
127.0.0.1 ads.stephensmedia.com
127.0.0.1 ads.stileproject.com
127.0.0.1 ads.stupid.com
127.0.0.1 ads.switchboard.com
127.0.0.1 ads.techtv.com
127.0.0.1 ads.telegraph.co.uk
127.0.0.1 ads.the15thinternet.com
127.0.0.1 ads.theglobeandmail.com
127.0.0.1 ads.theolympian.com
127.0.0.1 ads.thestar.com #Toronto Star
127.0.0.1 ads.thewebfreaks.com
127.0.0.1 ads.timesunion.com
127.0.0.1 ads.top500.org #TOP500 SuperComputer Site
127.0.0.1 ads.toronto.com
127.0.0.1 ads.townhall.com
127.0.0.1 ads.track.net
127.0.0.1 ads.traderonline.com
127.0.0.1 ads.tricityherald.com
127.0.0.1 ads.tripod.com
127.0.0.1 ads.tromaville.com
127.0.0.1 ads.tucows.com
127.0.0.1 ads.ucomics.com
127.0.0.1 ads.valuead.com
127.0.0.1 ads.vegas.com
127.0.0.1 ads.veloxia.com
127.0.0.1 ads.vnuemedia.com
127.0.0.1 ads.weather.com
127.0.0.1 ads.web.aol.com
127.0.0.1 ads.web.compuserve.com
127.0.0.1 ads.webcoretech.com
127.0.0.1 ads.webmd.com
127.0.0.1 ads.websponsors.com
127.0.0.1 ads.whi.co.nz
127.0.0.1 ads.x10.com
127.0.0.1 ads.xtra.co.nz
127.0.0.1 ads.zap2it.com
127.0.0.1 ads.zdnet.com
127.0.0.1 ads01.focalink.com
127.0.0.1 ads01.hyperbanner.net
127.0.0.1 ads02.focalink.com
127.0.0.1 ads02.hyperbanner.net
127.0.0.1 ads03.focalink.com
127.0.0.1 ads03.hyperbanner.net
127.0.0.1 ads04.focalink.com
127.0.0.1 ads04.hyperbanner.net
127.0.0.1 ads05.focalink.com
127.0.0.1 ads05.hyperbanner.net
127.0.0.1 ads06.focalink.com
127.0.0.1 ads06.hyperbanner.net
127.0.0.1 ads07.focalink.com
127.0.0.1 ads07.hyperbanner.net
127.0.0.1 ads08.focalink.com
127.0.0.1 ads08.hyperbanner.net
127.0.0.1 ads09.focalink.com
127.0.0.1 ads09.hyperbanner.net
127.0.0.1 ads1.activeagent.at
127.0.0.1 ads1.ad-flow.com
127.0.0.1 ads1.advance.net
127.0.0.1 ads1.advertwizard.com
127.0.0.1 ads1.ami-admin.com
127.0.0.1 ads1.canoe.ca
127.0.0.1 ads1.globeandmail.com
127.0.0.1 ads1.jev.co.za
127.0.0.1 ads1.realcities.com
127.0.0.1 ads1.revenue.net
127.0.0.1 ads1.sptimes.com
127.0.0.1 ads1.theglobeandmail.com
127.0.0.1 ads1.ucomics.com
127.0.0.1 ads1.udc.advance.net
127.0.0.1 ads1.updated.com
127.0.0.1 ads1.virtumundo.com
127.0.0.1 ads1.zdnet.com
127.0.0.1 ads10.focalink.com
127.0.0.1 ads10.hyperbanner.net
127.0.0.1 ads11.focalink.com
127.0.0.1 ads11.hyperbanner.net
127.0.0.1 ads12.focalink.com
127.0.0.1 ads12.hyperbanner.net
127.0.0.1 ads13.focalink.com
127.0.0.1 ads13.hyperbanner.net
127.0.0.1 ads14.bpath.com
127.0.0.1 ads14.focalink.com
127.0.0.1 ads14.hyperbanner.net
127.0.0.1 ads15.focalink.com
127.0.0.1 ads15.hyperbanner.net
127.0.0.1 ads16.focalink.com
127.0.0.1 ads16.hyperbanner.net
127.0.0.1 ads17.focalink.com
127.0.0.1 ads17.hyperbanner.net
127.0.0.1 ads18.focalink.com
127.0.0.1 ads18.hyperbanner.net
127.0.0.1 ads19.focalink.com
127.0.0.1 ads2.ad-flow.com
127.0.0.1 ads2.advance.net
127.0.0.1 ads2.advertwizard.com
127.0.0.1 ads2.canoe.ca
127.0.0.1 ads2.clickad.com
127.0.0.1 ads2.newtimes.com
127.0.0.1 ads2.osdn.com
127.0.0.1 ads2.realcities.com
127.0.0.1 ads2.udc.advance.net
127.0.0.1 ads2.virtumundo.com
127.0.0.1 ads2.zdnet.com
127.0.0.1 ads20.focalink.com
127.0.0.1 ads21.focalink.com
127.0.0.1 ads22.focalink.com
127.0.0.1 ads23.focalink.com
127.0.0.1 ads24.focalink.com
127.0.0.1 ads25.focalink.com
127.0.0.1 ads3.ad-flow.com
127.0.0.1 ads3.advance.net
127.0.0.1 ads3.advertwizard.com
127.0.0.1 ads3.canoe.ca
127.0.0.1 ads3.freebannertrade.com
127.0.0.1 ads3.realcities.com
127.0.0.1 ads3.virtumundo.com
127.0.0.1 ads3.zdnet.com
127.0.0.1 ads36.hyperbanner.net
127.0.0.1 ads4.ad-flow.com
127.0.0.1 ads4.advance.net
127.0.0.1 ads4.advertwizard.com
127.0.0.1 ads4.canoe.ca
127.0.0.1 ads4.clearchannel.com
127.0.0.1 ads4.realcities.com
127.0.0.1 ads4.virtumundo.com
127.0.0.1 ads5.ad-flow.com
127.0.0.1 ads5.advance.net
127.0.0.1 ads5.advertwizard.com
127.0.0.1 ads5.canoe.ca
127.0.0.1 ads5.udc.advance.net
127.0.0.1 ads5.virtumundo.com
127.0.0.1 ads6.ad-flow.com
127.0.0.1 ads6.advertwizard.com
127.0.0.1 ads7.ad-flow.com
127.0.0.1 ads7.advance.net
127.0.0.1 ads7.advertwizard.com
127.0.0.1 ads8.ad-flow.com
127.0.0.1 ads8.advertwizard.com
127.0.0.1 ads9.ad-flow.com
127.0.0.1 ads9.advertwizard.com
127.0.0.1 adsatt.abcnews.starwave.com
127.0.0.1 adsatt.espn.starwave.com
127.0.0.1 adserv.aip.org
127.0.0.1 adserv.bravenet.com
127.0.0.1 adserv.iafrica.com
127.0.0.1 adserv.internetfuel.com
127.0.0.1 adserv.quality-channel.de
127.0.0.1 adserv2.bravenet.com
127.0.0.1 adserve.viaarena.com
127.0.0.1 adserver.71i.de
127.0.0.1 adserver.adtech.de
127.0.0.1 adserver.aim4media.com
127.0.0.1 adserver.airmiles.ca
127.0.0.1 adserver.ancestry.com
127.0.0.1 adserver.anm.co.uk
127.0.0.1 adserver.dbusiness.com
127.0.0.1 adserver.digitalpartners.com
127.0.0.1 adserver.dnps.com
127.0.0.1 adserver.eham.net
127.0.0.1 adserver.eva2000.com
127.0.0.1 adserver.freenet.de
127.0.0.1 adserver.friendfinder.com
127.0.0.1 adserver.gamesquad.net
127.0.0.1 adserver.garden.com
127.0.0.1 adserver.gorillanation.com
127.0.0.1 adserver.hardwareanalysis.com
127.0.0.1 adserver.harktheherald.com
127.0.0.1 adserver.hellasnet.gr
127.0.0.1 adserver.hg-computer.de
127.0.0.1 adserver.humanux.com
127.0.0.1 adserver.ign.com
127.0.0.1 adserver.ixm.co.uk
127.0.0.1 adserver.janes.com
127.0.0.1 adserver.journalinteractive.com
127.0.0.1 adserver.linktrader.co.uk
127.0.0.1 adserver.lunarpages.com
127.0.0.1 adserver.m2kcore.com
127.0.0.1 adserver.matchcraft.com
127.0.0.1 adserver.merc.com
127.0.0.1 adserver.monster.com
127.0.0.1 adserver.news.com.au
127.0.0.1 adserver.newtimes.com
127.0.0.1 adserver.nydailynews.com
127.0.0.1 adserver.nzoom.com
127.0.0.1 adserver.phillyburbs.com
127.0.0.1 adserver.securityfocus.com
127.0.0.1 adserver.terra.com.br
127.0.0.1 adserver.thisislondon.co.uk
127.0.0.1 adserver.tilted.net
127.0.0.1 adserver.track-star.com
127.0.0.1 adserver.trader.ca
127.0.0.1 adserver.trb.com
127.0.0.1 adserver.tribuneinteractive.com
127.0.0.1 adserver.ugo.com
127.0.0.1 adserver01.ancestry.com
127.0.0.1 adserver1.backbeatmedia.com
127.0.0.1 adserver1.ogilvy-interactive.de
127.0.0.1 adserver2.creative.com
127.0.0.1 adsfac.net
127.0.0.1 adsintl.starwave.com
127.0.0.1 adsnew.userfriendly.org
127.0.0.1 adsr3pg.com.br
127.0.0.1 adsrc.bankrate.com
127.0.0.1 adsremote.scripps.com
127.0.0.1 adsrv.heraldtribune.com
127.0.0.1 adsrv.hpg.com.br
127.0.0.1 adsrv.iol.co.za
127.0.0.1 adsrv.news.com.au
127.0.0.1 adsrv.tuscaloosanews.com
127.0.0.1 adtag.sympatico.ca
127.0.0.1 adtegrity.spinbox.net
127.0.0.1 adtracking.vinden.nlfrm
127.0.0.1 adv.bannercity.ru
127.0.0.1 adv.bbanner.it
127.0.0.1 adv.surinter.net
127.0.0.1 adv.wp.pl
127.0.0.1 adveng.hiasys.com
127.0.0.1 advert.bayarea.com
127.0.0.1 advertising.gfxartist.com
127.0.0.1 advertising.hiasys.com
127.0.0.1 adverts.ecn.co.uk
127.0.0.1 adviva.net
127.0.0.1 adx.adrenalinesk.sk
127.0.0.1 affiliate.aol.com
127.0.0.1 affiliate.cfdebt.com
127.0.0.1 ajcclassifieds.com
127.0.0.1 ak.imgfarm.com
127.0.0.1 akaads-espn.starwave.com
127.0.0.1 alliance.adbureau.net
127.0.0.1 altfarm.mediaplex.com
127.0.0.1 amch.questionmarket.com
127.0.0.1 americansingles.click-url.com
127.0.0.1 antfarm-ad.flycast.com
127.0.0.1 apps5.oingo.com
127.0.0.1 arsconsole.global-intermedia.com
127.0.0.1 as1.falkag.de
127.0.0.1 au.ads.link4ads.com
127.0.0.1 aureate.com
127.0.0.1 banner.coza.com
127.0.0.1 banner.easyspace.com
127.0.0.1 banner.media-system.de
127.0.0.1 banner.northsky.com
127.0.0.1 banner.oddcast.com
127.0.0.1 banner.orb.net
127.0.0.1 banner.relcom.ru
127.0.0.1 banner2.inet-traffic.com
127.0.0.1 bannerads.anytimenews.com
127.0.0.1 bannerads.zwire.com
127.0.0.1 bannerimages.0catch.com
127.0.0.1 bannerpower.com
127.0.0.1 banners.affiliatefuel.com
127.0.0.1 banners.affiliatefuture.com
127.0.0.1 banners.bol.se
127.0.0.1 banners.directnic.com
127.0.0.1 banners.dnastudio.com
127.0.0.1 banners.easydns.com
127.0.0.1 banners.expressindia.com
127.0.0.1 banners.img.uol.com.br
127.0.0.1 banners.japantoday.com
127.0.0.1 banners.ksl.com
127.0.0.1 banners.linkbuddies.com
127.0.0.1 banners.looksmart.com
127.0.0.1 banners.netcraft.com
127.0.0.1 banners.nextcard.com
127.0.0.1 banners.pennyweb.com
127.0.0.1 banners.tucson.com
127.0.0.1 banners.valuead.com
127.0.0.1 banners.webmasterplan.com
127.0.0.1 banners.wunderground.com
127.0.0.1 banners1.linkbuddies.com
127.0.0.1 banners2.castles.org
127.0.0.1 barnesandnoble.bfast.com
127.0.0.1 bell.adcentriconline.com
127.0.0.1 beseenad.looksmart.com
127.0.0.1 betterperformance.goldenopps.info
127.0.0.1 bfast.com
127.0.0.1 bidclix.net
127.0.0.1 bild.ivwbox.de
127.0.0.1 bizad.nikkeibp.co.jp
127.0.0.1 bn.bfast.com
127.0.0.1 c1.zedo.com
127.0.0.1 c2.zedo.com
127.0.0.1 c3.zedo.com
127.0.0.1 c4.maxserving.com
127.0.0.1 c4.zedo.com
127.0.0.1 c5.zedo.com
127.0.0.1 c6.zedo.com
127.0.0.1 c7.zedo.com
127.0.0.1 cache.unicast.com
127.0.0.1 califia.imaginemedia.com
127.0.0.1 campaigns.f2.com.au
127.0.0.1 cashflowmarketing.com
127.0.0.1 cdn2.adsdk.com
127.0.0.1 click.avenuea.com
127.0.0.1 click.go2net.com
127.0.0.1 click.linksynergy.com
127.0.0.1 clickcash.webpower.com
127.0.0.1 clickit.go2net.com
127.0.0.1 clicks.adultplex.com
127.0.0.1 clipserv.adclip.com
127.0.0.1 clk.cloudyisland.com
127.0.0.1 cmhtml.overture.com
127.0.0.1 cmn1lsm2.beliefnet.com
127.0.0.1 commerce.www.ibm.com
127.0.0.1 connect.247media.ads.link4ads.com
127.0.0.1 content.ad-flow.com
127.0.0.1 coreg.flashtrack.net
127.0.0.1 cornflakes.pathfinder.com
127.0.0.1 count.casino-trade.com
127.0.0.1 counter.hitbox.com
127.0.0.1 crux.songline.com
127.0.0.1 dart.chron.com
127.0.0.1 db4.net-filter.com
127.0.0.1 dev.adforum.com
127.0.0.1 djbanners.deadjournal.com
127.0.0.1 dl.ncbuy.com
127.0.0.1 dnads.directnic.com
127.0.0.1 ehg-acdsystems.hitbox.com
127.0.0.1 ehg-legonewyorkinc.hitbox.com
127.0.0.1 engage.everyone.net
127.0.0.1 engage.speedera.net
127.0.0.1 erie.smartage.com
127.0.0.1 espn.footprint.net
127.0.0.1 etad.telegraph.co.uk
127.0.0.1 etype.adbureau.net
127.0.0.1 euniverseads.com
127.0.0.1 exits1.webquest.net
127.0.0.1 exits2.webquest.net
127.0.0.1 ezboard.bigbangmedia.com
127.0.0.1 faz.ivwbox.de
127.0.0.1 focusin.ads.targetnet.com
127.0.0.1 fp.valueclick.com
127.0.0.1 gadgeteer.pdamart.com
127.0.0.1 gavzad.keenspot.com
127.0.0.1 gcirm.burlingtonfreepress.com
127.0.0.1 gcirm.citizen-times.com
127.0.0.1 gcirm.dmregister.com
127.0.0.1 gcirm.gannett-tv.com
127.0.0.1 gcirm.lsj.com
127.0.0.1 gcirm.tennessean.com
127.0.0.1 gcrim.democratandchronicle.com
127.0.0.1 gcrim.theolympian.com
127.0.0.1 gm.preferences.com
127.0.0.1 got2goshop.com
127.0.0.1 goto.trafficmultiplier.com
127.0.0.1 gravitron.chron.com
127.0.0.1 grfx.mp3.com
127.0.0.1 gs1.idsales.co.uk
127.0.0.1 guptamedianetwork.com
127.0.0.1 hg1.hitbox.com
127.0.0.1 http300.content.ru4.com
127.0.0.1 ieee.adbureau.net
127.0.0.1 if.bbanner.it
127.0.0.1 image.i1img.com
127.0.0.1 image.linkexchange.com
127.0.0.1 imageads.canoe.ca
127.0.0.1 images.ads.fairfax.com.au
127.0.0.1 images.clickfinders.com
127.0.0.1 images.cybereps.com
127.0.0.1 images.emapadserver.com
127.0.0.1 imageserv.adtech.de
127.0.0.1 imgserv.adbutler.com
127.0.0.1 imp.partner2profit.com
127.0.0.1 impact.cossette-webpact.com
127.0.0.1 impes.tradedoubler.com
127.0.0.1 impse.tradedoubler.com
127.0.0.1 inl.adbureau.net
127.0.0.1 itxt.vibrantmedia.com
127.0.0.1 ivwbox.de
127.0.0.1 jl29jd25sm24mc29.com
127.0.0.1 kansas.valueclick.com
127.0.0.1 kicker.ivwbox.de
127.0.0.1 klipmart.dvlabs.com
127.0.0.1 klipmart.forbes.com
127.0.0.1 knight.economist.com
127.0.0.1 lanzar.publicidadweb.com
127.0.0.1 leader.linkexchange.com
127.0.0.1 links.dot.tk
127.0.0.1 linktracker.angelfire.com
127.0.0.1 liquidad.narrowcastmedia.com
127.0.0.1 lnads.osdn.com
127.0.0.1 load.focalex.com
127.0.0.1 lt.angelfire.com
127.0.0.1 m.tribalfusion.com
127.0.0.1 macaddictads.snv.futurenet.com
127.0.0.1 manuel.theonion.com
127.0.0.1 matrix.mediavantage.de
127.0.0.1 maximumpcads.imaginemedia.com
127.0.0.1 mds.centrport.net
127.0.0.1 media.adcentriconline.com
127.0.0.1 media.bonnint.net
127.0.0.1 media.fastclick.net
127.0.0.1 media.popuptraffic.com
127.0.0.1 media1.fastclick.net
127.0.0.1 media10.fastclick.net
127.0.0.1 media11.fastclick.net
127.0.0.1 media12.fastclick.net
127.0.0.1 media13.fastclick.net
127.0.0.1 media2.fastclick.net
127.0.0.1 media2.travelzoo.com
127.0.0.1 media3.fastclick.net
127.0.0.1 media4.fastclick.net
127.0.0.1 media5.fastclick.net
127.0.0.1 media6.fastclick.net
127.0.0.1 media7.fastclick.net
127.0.0.1 media8.fastclick.net
127.0.0.1 media9.fastclick.net
127.0.0.1 mediacharger.com
127.0.0.1 messagia.adcentric.proximi-t.com
127.0.0.1 mii-image.adjuggler.com
127.0.0.1 mjx.ads.nwsource.com
127.0.0.1 mjxads.internet.com
127.0.0.1 mojofarm.mediaplex.com
127.0.0.1 mt58.mtree.com
127.0.0.1 nb.netbreak.com.au
127.0.0.1 nbc.adbureau.net
127.0.0.1 netcomm.spinbox.net
127.0.0.1 netshelter.adtrix.com
127.0.0.1 network.realmedia.com
127.0.0.1 newads.cmpnet.com
127.0.0.1 ng3.ads.warnerbros.com
127.0.0.1 ngads.smartage.com
127.0.0.1 nitrous.exitfuel.com
127.0.0.1 nitrous.internetfuel.com
127.0.0.1 nsads.hotwired.com
127.0.0.1 ntbanner.digitalriver.com
127.0.0.1 nx-adv0005.247realmedia.com
127.0.0.1 nytadvertising.nytimes.com
127.0.0.1 oas-central.realmedia.com
127.0.0.1 oas-eu.247realmedia.com
127.0.0.1 oas.foxnews.com
127.0.0.1 oas.lee.net
127.0.0.1 oas.startribune.com
127.0.0.1 oas.villagevoice.com
127.0.0.1 oasads.whitepages.com
127.0.0.1 oascentral.abclocal.go.com
127.0.0.1 oascentral.adage.com
127.0.0.1 oascentral.bostonherald.com
127.0.0.1 oascentral.clearchannel.com
127.0.0.1 oascentral.construction.com
127.0.0.1 oascentral.crainsdetroit.com
127.0.0.1 oascentral.drphil.com
127.0.0.1 oascentral.foxnews.com
127.0.0.1 oascentral.sina.com
127.0.0.1 oascentral.sina.com.hk
127.0.0.1 oascentral.theonion.com
127.0.0.1 oascentral.theonionavclub.com
127.0.0.1 oascentral.thesmokinggun.com
127.0.0.1 oascentral.thespark.com
127.0.0.1 oascentral.wwe.com
127.0.0.1 oasis.zmh.zope.com
127.0.0.1 oassis.zmh.zope.com
127.0.0.1 offers.impower.com
127.0.0.1 onlineads.magicvalley.com
127.0.0.1 openad.travelnow.com
127.0.0.1 overflow.adsoftware.com
127.0.0.1 oz.valueclick.com
127.0.0.1 pagead.googlesyndication.com
127.0.0.1 pagead1.googlesyndication.com
127.0.0.1 pagead2.googlesyndication.com
127.0.0.1 partner.ah-ha.com
127.0.0.1 partner01.oingo.com
127.0.0.1 partner02.oingo.com
127.0.0.1 partner03.oingo.com
127.0.0.1 ph-ad01.focalink.com
127.0.0.1 ph-ad02.focalink.com
127.0.0.1 ph-ad03.focalink.com
127.0.0.1 ph-ad04.focalink.com
127.0.0.1 ph-ad05.focalink.com
127.0.0.1 ph-ad06.focalink.com
127.0.0.1 ph-ad07.focalink.com
127.0.0.1 ph-ad08.focalink.com
127.0.0.1 ph-ad09.focalink.com
127.0.0.1 ph-ad10.focalink.com
127.0.0.1 ph-ad11.focalink.com
127.0.0.1 ph-ad12.focalink.com
127.0.0.1 ph-ad13.focalink.com
127.0.0.1 ph-ad14.focalink.com
127.0.0.1 ph-ad15.focalink.com
127.0.0.1 ph-ad16.focalink.com
127.0.0.1 ph-ad17.focalink.com
127.0.0.1 ph-ad18.focalink.com
127.0.0.1 ph-ad19.focalink.com
127.0.0.1 ph-ad20.focalink.com
127.0.0.1 phg.hitbox.com
127.0.0.1 phpads.cnpapers.com
127.0.0.1 phpads.macbidouille.com
127.0.0.1 popup.matchmaker.com
127.0.0.1 popups.ad-logics.com
127.0.0.1 popups.infostart.com
127.0.0.1 primetime.ad.primetime.net
127.0.0.1 ptrads.mp3.com
127.0.0.1 publicidades.redtotalonline.com
127.0.0.1 q.azcentral.com
127.0.0.1 realads.realmedia.com
127.0.0.1 realmedia-a800.d4p.net # Scientific American
127.0.0.1 red01.as-eu.falkag.net
127.0.0.1 red01.as-us.falkag.net
127.0.0.1 red02.as-eu.falkag.net
127.0.0.1 red02.as-us.falkag.net
127.0.0.1 red03.as-eu.falkag.net
127.0.0.1 red03.as-us.falkag.net
127.0.0.1 red04.as-eu.falkag.net
127.0.0.1 red04.as-us.falkag.net
127.0.0.1 redherring.ngadcenter.net
127.0.0.1 redirect.click2net.com
127.0.0.1 regio.adlink.de
127.0.0.1 remotead.cnet.com
127.0.0.1 responsemedia-ad.flycast.com
127.0.0.1 rmedia.boston.com
127.0.0.1 rotabanner100.utro.ru
127.0.0.1 s0b.bluestreak.com
127.0.0.1 search.freeonline.com
127.0.0.1 secure-au.imrworldwide.com
127.0.0.1 secure.webconnect.net
127.0.0.1 securerunner.com
127.0.0.1 servads.aip.org
127.0.0.1 servedby.advertising.com
127.0.0.1 server.as5000.com
127.0.0.1 server.iad.liveperson.net
127.0.0.1 server01.popupmoney.com
127.0.0.1 sfads.osdn.com
127.0.0.1 sh4sure-images.adbureau.net
127.0.0.1 shinystat.shiny.it
127.0.0.1 simg.zedo.com
127.0.0.1 skill.skilljam.com
127.0.0.1 specialoffers.aol.com
127.0.0.1 speed.pointroll.com # Microsoft
127.0.0.1 spiegel.ivwbox.de
127.0.0.1 spin.spinbox.net
127.0.0.1 spinbox.consumerreview.com
127.0.0.1 sponsor1.com
127.0.0.1 ssads.osdn.com
127.0.0.1 st.valueclick.com
127.0.0.1 stat.dealtime.com
127.0.0.1 static.admaximize.com
127.0.0.1 static.everyone.net
127.0.0.1 static.firehunt.com
127.0.0.1 stats2.dooyoo.com
127.0.0.1 suissa-ad.flycast.com
127.0.0.1 sview.avenuea.com
127.0.0.1 techreview-images.adbureau.net
127.0.0.1 techreview.adbureau.net
127.0.0.1 thinknyc.eu-adcenter.net
127.0.0.1 tmsads.tribune.com
127.0.0.1 topica.advertserve.com
127.0.0.1 touche.adcentric.proximi-t.com
127.0.0.1 tower.adexpedia.com
127.0.0.1 transfer.go.com
127.0.0.1 tsms-ad.tsms.com
127.0.0.1 ttarget.adbureau.net
127.0.0.1 twnads.weather.ca # Canadian Weather Network
127.0.0.1 u0.extreme-dm.com
127.0.0.1 ugo.eu-adcenter.net
127.0.0.1 uk.i1.yimg.com
127.0.0.1 us.a1.yimg.com
127.0.0.1 usads.vibrantmedia.com
127.0.0.1 utils.mediageneral.com
127.0.0.1 v0.extreme-dm.com
127.0.0.1 v1.extreme-dm.com
127.0.0.1 van.ads.link4ads.com
127.0.0.1 venus.goclick.com
127.0.0.1 view.atdmt.com
127.0.0.1 view.avenuea.com
127.0.0.1 view.iballs.a1.avenuea.com
127.0.0.1 vnu.eu-adcenter.net
127.0.0.1 w.extreme-dm.com
127.0.0.1 w0.extreme-dm.com
127.0.0.1 w1.extreme-dm.com
127.0.0.1 w2.extreme-dm.com
127.0.0.1 w3.extreme-dm.com
127.0.0.1 w4.extreme-dm.com
127.0.0.1 w5.extreme-dm.com
127.0.0.1 w6.extreme-dm.com
127.0.0.1 w7.extreme-dm.com
127.0.0.1 w8.extreme-dm.com
127.0.0.1 w9.extreme-dm.com
127.0.0.1 web.nyc.ads.juno.co
127.0.0.1 web1b.netreflector.com
127.0.0.1 webads.bizservers.com
127.0.0.1 weeklyad.target.com
127.0.0.1 wwbtads.com
127.0.0.1 www.3qqq.net
127.0.0.1 www.3turtles.com
127.0.0.1 www.404errorpage.com
127.0.0.1 www.5thavenue.com
127.0.0.1 www.ad-souk.com
127.0.0.1 www.ad-up.com
127.0.0.1 www.ad.tomshardware.com
127.0.0.1 www.adbanner.gr
127.0.0.1 www.adforum.com
127.0.0.1 www.adimages.beeb.com
127.0.0.1 www.admex.com
127.0.0.1 www.adpepper.dk
127.0.0.1 www.adpowerzone.com
127.0.0.1 www.adreporting.com
127.0.0.1 www.ads.revenue.net
127.0.0.1 www.adsoftware.com
127.0.0.1 www.adtrix.com
127.0.0.1 www.affiliateclick.com
127.0.0.1 www.aureate.com
127.0.0.1 www.banner4all.dk
127.0.0.1 www.boonsolutions.com
127.0.0.1 www.bugsbanner.it
127.0.0.1 www.bulkclicks.com
127.0.0.1 www.burstnet.com
127.0.0.1 www.buyhitscheap.com
127.0.0.1 www.click10.com
127.0.0.1 www.clickbank.com
127.0.0.1 www.clicktilluwin.com
127.0.0.1 www.clickxchange.com
127.0.0.1 www.coolsavings.com
127.0.0.1 www.cpabank.com
127.0.0.1 www.crazypopups.com
127.0.0.1 www.datatech.es
127.0.0.1 www.digimedia.com
127.0.0.1 www.direc-tory.tk
127.0.0.1 www.e-bannerx.com
127.0.0.1 www.eads.com
127.0.0.1 www.ehg-rr.hitbox.com
127.0.0.1 www.fast-adv.it
127.0.0.1 www.fineclicks.com
127.0.0.1 www.focalex.com
127.0.0.1 www.fusionbanners.com
127.0.0.1 www.gatoradvertisinginformationnetwork.com
127.0.0.1 www.getloan.com
127.0.0.1 www.gopopup.com
127.0.0.1 www.guesstheview.com
127.0.0.1 www.guptamedianetwork.com
127.0.0.1 www.hightrafficads.com
127.0.0.1 www.idealcasino.net
127.0.0.1 www.idirect.com
127.0.0.1 www.ijacko.net
127.0.0.1 www.indiads.com
127.0.0.1 www.infinite-ads.com # www.shareactor.com
127.0.0.1 www.interstitialzone.com
127.0.0.1 www.iwin.com
127.0.0.1 www.jetseeker.com
127.0.0.1 www.jl29jd25sm24mc29.com
127.0.0.1 www.joinfree.ro
127.0.0.1 www.leadgreed.com
127.0.0.1 www.linkhut.com
127.0.0.1 www.lottoforever.com
127.0.0.1 www.media2.travelzoo.com
127.0.0.1 www.merchantapp.com
127.0.0.1 www.my-stats.com
127.0.0.1 www.myaffiliateprogram.com
127.0.0.1 www.myuitm.com
127.0.0.1 www.netpalnow.com
127.0.0.1 www.netpaloffers.net
127.0.0.1 www.ontheweb.com
127.0.0.1 www.parsads.com
127.0.0.1 www.paypopup.com
127.0.0.1 www.popupad.net
127.0.0.1 www.popuptraffic.com
127.0.0.1 www.postmasterbannernet.com
127.0.0.1 www.radiate.com
127.0.0.1 www.rankyou.com
127.0.0.1 www.rtcode.com
127.0.0.1 www.securerunner.com
127.0.0.1 www.servedby.advertising.com
127.0.0.1 www.shoppingjobshere.com
127.0.0.1 www.smartadserver.com
127.0.0.1 www.speedyclick.com
127.0.0.1 www.sponsoradulto.com
127.0.0.1 www.subsitesadserver.co.uk
127.0.0.1 www.textbanners.net
127.0.0.1 www.top20free.com
127.0.0.1 www.treeloot.com
127.0.0.1 www.tutop.com
127.0.0.1 www.tuttosessogratis.org
127.0.0.1 www.ukbanners.com
127.0.0.1 www.uproar.com
127.0.0.1 www.utarget.co.uk
127.0.0.1 www.valueclick.com
127.0.0.1 www.virtumundo.com
127.0.0.1 www.webcashvideos.com
127.0.0.1 www.websponsors.com
127.0.0.1 www.whatuwhatuwhatuwant.com
127.0.0.1 www.windaily.com
127.0.0.1 www.winnerschoiceservices.com
127.0.0.1 www.xbn.ru # exclusive banner network (Russian)
127.0.0.1 www1.ad.tomshardware.com
127.0.0.1 www1.bannerspace.com
127.0.0.1 www10.ad.tomshardware.com
127.0.0.1 www10.indiads.com
127.0.0.1 www10.paypopup.com
127.0.0.1 www11.ad.tomshardware.com
127.0.0.1 www12.ad.tomshardware.com
127.0.0.1 www13.ad.tomshardware.com
127.0.0.1 www14.ad.tomshardware.com
127.0.0.1 www15.ad.tomshardware.com
127.0.0.1 www2.ad.tomshardware.com
127.0.0.1 www2.bannerspace.com
127.0.0.1 www3.ad.tomshardware.com
127.0.0.1 www3.bannerspace.com
127.0.0.1 www4.ad.tomshardware.com
127.0.0.1 www4.bannerspace.com
127.0.0.1 www5.ad.tomshardware.com
127.0.0.1 www5.bannerspace.com
127.0.0.1 www6.ad.tomshardware.com
127.0.0.1 www6.bannerspace.com
127.0.0.1 www7.ad.tomshardware.com
127.0.0.1 www7.bannerspace.com
127.0.0.1 www74.valueclick.com
127.0.0.1 www8.ad.tomshardware.com
127.0.0.1 www81.valueclick.com
127.0.0.1 www9.ad.tomshardware.com
127.0.0.1 xlonhcld.xlontech.net
127.0.0.1 z.extreme-dm.com
127.0.0.1 z0.extreme-dm.com
127.0.0.1 z1.adserver.com
127.0.0.1 z1.extreme-dm.com
127.0.0.1 zads.zedo.com
127.0.0.1 zdads.e-media.com
127.0.0.1 us.b1.yimg.com
127.0.0.1 us.c1.yimg.com
127.0.0.1 us.d1.yimg.com
127.0.0.1 us.e1.yimg.com
127.0.0.1 us.f1.yimg.com
127.0.0.1 us.g1.yimg.com
127.0.0.1 us.h1.yimg.com
127.0.0.1 us.j1.yimg.com
127.0.0.1 us.k1.yimg.com
127.0.0.1 us.l1.yimg.com
127.0.0.1 us.m1.yimg.com
127.0.0.1 us.n1.yimg.com
127.0.0.1 us.o1.yimg.com
127.0.0.1 us.p1.yimg.com
127.0.0.1 us.q1.yimg.com
127.0.0.1 us.r1.yimg.com
127.0.0.1 us.s1.yimg.com
127.0.0.1 us.t1.yimg.com
127.0.0.1 us.u1.yimg.com
127.0.0.1 us.v1.yimg.com
127.0.0.1 us.w1.yimg.com
127.0.0.1 us.x1.yimg.com
127.0.0.1 us.y1.yimg.com
127.0.0.1 us.z1.yimg.com
127.0.0.1 incestland.com
127.0.0.1 www.asiansforu.com
127.0.0.1 www.datanotary.com
127.0.0.1 www.entercasino.com
127.0.0.1 www.incestdot.com
127.0.0.1 www.incestgold.com
127.0.0.1 www.mangayhentai.com
127.0.0.1 www.realincestvideos.com
127.0.0.1 www.searchv.com
127.0.0.1 www.secretosx.com
127.0.0.1 www.seductiveamateurs.com
127.0.0.1 www.xxxnations.com
127.0.0.1 www.xxxnightly.com
127.0.0.1 www.xxxtoolbar.com

ササササササササササササササササササササササササ Generic Renos Fix

GenericRenosFix by S!Ri

E:\WINDOWS\system32\afkvvy.dll -> Hoax.Win32.Renos.gen.o
E:\WINDOWS\system32\afkvvy.dll -> Deleted


ササササササササササササササササササササササササ Deleting infected files

E:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
E:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted
E:\DOCUME~1\KIERAN\FAVORI~1\Online Security Test.url Deleted
E:\Program Files\Video ActiveX Access\ Deleted

ササササササササササササササササササササササササ DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{C5081C12-9F20-4FAA-B3B1-13FF10B46180}: DhcpNameServer=192.168.1.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{C5081C12-9F20-4FAA-B3B1-13FF10B46180}: DhcpNameServer=192.168.1.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.2


ササササササササササササササササササササササササ Deleting Temp Files


ササササササササササササササササササササササササ Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


ササササササササササササササササササササササササ Registry Cleaning

Registry Cleaning done.

ササササササササササササササササササササササササ SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


ササササササササササササササササササササササササ End



Is that it?

Am I OK now?

It was this simple?

Thank you so much for your help on this journey.

Is there anything else I should be wary of?

#4 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:07:55 AM

Posted 28 June 2007 - 05:44 PM

Hello beasty_in_the_easty,

Is that it?

Am I OK now?

It was this simple?

Thank you so much for your help on this journey.

Is there anything else I should be wary of?


Yes, that is it. :flowers: You just have to know the right tool to use, and be able to analyse the Hijackthis log.

You log looks clean so you are good to go. :thumbsup:

Below I have included a number of recommendations on how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously! These few simple steps can stave off the vast majority of spyware problems.

Regularly go to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows, including the latest version of Internet Explorer. This can patch many of the security holes through which attackers can gain access to your computer. You should also turn on the Windows automatic update feature.

You should definitely maintain a firewall.
Some good free firewalls are Kerio, ZoneAlarm, or Outpost
A tutorial on understanding and using firewalls may be found here.

Remember to only install one firewall or one antivirus program per computer. Two will cause problems.

In order to protect yourself against spyware, you should consider installing and running the following free programs:

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

IE/Spyad:
It places over 5000 malicious websites and domains in your IE's restricted zone.
IE/Spyad

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

* Avoid illegal sites, because that's where most malware is present.
* Don't click on links inside popups.
* Don't click on links in spam messages claiming to offer anti-spyware software; because most of these so called removers ARE spyware.
* Download free software only from sites you know and trust. A lot of free software can bundle other software, including spyware.

Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/

Please make sure to run your antivirus software regularly, and to keep it up-to-date.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:07:55 AM

Posted 19 July 2007 - 06:01 PM

Since your problem appears to be resolved, this thread will now be closed. If you need this topic reopened, please contact me or a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users