Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Help - this is my hijackthis file -- thank you

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Help - this is my hijackthis file -- thank you

Unread postby dan12 » February 23rd, 2008, 1:01 pm

Were nearly there

The kaspersky scan that I asked for was the online scan!
The items that the kaspersky scan picked up we can deal with them soon as they are safe were they are.


Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present)

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit


I just want to check I have got these:
Right click start, In the drop down menu click "Explore" Then navigate to each file\ folder in the left hand pane, which will reveal its content in the right hand pane, highlight file or folder right click and Delete, if present:

C:\WINDOWS\wt << This folder
C:\Temp\cXzz9 <<This file

---------------------------

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

Code: Select all
      DirLook::
C:\WINDOWS\BM2b641592.xml
C:\WINDOWS\system32\83E6C90212.sys
C:\Documents and Settings\Gary Kueter\Application Data\kuetergl.zip

    


Save this as CFScript.txt, in the same location as ComboFix.exe


Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


___________________

Post the combo log after running
and a new highjackthis log.
Thanks dan
User avatar
dan12
MRU Honors Grad Emeritus
 
Posts: 6123
Joined: March 30th, 2006, 3:22 am
Location: Leicestershire
Advertisement
Register to Remove

Re: Help - this is my hijackthis file -- thank you

Unread postby sooner1948 » February 23rd, 2008, 6:10 pm

I tried to do an online kaspersky scan, but it only had a place to scan one file at a time and said to scan the whole system, I had to download the trial version - I may have missed something.....

Neither of the two files were there

here is the new combofix log

ComboFix 08-02-22.3 - Gary Kueter 2008-02-23 15:57:45.4 - NTFSx86
Running from: C:\Documents and Settings\Gary Kueter\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Gary Kueter\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-23 to 2008-02-23 )))))))))))))))))))))))))))))))
.

2008-02-22 17:43 . 2008-02-22 17:43 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-02-22 17:43 . 2008-02-22 17:43 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-02-22 17:42 . 2008-02-22 17:42 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-02-22 17:42 . 2008-02-23 08:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-22 17:42 . 2008-02-23 16:00 1,783,072 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-22 17:42 . 2008-02-22 20:50 23,660 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-22 17:42 . 2008-02-23 16:00 11,040 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-02-22 17:42 . 2008-02-22 20:50 1,412 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-02-22 17:40 . 2008-02-22 17:40 <DIR> d-------- C:\kav
2008-02-22 08:44 . 2008-02-22 08:44 <DIR> d-------- C:\Program Files\BillP Studios
2008-02-22 08:44 . 2008-02-22 08:44 <DIR> d-------- C:\Documents and Settings\Gary Kueter\Application Data\WinPatrol
2008-02-21 18:29 . 2008-02-21 18:29 70,824 --a------ C:\WINDOWS\BM2b641592.xml
2008-02-21 18:21 . 2008-02-21 18:21 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-21 10:52 . 2008-02-21 11:05 <DIR> d-------- C:\SDAT
2008-02-21 10:42 . 2008-02-21 10:42 37,786,820 --a------ C:\sdat5234.exe
2008-02-21 09:58 . 2008-02-21 09:58 61,480 --a------ C:\Documents and Settings\Gary Kueter\GoToAssistDownloadHelper.exe
2008-02-20 16:23 . 2008-02-23 09:20 8,502 --a------ C:\WINDOWS\extend.dat
2008-02-20 16:01 . 2008-02-21 08:19 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
2008-02-20 16:01 . 2008-02-23 11:01 <DIR> d-------- C:\Documents and Settings\Gary Kueter\Application Data\SiteAdvisor
2008-02-20 14:03 . 2008-02-21 12:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-20 11:57 . 2008-02-20 11:57 <DIR> d-------- C:\Program Files\SiteAdvisor
2008-02-20 11:57 . 2008-02-20 11:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-20 11:57 . 2008-02-23 08:44 8,567 --a------ C:\WINDOWS\system32\Config.MPF
2008-02-20 11:56 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-02-20 11:54 . 2007-07-21 09:08 201,288 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-20 11:54 . 2007-07-24 07:40 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-02-20 11:54 . 2007-07-21 09:08 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-02-20 11:54 . 2007-07-21 09:08 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-02-20 11:54 . 2007-07-24 12:02 33,800 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-02-20 11:53 . 2007-07-13 09:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-02-20 11:52 . 2008-02-20 16:00 <DIR> d-------- C:\Program Files\McAfee.com
2008-02-20 11:51 . 2008-02-20 16:00 <DIR> d-------- C:\Program Files\McAfee
2008-02-20 11:51 . 2008-02-20 16:00 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-02-20 11:46 . 2008-02-20 11:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-19 08:44 . 2008-02-19 08:44 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-02-19 08:28 . 2008-02-19 08:29 <DIR> d-------- C:\Program Files\ScottradeELITE
2008-02-08 18:37 . 2008-02-08 18:37 219,664 --a------ C:\WINDOWS\system32\klogon.dll
2008-02-08 18:35 . 2008-02-08 18:35 23,604 --a------ C:\WINDOWS\system32\drivers\klopp.dat
2008-01-30 11:50 . 2008-02-22 17:02 <DIR> d-------- C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 21:15 --------- d-----w C:\Program Files\Google
2008-02-20 22:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-02-20 14:04 --------- d-----w C:\Documents and Settings\Gary Kueter\Application Data\AVG7
2008-02-17 16:36 7,518 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-02-06 15:10 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-30 14:03 910,392 ----a-w C:\Documents and Settings\Gary Kueter\Application Data\kuetergl.zip
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-08 05:21 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 11:01 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-05-28 21:34 88 --sh--r C:\WINDOWS\system32\83E6C90212.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\Documents and Settings\Gary Kueter\Application Data\kuetergl.zip ----

C:\Documents and Settings\Gary Kueter\Application Data\kuetergl.zip\

---- Directory of C:\WINDOWS\BM2b641592.xml ----

C:\WINDOWS\BM2b641592.xml\

---- Directory of C:\WINDOWS\system32\83E6C90212.sys ----

C:\WINDOWS\system32\83E6C90212.sys\


------- Sigcheck -------

"C:\WINDOWS\system32\svchost.exe"
----a-w 14,336 2004-08-10 10:00:00 C:\WINDOWS\system32\svchost.exe

"C:\WINDOWS\system32\user32.dll"
-c--a-w 577,024 2005-03-02 18:19:56 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
----a-w 578,048 2007-03-08 15:48:36 C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
-c----w 577,024 2004-08-10 10:00:00 C:\WINDOWS\$NtUninstallKB890859$\user32.dll
-c----w 577,024 2005-03-02 18:09:30 C:\WINDOWS\$NtUninstallKB925902$\user32.dll
----a-w 577,536 2007-03-08 15:36:28 C:\WINDOWS\system32\user32.dll
------w 577,536 2007-03-08 15:36:28 C:\WINDOWS\system32\dllcache\user32.dll

"C:\WINDOWS\system32\ws2_32.dll"
----a-w 82,944 2004-08-10 10:00:00 C:\WINDOWS\system32\ws2_32.dll

"C:\WINDOWS\system32\wininet.dll"
-c--a-w 661,504 2005-10-21 03:38:08 C:\WINDOWS\$hf_mig$\KB905915\SP2QFE\wininet.dll
----a-w 823,296 2007-03-07 17:40:29 C:\WINDOWS\$hf_mig$\KB931768-IE7\SP2QFE\wininet.dll
----a-w 823,808 2007-04-25 09:08:34 C:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll
----a-w 824,320 2007-06-27 14:40:03 C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
----a-w 825,344 2007-08-20 10:02:11 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
----a-w 825,344 2007-10-10 23:47:29 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
----a-w 825,344 2007-12-07 02:01:13 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
-c----w 658,432 2005-10-21 03:39:30 C:\WINDOWS\$NtUninstallKB912812$\wininet.dll
-c----w 663,552 2006-03-04 03:58:52 C:\WINDOWS\$NtUninstallKB916281$\wininet.dll
-c----w 663,552 2006-05-10 05:25:22 C:\WINDOWS\$NtUninstallKB918899$\wininet.dll
-c----w 664,576 2006-06-23 11:25:31 C:\WINDOWS\$NtUninstallKB922760$\wininet.dll
-c--a-w 664,576 2006-09-14 08:31:30 C:\WINDOWS\ie7\wininet.dll
-c----w 818,688 2006-11-08 03:03:36 C:\WINDOWS\ie7updates\KB928090-IE7\wininet.dll
-c----w 822,784 2007-01-12 15:27:42 C:\WINDOWS\ie7updates\KB931768-IE7\wininet.dll
-c----w 822,784 2007-03-07 17:45:18 C:\WINDOWS\ie7updates\KB933566-IE7\wininet.dll
-c----w 822,784 2007-04-25 08:41:17 C:\WINDOWS\ie7updates\KB937143-IE7\wininet.dll
-c----w 823,808 2007-06-27 14:34:59 C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll
-c----w 824,832 2007-08-20 10:04:43 C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
-c----w 824,832 2007-10-10 23:56:00 C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
----a-w 824,832 2007-12-07 02:21:48 C:\WINDOWS\system32\wininet.dll
----a-w 824,832 2007-12-07 02:21:48 C:\WINDOWS\system32\dllcache\wininet.dll

"C:\WINDOWS\system32\drivers\tcpip.sys"
-c--a-w 360,448 2006-01-13 17:07:08 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
-c--a-w 360,576 2006-04-20 12:18:35 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
----a-w 360,832 2007-10-30 16:53:32 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
-c----w 359,040 2004-08-10 10:00:00 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
-c----w 359,808 2006-01-13 02:28:14 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
-c----w 359,808 2006-04-20 11:51:50 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
------w 360,064 2007-10-30 17:20:55 C:\WINDOWS\system32\dllcache\tcpip.sys
----a-w 360,064 2007-10-30 17:20:55 C:\WINDOWS\system32\drivers\tcpip.sys

"C:\WINDOWS\system32\winlogon.exe"
----a-w 502,272 2004-08-10 10:00:00 C:\WINDOWS\system32\winlogon.exe

"C:\WINDOWS\system32\drivers\ndis.sys"
----a-w 182,912 2004-08-10 10:00:00 C:\WINDOWS\system32\dllcache\ndis.sys
-c--a-w 182,912 2004-08-10 10:00:00 C:\WINDOWS\system32\drivers\ndis.sys

"C:\WINDOWS\system32\drivers\ip6fw.sys"
----a-w 29,056 2004-08-10 10:00:00 C:\WINDOWS\system32\drivers\ip6fw.sys

"C:\WINDOWS\system32\ntkrnlpa.exe"
-c--a-w 2,056,832 2005-03-02 00:36:40 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
-c----w 2,056,832 2004-08-10 10:00:00 C:\WINDOWS\$NtUninstallKB890859$\ntkrnlpa.exe
-c----w 2,056,832 2005-03-02 00:34:40 C:\WINDOWS\$NtUninstallKB929338$\ntkrnlpa.exe
-c----w 2,059,392 2006-12-19 16:12:16 C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe
------w 2,059,392 2007-02-28 09:15:56 C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
----a-w 2,059,392 2007-02-28 09:15:56 C:\WINDOWS\system32\ntkrnlpa.exe
------w 2,059,392 2007-02-28 09:15:56 C:\WINDOWS\system32\dllcache\ntkrnlpa.exe

"C:\WINDOWS\system32\ntoskrnl.exe"
-c--a-w 2,179,456 2005-03-02 01:04:22 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
-c----w 2,180,992 2004-08-10 10:00:00 C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe
-c----w 2,179,328 2005-03-02 00:59:53 C:\WINDOWS\$NtUninstallKB929338$\ntoskrnl.exe
-c----w 2,182,016 2006-12-19 16:51:12 C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe
------w 2,182,144 2007-02-28 09:55:14 C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
----a-w 2,182,144 2007-02-28 09:55:14 C:\WINDOWS\system32\ntoskrnl.exe
------w 2,182,144 2007-02-28 09:55:14 C:\WINDOWS\system32\dllcache\ntoskrnl.exe

"C:\WINDOWS\explorer.exe"
----a-w 1,033,216 2007-06-13 10:23:07 C:\WINDOWS\explorer.exe
----a-w 1,033,216 2007-06-13 11:26:03 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
-c----w 1,032,192 2004-08-10 10:00:00 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
------w 1,033,216 2007-06-13 10:23:07 C:\WINDOWS\system32\dllcache\explorer.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 04:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-24 11:56 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-24 15:57 36640]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-01-26 23:38 316728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 15:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=C:\WINDOWS\pss\Microsoft Find Fast.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office Shortcut Bar.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office Shortcut Bar.lnk
backup=C:\WINDOWS\pss\Microsoft Office Shortcut Bar.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=C:\WINDOWS\pss\Office Startup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_Run]
C:\PROGRA~1\Grisoft\AVG7\avgw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
--a--c--- 2006-04-24 00:38 61440 c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cleanup]
C:\DOCUME~1\GARYKU~1\LOCALS~1\Temp\2007528121420_mcappins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a--c--- 2004-08-10 04:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
--a--c--- 2005-12-15 09:44 839680 C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
--a------ 2005-05-15 01:04 332800 C:\Program Files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
--a--c--- 2005-09-08 04:20 122940 C:\WINDOWS\System32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a--c--- 2005-10-05 02:12 94208 C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
--a--c--- 2005-09-29 13:01 67584 C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-02-16 22:11 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a--c--- 2005-10-14 19:46 77824 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a--c--- 2005-10-14 19:50 114688 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a--c--- 2005-10-14 19:49 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
--a--c--- 2004-10-30 13:59 385024 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a--c--- 2005-06-10 09:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a--c--- 2005-06-10 09:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
--a------ 2007-08-03 22:33 582992 c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
--a------ 2007-08-18 03:12 394576 C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
--------- 2003-09-10 01:24 20480 C:\Program Files\NetWaiting\netWaiting.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 10:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-04-24 01:01 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a--c--- 2005-09-09 22:19 393216 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-04-24 11:56 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a--c--- 2005-11-29 03:56 761947 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-03-17 12:46 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"= %windir%\\system32\\sessmgr.exe:@xpsp2res.dll,-22019
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"= %windir%\\Network Diagnostic\\xpnetdiag.exe:@xpsp3res.dll,-20000
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-02-20 17:52:59 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-20 17:52:58 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-23 16:00:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-23 16:01:48
ComboFix-quarantined-files.txt 2008-02-23 22:01:43
ComboFix2.txt 2008-02-23 15:04:11
ComboFix3.txt 2008-02-22 23:05:22
ComboFix4.txt 2008-02-22 17:55:01
.
2008-02-13 09:02:36 --- E O F ---


and here is the hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:05:37 PM, on 2/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC12.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\Removal.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://oklahomacity.cox.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {238EC5B8-0BF5-11D5-826E-00010239321B} (OBXViewer Control) - http://ciserver.comfedcu.org/onbase//Ap ... Viewer.cab
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 6591 bytes
sooner1948
Regular Member
 
Posts: 17
Joined: February 21st, 2008, 8:28 pm

Re: Help - this is my hijackthis file -- thank you

Unread postby dan12 » February 23rd, 2008, 7:13 pm

Hi, did you disable kaspersky or delete it?
How are things now?
I just need to check a couple of things tomorrow,as I'm at work presently and don't have access to my pc.
On the works pc at the moment :(
catch you soon
dan
User avatar
dan12
MRU Honors Grad Emeritus
 
Posts: 6123
Joined: March 30th, 2006, 3:22 am
Location: Leicestershire

Re: Help - this is my hijackthis file -- thank you

Unread postby sooner1948 » February 23rd, 2008, 10:18 pm

Dan
Everything seems to be working great - I did just get a warning box about this being a suspicious website - probably from McAfee or WinPatrol

I have disabled kaspersky - but have not un-installed it yet - plan to do that when we are finished if that works with you

I suppose I should disable winPatrol also - but I may keep it on my system for now -- the McAfee is provided free from my internet access provider -- unfortunately I didn't have it installed when I got this recent bug.

You guys do a really good thing here
thanks - I will check back tomorrow
Gary
sooner1948
Regular Member
 
Posts: 17
Joined: February 21st, 2008, 8:28 pm

Re: Help - this is my hijackthis file -- thank you

Unread postby dan12 » February 24th, 2008, 4:21 am

Hi,Gary,
You should be fine with winpatrol, it's just two antivirus programs on the same system don't work well together.

Ok, couple of things I want you to do for me.

Submit a couple of files to Jotti
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath,browse and find the file click open which will place it in the field.

C:\WINDOWS\system32\83E6C90212.sys
C:\WINDOWS\BM2b641592.xml

Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

------------------------

Could you have a look and see if you can find: C:\Documents and Settings\Gary Kueter\Application Data\kuetergl.zip

If you can, could you upload it to Thespykiller forums. Just start a new thread, tell them I sent you and include a link to this thread, I don't know what that file is yet, but if it's something new then the experts will need to look at it.

http://www.thespykiller.co.uk/index.php?board=1.0

-----------------------


Open notepad and copy and paste this text in it:

Code: Select all
@echo off
if exist C:\kresults.txt del /q C:\kresults.txt
type C:\WINDOWS\system32\83E6C90212.sys >> C:\kresults.txt
@echo. >> C:\kresults.txt
@echo ========================================================== >> C:\kresults.txt
@echo ========================================================== >> C:\kresults.txt
@echo. >> C:\kresults.txt
type C:\WINDOWS\BM2b641592.xml >> C:\kresults.txt
start notepad C:\kresults.txt
del /q look.bat
exit


Save this as look.bat , choose to save it as *all files and place it on your desktop.
Doubleclick look.bat and post the content of the txtfile you get in your next reply together with a new hijackthislog.

dan
User avatar
dan12
MRU Honors Grad Emeritus
 
Posts: 6123
Joined: March 30th, 2006, 3:22 am
Location: Leicestershire

Re: Help - this is my hijackthis file -- thank you

Unread postby sooner1948 » February 24th, 2008, 1:08 pm

dan

Could not find this file ----- C:\WINDOWS\system32\83E6C90212.sys
found this one - C:\WINDOWS\BM2b641592.xml - Jotti was at 100% so went to virustotal and submitted it -- still waiting for it to load??? -- if/when I get resluts I will sent it

Did not find: C:\Documents and Settings\Gary Kueter\Application Data\kuetergl.zip
there does not appear to exist an "Application Data" folder

this is the kresults file

 P Ô6Í+Olæ-Ò ±ôËØ®ŽÐÅuB
==========================================================
==========================================================

<ROOT><CAMPAIGNLIST><CAMPAIGN name="bs120x240" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[115,125,235,245,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x240/120x240_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs120x600" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[115,125,595,605,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x600/120x600_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs120x90" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[115,125,85,95,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/120x90/120x90_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs125x125" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[120,130,120,130,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/125x125/125x125_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs160x600" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[155,165,595,605,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/160x600/160x600_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs180x150" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[175,185,145,155,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/180x150/180x150_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs234x60" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[229,239,55,65,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/234x60/234x60_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs240x400" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[235,245,395,405,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/240x400/240x400_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs250x250" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[245,255,245,255,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/250x250/250x250_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs300x100" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[295,305,95,105,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x100/300x100_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs300x250" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[295,305,245,255,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/300x250/300x250_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs336x280" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[331,341,275,285,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/336x280/336x280_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs468x60" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[463,473,55,65,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/468x60/468x60_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs720x300" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[715,725,295,305,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/720x300/720x300_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN><CAMPAIGN name="bs728x90" id="2008020713"><options><option name="count" value="100"/><option name="interval" value="1"/></options><commands><command name="replacebanners"><![CDATA[728,730,90,95,0]]><banner_source id="1" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_1.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="2" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_2.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="3" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_3.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="4" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_4.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="5" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_5.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="6" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_6.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="7" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_7.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="8" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_8.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="9" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_9.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="10" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_10.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="11" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_11.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="12" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_12.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="13" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_13.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="14" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_14.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="15" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_15.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="16" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_16.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="17" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_17.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="18" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_18.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="19" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_19.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="20" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_20.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="21" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_21.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="22" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_22.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="23" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_23.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="24" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_24.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="25" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_25.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="26" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_26.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="27" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_27.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="28" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_28.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="29" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_29.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="30" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_30.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="31" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_31.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source><banner_source id="32" weight="1"><iframe_src><![CDATA[http://85.12.43.83/fls.snp/728x90/728x90_32.html?a=b]]></iframe_src><img_src><![CDATA[]]></img_src><img_href><![CDATA[]]></img_href></banner_source></command></commands><rules><rule type="urlkeyword"><![CDATA[.]]></rule><rule type="metakeyword"><![CDATA[.]]></rule><rule type="contentkeyword"><![CDATA[.]]></rule></rules><internal_state><current_match_count value="0"/><last_match_time value="0"/></internal_state></CAMPAIGN></CAMPAIGNLIST><COOKIES><COOKIE>ip=NzAuMTg5LjEyNS4xMQ##</COOKIE><COOKIE>country=VVM#</COOKIE><COOKIE>network=Y3g#</COOKIE></COOKIES></ROOT>


and here is aa new hijackthislog.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:03:37 AM, on 2/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
c:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6172\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC12.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\Removal.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://oklahomacity.cox.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {238EC5B8-0BF5-11D5-826E-00010239321B} (OBXViewer Control) - http://ciserver.comfedcu.org/onbase//Ap ... Viewer.cab
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - c:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 6525 bytes
sooner1948
Regular Member
 
Posts: 17
Joined: February 21st, 2008, 8:28 pm

Re: Help - this is my hijackthis file -- thank you

Unread postby dan12 » February 24th, 2008, 1:36 pm

Could you try this, if the folder is not there I don't think it will work just want to be sure.


Open notepad and copy and paste this text in it:

Code: Select all
@echo off
if exist C:\kresults.txt del /q C:\kresults.txt
type C:\Documents and Settings\Gary Kueter\Application Data\kuetergl.zip >> C:\kresults.txt
@echo. >> C:\kresults.txt
@echo ========================================================== >> C:\kresults.txt
@echo ========================================================== >> C:\kresults.txt
start notepad C:\kresults.txt
del /q look.bat
exit


Save this as look.bat , choose to save it as *all files and place it on your desktop.
Doubleclick look.bat and post the content of the txtfile you get in your next reply


Let me know when you have results on that file your uploading :)
dan
User avatar
dan12
MRU Honors Grad Emeritus
 
Posts: 6123
Joined: March 30th, 2006, 3:22 am
Location: Leicestershire

Re: Help - this is my hijackthis file -- thank you

Unread postby sooner1948 » February 24th, 2008, 1:43 pm

dan, this is what I got back

==========================================================
==========================================================


this is what is on my virustotal screen...??

File ___ received on ___
Current status: Loading ... queued waiting scanning

Loading server information...
sooner1948
Regular Member
 
Posts: 17
Joined: February 21st, 2008, 8:28 pm

Re: Help - this is my hijackthis file -- thank you

Unread postby dan12 » February 24th, 2008, 1:58 pm

Are you saying that is what you got back from virus total reference the file you could find to upload!
You have to wait for the scans to run then it puts an output for you to copy and past to me.
If this has not happened, try jotti's again these places are busy.
see how you go.

Finish that task, before you start my last post ref the zip folder look.bat
you doing well
dan
User avatar
dan12
MRU Honors Grad Emeritus
 
Posts: 6123
Joined: March 30th, 2006, 3:22 am
Location: Leicestershire

Re: Help - this is my hijackthis file -- thank you

Unread postby sooner1948 » February 24th, 2008, 2:13 pm

that was what I got back from the look program

I will try jottis also ---- when I find the file and it is put into the box, the "submit" button does not lite up
I assume that means it is busy = I will wait for it and the virustotal programs.......

I will run your bat file again after one of those programs finishes running
sooner1948
Regular Member
 
Posts: 17
Joined: February 21st, 2008, 8:28 pm

Re: Help - this is my hijackthis file -- thank you

Unread postby sooner1948 » February 24th, 2008, 2:47 pm

dan
I just noticed this note on the top of the jotti screen:

Warning: you seem to have javascript disabled. This is necessary for the display of results.

Im not sure how/where to enable javascript -

I think that may be fixed

jotti still keeps re-trying to run the file.....
Last edited by sooner1948 on February 24th, 2008, 6:14 pm, edited 1 time in total.
sooner1948
Regular Member
 
Posts: 17
Joined: February 21st, 2008, 8:28 pm

Re: Help - this is my hijackthis file -- thank you

Unread postby sooner1948 » February 24th, 2008, 4:13 pm

got this from virsutotal

| Slovenščina | Dansk | Русский | Română | Türkçe | Nederlands | Ελληνικά | Français | Svenska | Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español
Virustotal is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...
File BM2b641592.xml received on 02.24.2008 16:34:49 (CET)
Current status: finished

Result: 0/32 (0.00%)
Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.2.22.0 2008.02.22 -
AntiVir 7.6.0.67 2008.02.22 -
Authentium 4.93.8 2008.02.24 -
Avast 4.7.1098.0 2008.02.23 -
AVG 7.5.0.516 2008.02.24 -
BitDefender 7.2 2008.02.24 -
CAT-QuickHeal 9.50 2008.02.22 -
ClamAV 0.92.1 2008.02.24 -
DrWeb 4.44.0.09170 2008.02.24 -
eSafe 7.0.15.0 2008.02.21 -
eTrust-Vet 31.3.5557 2008.02.23 -
Ewido 4.0 2008.02.24 -
FileAdvisor 1 2008.02.24 -
Fortinet 3.14.0.0 2008.02.24 -
F-Prot 4.4.2.54 2008.02.23 -
F-Secure 6.70.13260.0 2008.02.23 -
Ikarus T3.1.1.20 2008.02.24 -
Kaspersky 7.0.0.125 2008.02.24 -
McAfee 5236 2008.02.22 -
Microsoft 1.3204 2008.02.24 -
NOD32v2 2898 2008.02.23 -
Norman 5.80.02 2008.02.22 -
Panda 9.0.0.4 2008.02.24 -
Prevx1 V2 2008.02.24 -
Rising 20.32.62.00 2008.02.24 -
Sophos 4.26.0 2008.02.24 -
Sunbelt 3.0.893.0 2008.02.23 -
Symantec 10 2008.02.24 -
TheHacker 6.2.9.228 2008.02.23 -
VBA32 3.12.6.1 2008.02.21 -
VirusBuster 4.3.26:9 2008.02.23 -
Webwasher-Gateway 6.6.2 2008.02.23 -
Additional information
File size: 70824 bytes
MD5: b84de2eb650969e36ca7eb61634d3321
SHA1: 6966edaab941f5624ded58d00da1540a878ed6db
PEiD: -


ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com


also ran this bat file

@echo off
if exist C:\kresults.txt del /q C:\kresults.txt
type C:\Documents and Settings\Gary Kueter\Application Data\kuetergl.zip >> C:\kresults.txt
@echo. >> C:\kresults.txt
@echo ========================================================== >> C:\kresults.txt
@echo ========================================================== >> C:\kresults.txt
start notepad C:\kresults.txt
del /q look.bat
exit


with this result

==========================================================
==========================================================

jotties still has not given me anything
finally got it................

Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1

File to upload & scan:
Service
Service load: 0% 100%

File: BM2b641592.xml
Status: OK
MD5: b84de2eb650969e36ca7eb61634d3321
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 24 Feb 2008 23:01:46 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Powered by

Disclaimer
This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service.

Also, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita.

Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware.

Virus definitions are updated every hour. There is a 10Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample.

Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. Read more about this in our privacy policy. If you do not want your files to be distributed, please do not send them at all.

Sponsored by HotelScraper.com.
--------------------------------------------------------------------------------


Statistics
Last file scanned at least one scanner reported something about: AQFinal_1.3.1.zip (MD5: ea4b97de011a2b6481bf4d9a2f52e2fc, size: 1398550 bytes), detected by:

Scanner Malware name
A-Squared X
AntiVir X
ArcaVir X
Avast X
AVG Antivirus Downloader.Generic_c.IH
BitDefender X
ClamAV PUA.Packed.MEW-1
CPsecure X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Ikarus Suspect code-parts
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control Suspicious_M.gen
Panda Antivirus X
Rising Antivirus X
Sophos Antivirus Mal/EncPk-BU
VirusBuster X
VBA32 X


You're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives
We are not affiliated with any third parties that conduct tests using this service.





Frequently asked questions - Feedback - Privacy policy



Page generated by JTPL

© 2004-2008 Jordi Bosveld <jotti@jotti.org>
sooner1948
Regular Member
 
Posts: 17
Joined: February 21st, 2008, 8:28 pm

Re: Help - this is my hijackthis file -- thank you

Unread postby dan12 » February 24th, 2008, 8:21 pm

Ok,well done for your efforts and sticking with it.
I'm quite happy now that have spoken to one of my collegues and we were able to view the returned text.
I'm happy for it to go. Will post you Instruction soon.

Will catch you in the morning as working again.
dan
:)
User avatar
dan12
MRU Honors Grad Emeritus
 
Posts: 6123
Joined: March 30th, 2006, 3:22 am
Location: Leicestershire

Re: Help - this is my hijackthis file -- thank you

Unread postby sooner1948 » February 24th, 2008, 8:51 pm

Dan
I have un-installed Kaspersky and WinPatrol
I chose to keep McAfee as it will be regularly updated at no cost by my internet provider

my pc has not run so well in a long time
sort of like when you change the oil and clean your car inside and out - drives like a new one...

thank you
sooner1948
Regular Member
 
Posts: 17
Joined: February 21st, 2008, 8:28 pm

Re: Help - this is my hijackthis file -- thank you

Unread postby dan12 » February 25th, 2008, 4:54 am

Hi,Gary,

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present)

O16 - DPF: {238EC5B8-0BF5-11D5-826E-00010239321B} (OBXViewer Control) - http://ciserver.comfedcu.org/onbase//Ap ... Viewer.cab

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit

---------------------------------



1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

Code: Select all
    File::
C:\WINDOWS\system32\83E6C90212.sys
C:\WINDOWS\BM2b641592.xml 

    Folder::
C:\Documents and Settings\Gary Kueter\Application Data\kuetergl.zip

       


Save this as CFScript.txt, in the same location as ComboFix.exe


Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


--------------------------------------


: Malwarebytes' Anti-Malware :

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\\Documents and Settings\\Username\\Application Data\\Malwarebytes\\Malwarebytes' Anti-Malware\\Logs\\mbam-log-date (time).txt


post a newHJT log
malwarebytes log
ComboFix.txt
dan
User avatar
dan12
MRU Honors Grad Emeritus
 
Posts: 6123
Joined: March 30th, 2006, 3:22 am
Location: Leicestershire
Advertisement
Register to Remove

PreviousNext

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 40 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware