Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Help!!...... Pop-Ups

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Help!!...... Pop-Ups

Unread postby aussie » November 17th, 2007, 8:39 pm

Hi guys.

The last few days I have been getting nothing but "Warnings" popping up re spyware.

I have run several different Anti Virus programs and several different Spyware removal programs.
These have removed most but not all.

I would greatly appreciate any help you can give me in removing these annoying issues


Aussie...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:34:57 AM, on 11/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\AdsGone\AdsGone.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TrojanHunter 5.0\TrojanHunter.exe
C:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {2D42D689-4B94-4734-92C2-606FC5F4C15D} - C:\WINDOWS\oprevtdp.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: The bonsws - {CBF19702-9D5B-44E7-8F8A-6750209B76F3} - C:\WINDOWS\bonsws.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: AdsGone.lnk = C:\Program Files\AdsGone\AdsGone.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?82b43d9504bd4ad69056bcd079f09299
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?82b43d9504bd4ad69056bcd079f09299
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6545566937
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O21 - SSODL: nopctrl - {3CB6E27C-4611-4C8A-86D4-067C0146FCBF} - C:\WINDOWS\nopctrl.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

--
End of file - 8200 bytes
aussie
Active Member
 
Posts: 7
Joined: November 17th, 2007, 8:30 pm
Advertisement
Register to Remove

Re: Help!!...... Pop-Ups

Unread postby random/random » November 18th, 2007, 11:59 am

Please download SmitfraudFix (by S!Ri)

Double-click SmitfraudFix.exe.
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

Post back with the smitfraudfix log and a new HijackThis log
User avatar
random/random
Developer
Developer
 
Posts: 7733
Joined: December 18th, 2005, 3:30 pm

Re: Help!!...... Pop-Ups

Unread postby aussie » November 18th, 2007, 5:39 pm

Report sent as requested.

Thanks for your help



SmitFraudFix v2.253

Scan done at 7:38:11.75, Mon 11/19/2007
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\TrojanHunter 5.0\THGuard.exe
C:\Program Files\AdsGone\AdsGone.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\OEM


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\OEM\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\OEM\FAVORI~1

C:\DOCUME~1\OEM\FAVORI~1\Error Cleaner.url FOUND !
C:\DOCUME~1\OEM\FAVORI~1\Privacy Protector.url FOUND !
C:\DOCUME~1\OEM\FAVORI~1\Spyware?Malware Protection.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

C:\DOCUME~1\OEM\Desktop\Error Cleaner.url FOUND !
C:\DOCUME~1\OEM\Desktop\Privacy Protector.url FOUND !
C:\DOCUME~1\OEM\Desktop\Spyware?Malware Protection.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"=""
"SubscribedURL"=""
"FriendlyName"="Privacy Protection"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: VIA Rhine II Fast Ethernet Adapter - Packet Scheduler Miniport
DNS Server Search Order: 10.0.0.138

HKLM\SYSTEM\CCS\Services\Tcpip\..\{28F49DA5-9DD8-4E8A-B429-CF62919014B9}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS1\Services\Tcpip\..\{28F49DA5-9DD8-4E8A-B429-CF62919014B9}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS2\Services\Tcpip\..\{28F49DA5-9DD8-4E8A-B429-CF62919014B9}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End
aussie
Active Member
 
Posts: 7
Joined: November 17th, 2007, 8:30 pm

Re: Help!!...... Pop-Ups

Unread postby aussie » November 18th, 2007, 5:42 pm

Sorry, missed the Hijack Log request



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:41:35 AM, on 11/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\AdsGone\AdsGone.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {2D42D689-4B94-4734-92C2-606FC5F4C15D} - C:\WINDOWS\oprevtdp.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: The bonsws - {CBF19702-9D5B-44E7-8F8A-6750209B76F3} - C:\WINDOWS\bonsws.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: AdsGone.lnk = C:\Program Files\AdsGone\AdsGone.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?82b43d9504bd4ad69056bcd079f09299
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?82b43d9504bd4ad69056bcd079f09299
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6545566937
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O21 - SSODL: nopctrl - {3CB6E27C-4611-4C8A-86D4-067C0146FCBF} - C:\WINDOWS\nopctrl.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

--
End of file - 8177 bytes
aussie
Active Member
 
Posts: 7
Joined: November 17th, 2007, 8:30 pm

Re: Help!!...... Pop-Ups

Unread postby random/random » November 18th, 2007, 5:44 pm

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply, along with a new HijackThis log.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.
User avatar
random/random
Developer
Developer
 
Posts: 7733
Joined: December 18th, 2005, 3:30 pm

Re: Help!!...... Pop-Ups

Unread postby aussie » November 19th, 2007, 4:27 am

SmitFraudFix v2.253

Scan done at 18:15:22.07, Mon 11/19/2007
Run from C:\Documents and Settings\OEM\Desktop\New Folder (3)\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 actionsplash.com
127.0.0.1 ads.x10.com
127.0.0.1 images.x10.com
127.0.0.1 adserv.internetfuel.com
127.0.0.1 popme.163.com
127.0.0.1 servedby.advertising.com
127.0.0.1 specialoffers.aol.com
127.0.0.1 whenushop.whenu.com
127.0.0.1 http://www.popupnation.com
127.0.0.1 http://www.popuptraffic.com
127.0.0.1 view.popupsponsor.com
127.0.0.1 popups.infostart.com
127.0.0.1 ads.ad-flow.com
127.0.0.1 http://www.popupmoney.com
127.0.0.1 ad0.popupad.net
127.0.0.1 ad00.popupad.net
127.0.0.1 ad01.popupad.net
127.0.0.1 ad03.popupad.net
127.0.0.1 ad04.popupad.net
127.0.0.1 ad05.popupad.net
127.0.0.1 ad06.popupad.net
127.0.0.1 ad07.popupad.net
127.0.0.1 ad08.popupad.net
127.0.0.1 ad09.popupad.net
127.0.0.1 contest.x10.com
127.0.0.1 control.x10.com
127.0.0.1 graphics.x10.com
127.0.0.1 reports.x10.com
127.0.0.1 software.x10.com
127.0.0.1 store.x10.com
127.0.0.1 http://www.x10.com
127.0.0.1 101order.com
127.0.0.1 123banners.com
127.0.0.1 123found.com
127.0.0.1 180solutions.com
127.0.0.1 247media.com
127.0.0.1 24pm-affiliation.com
127.0.0.1 2o7.net
127.0.0.1 4affiliate.net
127.0.0.1 4d5.net
127.0.0.1 7adpower.com
127.0.0.1 911promotion.com
127.0.0.1 a.boom.ro
127.0.0.1 a.consumer.net
127.0.0.1 a.mktw.net
127.0.0.1 a.r.tv.com
127.0.0.1 a.rn11.com
127.0.0.1 a.xanga.com
127.0.0.1 a32.g.a.yimg.com
127.0.0.1 aaddzz.com
127.0.0.1 abcnews.footprint.net
127.0.0.1 abetterinternet.com
127.0.0.1 abz.com
127.0.0.1 ac.rnm.ca
127.0.0.1 accelerator-media.com
127.0.0.1 action.ientry.net
127.0.0.1 actionsplash.com
127.0.0.1 ad-annex.com
127.0.0.1 ad-flow.com
127.0.0.1 ad-images.suntimes.com
127.0.0.1 ad-rotator.com
127.0.0.1 ad-server.gulasidorna.se
127.0.0.1 ad-souk.com
127.0.0.1 ad-space.net
127.0.0.1 ad-universe.com
127.0.0.1 ad-up.com
127.0.0.1 ad.100.tbn.ru
127.0.0.1 ad.37.com
127.0.0.1 ad.4web.cz
127.0.0.1 ad.71i.de
127.0.0.1 ad.abcnews.com
127.0.0.1 ad.abctv.com
127.0.0.1 ad.about.com
127.0.0.1 ad.aboutit.de
127.0.0.1 ad.aboutwebservices.com
127.0.0.1 ad.aftonbladet.se
127.0.0.1 ad.allstar.cz
127.0.0.1 ad.altervista.org
127.0.0.1 ad.bondage.com
127.0.0.1 ad.centrum.cz
127.0.0.1 ad.cgi.cz
127.0.0.1 ad.clix.pt
127.0.0.1 ad.digitallook.com
127.0.0.1 ad.directconnect.se
127.0.0.1 ad.disney.go.com
127.0.0.1 ad.domainfactory.de
127.0.0.1 ad.dvdforum.nu
127.0.0.1 ad.e-not.net
127.0.0.1 ad.eurosport.com
127.0.0.1 ad.ezpeer.com
127.0.0.1 ad.fido.net
127.0.0.1 ad.fragzone.se
127.0.0.1 ad.free6.com
127.0.0.1 ad.grafika.cz
127.0.0.1 ad.harmony-central.com
127.0.0.1 ad.howstuffworks.com
127.0.0.1 ad.hyena.cz
127.0.0.1 ad.iinfo.cz
127.0.0.1 ad.ilse.nl
127.0.0.1 ad.img.yahoo.co.kr
127.0.0.1 ad.infoseek.com
127.0.0.1 ad.investopedia.com
127.0.0.1 ad.ir.ru
127.0.0.1 ad.jetsoftware.com
127.0.0.1 ad.keenspace.com
127.0.0.1 ad.krutilka.ru
127.0.0.1 ad.kvantum.cz
127.0.0.1 ad.leadcrunch.com
127.0.0.1 ad.linx.cz
127.0.0.1 ad.liveinternet.ru
127.0.0.1 ad.lupa.cz
127.0.0.1 ad.mediastorm.hu
127.0.0.1 ad.mgd.de
127.0.0.1 ad.moscowtimes.ru
127.0.0.1 ad.musicmatch.com
127.0.0.1 ad.mwizard.net
127.0.0.1 ad.nozonedata.com
127.0.0.1 ad.pbs.bb.ru
127.0.0.1 ad.playground.ru
127.0.0.1 ad.rambler.ru
127.0.0.1 ad.seznam.cz
127.0.0.1 ad.simgames.net
127.0.0.1 ad.smni.com
127.0.0.1 ad.spieletips.de
127.0.0.1 ad.suprnova.org
127.0.0.1 ad.surfsecret.com
127.0.0.1 ad.sweclockers.com
127.0.0.1 ad.t2t2.com
127.0.0.1 ad.tbn.ru
127.0.0.1 ad.tiscali.com
127.0.0.1 ad.tisnet.net.tw
127.0.0.1 ad.tomshardware.com
127.0.0.1 ad.top50.to
127.0.0.1 ad.tv2.no
127.0.0.1 ad.uk.tangozebra.com
127.0.0.1 ad.uol.com.br
127.0.0.1 ad.usatoday.com
127.0.0.1 ad.way.cz
127.0.0.1 ad.wz.cz
127.0.0.1 ad.yadro.ru
127.0.0.1 ad01.mediacorpsingapore.com
127.0.0.1 ad1.emediate.dk
127.0.0.1 ad1.gamezone.com
127.0.0.1 ad1.hardware.no
127.0.0.1 ad1.kde.cz
127.0.0.1 ad1.lbe.ru
127.0.0.1 ad1.outpost.com
127.0.0.1 ad1.zendmedia.com
127.0.0.1 ad2.atlas.cz
127.0.0.1 ad2.bb.ru
127.0.0.1 ad2.insitemedia.hu
127.0.0.1 ad2.lbe.ru
127.0.0.1 ad2.linx.cz
127.0.0.1 ad2.linxcz.cz
127.0.0.1 ad2.lupa.cz
127.0.0.1 ad2.mamma.com
127.0.0.1 ad2.seznam.cz
127.0.0.1 ad2.tisnet.net.tw
127.0.0.1 ad3.tisnet.net.tw
127.0.0.1 ad4.atlas.cz
127.0.0.1 ad4.tisnet.net.tw
127.0.0.1 ad41.atlas.cz
127.0.0.1 ad4ex.com
127.0.0.1 adbanner.ro
127.0.0.1 adbot.com
127.0.0.1 adbot.theonion.com
127.0.0.1 adbureau.net
127.0.0.1 adbutler.com
127.0.0.1 adcenter.mdf.se
127.0.0.1 adcenter.net
127.0.0.1 adcentriconline.com
127.0.0.1 adcept.net
127.0.0.1 adclick.com
127.0.0.1 adclick.gamespy.com
127.0.0.1 adclick.mint.se
127.0.0.1 adclick.ro
127.0.0.1 adcodes.bla-bla.com
127.0.0.1 adcomplete.com
127.0.0.1 adcontent.gamespy.com
127.0.0.1 adcontroller.unicast.com
127.0.0.1 adcreative.tribuneinteractive.com
127.0.0.1 adcycle.com
127.0.0.1 adcycle.icpeurope.net
127.0.0.1 addfreestats.com
127.0.0.1 addme.com
127.0.0.1 addsdev.mediapost.com
127.0.0.1 addynamix.com
127.0.0.1 adevents.msn.com
127.0.0.1 adext.inkclub.com
127.0.0.1 adfarm.mediaplex.com
127.0.0.1 adfiles.api.no
127.0.0.1 adflight.com
127.0.0.1 adfly.com
127.0.0.1 adhearus.com
127.0.0.1 adi.mainichi.co.jp
127.0.0.1 adimage.asiaone.com.sg
127.0.0.1 adimages.been.com
127.0.0.1 adimages.go.com
127.0.0.1 adimages.sanomawsoy.fi
127.0.0.1 adimg.cnet.com
127.0.0.1 adimg1.chosun.com
127.0.0.1 adimgs.sapo.pt
127.0.0.1 adincl.gopher.com
127.0.0.1 adition.net
127.0.0.1 adjuggler.yourdictionary.com
127.0.0.1 adlegend.com
127.0.0.1 adlink.de
127.0.0.1 adlog.com.com
127.0.0.1 adlogix.net
127.0.0.1 adm.ad.asap-asp.net
127.0.0.1 adman.freeze.com
127.0.0.1 admanagement.ch
127.0.0.1 admanager.beweb.com
127.0.0.1 admanager.btopenworld.com
127.0.0.1 admanager.persianblog.com
127.0.0.1 admaximize.com
127.0.0.1 admedia.ro
127.0.0.1 admex.com
127.0.0.1 adminshop.com
127.0.0.1 admonitor.net
127.0.0.1 admotion.com.ar
127.0.0.1 ado.internet.cz
127.0.0.1 adorigin.com
127.0.0.1 adpepper.dk
127.0.0.1 adpick.switchboard.com
127.0.0.1 adprofile.net
127.0.0.1 adprojekt.pl
127.0.0.1 adpush.dreamscape.com
127.0.0.1 adq.nextag.com
127.0.0.1 adremote.pathfinder.com
127.0.0.1 adrenaline.cz
127.0.0.1 adrenalinesk.sk
127.0.0.1 adreporting.com
127.0.0.1 adres.internet.com
127.0.0.1 adrevolver.com
127.0.0.1 adriver.ru
127.0.0.1 adroar.com
127.0.0.1 adrotator.net
127.0.0.1 adrun.net
127.0.0.1 ads-205.quarterserver.de
127.0.0.1 ads-de.spray.net
127.0.0.1 ads.5ci.lt
127.0.0.1 ads.aceweb.net
127.0.0.1 ads.activeagent.at
127.0.0.1 ads.addesktop.com
127.0.0.1 ads.adultfriendfinder.com
127.0.0.1 ads.advance.net
127.0.0.1 ads.adverline.com
127.0.0.1 ads.affiliates.match.com
127.0.0.1 ads.allsites.com
127.0.0.1 ads.alwayson-network.com
127.0.0.1 ads.amazingmedia.com
127.0.0.1 ads.amdmb.com
127.0.0.1 ads.aol.com
127.0.0.1 ads.as4x.tmcs.net
127.0.0.1 ads.asia1.com.sg
127.0.0.1 ads.asiafriendfinder.com
127.0.0.1 ads.aspalliance.com
127.0.0.1 ads.astalavista.us
127.0.0.1 ads.battle.net
127.0.0.1 ads.belointeractive.com
127.0.0.1 ads.betanews.com
127.0.0.1 ads.bfast.com
127.0.0.1 ads.bianca.com
127.0.0.1 ads.bigcitytools.com
127.0.0.1 ads.bigfoot.com
127.0.0.1 ads.bitsonthewire.com
127.0.0.1 ads.blick.ch
127.0.0.1 ads.bloomberg.com
127.0.0.1 ads.bluemountain.com
127.0.0.1 ads.box.sk
127.0.0.1 ads.businessweek.com
127.0.0.1 ads.canoe.ca
127.0.0.1 ads.cbc.ca
127.0.0.1 ads.cdfreaks.com
127.0.0.1 ads.centraliprom.com
127.0.0.1 ads.cgnetworks.com
127.0.0.1 ads.channel4.com
127.0.0.1 ads.chipcenter.com
127.0.0.1 ads.cimedia.com
127.0.0.1 ads.clearchannel.com
127.0.0.1 ads.collegclub.com
127.0.0.1 ads.com.com
127.0.0.1 ads.currantbun.com
127.0.0.1 ads.cyberfight.ru
127.0.0.1 ads.cybersales.cz
127.0.0.1 ads.danworld.net
127.0.0.1 ads.datingyes.com
127.0.0.1 ads.dbforums.com
127.0.0.1 ads.ddj.com
127.0.0.1 ads.deltha.hu
127.0.0.1 ads.dennisnet.co.uk
127.0.0.1 ads.desmoinesregister.com
127.0.0.1 ads.detelefoongids.nl
127.0.0.1 ads.developershed.com
127.0.0.1 ads.deviantart.com
127.0.0.1 ads.directionsmag.com
127.0.0.1 ads.discovery.com
127.0.0.1 ads.dk
127.0.0.1 ads.dmk-internet.com
127.0.0.1 ads.e-planning.net
127.0.0.1 ads.einmedia.com
127.0.0.1 ads.enliven.com
127.0.0.1 ads.erotism.com
127.0.0.1 ads.esmas.com
127.0.0.1 ads.eu.msn.com
127.0.0.1 ads.eudora.com
127.0.0.1 ads.everythingirc.com
127.0.0.1 ads.exhedra.com
127.0.0.1 ads.fairfax.com.au
127.0.0.1 ads.filmup.com
127.0.0.1 ads.firingsquad.com
127.0.0.1 ads.flooble.com
127.0.0.1 ads.floridatoday.com
127.0.0.1 ads.fool.com
127.0.0.1 ads.forbes.com
127.0.0.1 ads.forbes.net
127.0.0.1 ads.fortunecity.com
127.0.0.1 ads.foxkidseurope.net
127.0.0.1 ads.freecity.de
127.0.0.1 ads.freeze.com
127.0.0.1 ads.friendtest.com
127.0.0.1 ads.ft.com
127.0.0.1 ads.g4techtv.com
127.0.0.1 ads.game.net
127.0.0.1 ads.gamecity.net
127.0.0.1 ads.gamecopyworld.no
127.0.0.1 ads.gameforgeads.de
127.0.0.1 ads.gamemarshal.com
127.0.0.1 ads.gamershell.com
127.0.0.1 ads.gamespy.com
127.0.0.1 ads.gamespyid.com
127.0.0.1 ads.gawker.com
127.0.0.1 ads.gettools.com
127.0.0.1 ads.globeandmail.com
127.0.0.1 ads.gotfrag.com
127.0.0.1 ads.grindinggears.com
127.0.0.1 ads.guardian.co.uk
127.0.0.1 ads.guardianunlimited.co.uk
127.0.0.1 ads.hbv.de
127.0.0.1 ads.heartlight.org
127.0.0.1 ads.hollywood.com
127.0.0.1 ads.humorbua.no
127.0.0.1 ads.iafrica.com
127.0.0.1 ads.iboost.com
127.0.0.1 ads.icq.com
127.0.0.1 ads.ign.com
127.0.0.1 ads.imdb.com
127.0.0.1 ads.img.co.za
127.0.0.1 ads.indya.com
127.0.0.1 ads.indystar.com
127.0.0.1 ads.inetfast.com
127.0.0.1 ads.inetinteractive.com
127.0.0.1 ads.infi.net
127.0.0.1 ads.infospace.com
127.0.0.1 ads.internic.co.il
127.0.0.1 ads.inthemix.com.au
127.0.0.1 ads.ipowerweb.com
127.0.0.1 ads.isoftmarketing.com
127.0.0.1 ads.itv.com
127.0.0.1 ads.iwon.com
127.0.0.1 ads.jimworld.com
127.0.0.1 ads.jpost.com
127.0.0.1 ads.jubii.dk
127.0.0.1 ads.katz.ws
127.0.0.1 ads.leo.org
127.0.0.1 ads.linuxquestions.org
127.0.0.1 ads.linuxsecurity.com
127.0.0.1 ads.lnkworld.com
127.0.0.1 ads.localnow.com
127.0.0.1 ads.lycos-europe.com
127.0.0.1 ads.lycos.com
127.0.0.1 ads.madison.com
127.0.0.1 ads.mariuana.it
127.0.0.1 ads.mcafee.com
127.0.0.1 ads.mediaodyssey.com
127.0.0.1 ads.mediaturf.net
127.0.0.1 ads.metropol.dk
127.0.0.1 ads.monster.com
127.0.0.1 ads.msn.com
127.0.0.1 ads.multimania.lycos.fr
127.0.0.1 ads.musiccity.com
127.0.0.1 ads.mysimon.com
127.0.0.1 ads.nandomedia.com
127.0.0.1 ads.nationalreview.com
127.0.0.1 ads.neoseeker.com
127.0.0.1 ads.netmechanic.com
127.0.0.1 ads.newcity.com
127.0.0.1 ads.newcitynet.com
127.0.0.1 ads.newdream.net
127.0.0.1 ads.newmedia.cz
127.0.0.1 ads.newsint.co.uk
127.0.0.1 ads.newsquest.co.uk
127.0.0.1 ads.newtimes.com
127.0.0.1 ads.ngenuity.com
127.0.0.1 ads.ninemsn.com.au
127.0.0.1 ads.nola.com
127.0.0.1 ads.nordichardware.se
127.0.0.1 ads.ntadvice.com
127.0.0.1 ads.nwsource.com
127.0.0.1 ads.nyi.net
127.0.0.1 ads.nyjournalnews.com
127.0.0.1 ads.nypost.com
127.0.0.1 ads.nytimes.com
127.0.0.1 ads.nzcity.co.nz
127.0.0.1 ads.ole.com
127.0.0.1 ads.oneplace.com
127.0.0.1 ads.onlineguiden.com
127.0.0.1 ads.optusnet.com.au
127.0.0.1 ads.orsm.net
127.0.0.1 ads.osdn.com
127.0.0.1 ads.osnews.com
127.0.0.1 ads.ourbrisbane.com
127.0.0.1 ads.peel.com
127.0.0.1 ads.phparena.net
127.0.0.1 ads.phpclasses.org
127.0.0.1 ads.pittsburghlive.com
127.0.0.1 ads.planet.nl
127.0.0.1 ads.pni.com
127.0.0.1 ads.powweb.com
127.0.0.1 ads.premium.cz
127.0.0.1 ads.premiumnetwork.com
127.0.0.1 ads.primeinteractive.net
127.0.0.1 ads.prisacom.com
127.0.0.1 ads.pro-market.net
127.0.0.1 ads.rackshack.net
127.0.0.1 ads.realcities.com
127.0.0.1 ads.realmedia.de
127.0.0.1 ads.recoletos.es
127.0.0.1 ads.rediff.com
127.0.0.1 ads.rottentomatoes.com
127.0.0.1 ads.rp-online.de
127.0.0.1 ads.satyamonline.com
127.0.0.1 ads.savannahnow.com
127.0.0.1 ads.scifi.com
127.0.0.1 ads.sexplanets.com
127.0.0.1 ads.sify.com
127.0.0.1 ads.simtel.net
127.0.0.1 ads.smartclick.com
127.0.0.1 ads.softwareoutfit.com
127.0.0.1 ads.space.com
127.0.0.1 ads.sptimes.com
127.0.0.1 ads.stationplay.com
127.0.0.1 ads.stileproject.com
127.0.0.1 ads.storagereview.net
127.0.0.1 ads.switchboard.com
127.0.0.1 ads.telegraaf.nl
127.0.0.1 ads.telegraph.co.uk
127.0.0.1 ads.theglobeandmail.com
127.0.0.1 ads.thestar.com
127.0.0.1 ads.thewebfreaks.com
127.0.0.1 ads.tiscali.fr
127.0.0.1 ads.tmcs.net
127.0.0.1 ads.top500.org
127.0.0.1 ads.townhall.com
127.0.0.1 ads.tripod.com
127.0.0.1 ads.tripod.lycos.co.uk
127.0.0.1 ads.tripod.lycos.de
127.0.0.1 ads.tripod.lycos.nl
127.0.0.1 ads.tucows.com
127.0.0.1 ads.unixathome.org
127.0.0.1 ads.urli.net
127.0.0.1 ads.usatoday.com
127.0.0.1 ads.v3exchange.com
127.0.0.1 ads.vesperexchange.com
127.0.0.1 ads.videoaxs.com
127.0.0.1 ads.virtualcountries.com
127.0.0.1 ads.vnuemedia.com
127.0.0.1 ads.wanadooregie.com
127.0.0.1 ads.weather.ca
127.0.0.1 ads.weather.com
127.0.0.1 ads.web.aol.com
127.0.0.1 ads.web.cs.com
127.0.0.1 ads.web.de
127.0.0.1 ads.web21.com
127.0.0.1 ads.webattack.com
127.0.0.1 ads.webheat.com
127.0.0.1 ads.webnet.advance.net
127.0.0.1 ads.whi.co.nz
127.0.0.1 ads.winsite.com
127.0.0.1 ads.wunderground.com
127.0.0.1 ads.x10.com
127.0.0.1 ads.x10.net
127.0.0.1 ads.xtra.co.nz
127.0.0.1 ads.yourfreedvds.com
127.0.0.1 ads.zdnet.com
127.0.0.1 ads001.webwombat.com.au
127.0.0.1 ads1.activeagent.at
127.0.0.1 ads1.advance.net
127.0.0.1 ads1.akkuna.com
127.0.0.1 ads1.canoe.ca
127.0.0.1 ads1.erotism.com
127.0.0.1 ads1.mediacapital.pt
127.0.0.1 ads1.sptimes.com
127.0.0.1 ads1.theglobeandmail.com
127.0.0.1 ads10.speedbit.com
127.0.0.1 ads2.advance.net
127.0.0.1 ads2.akkuna.com
127.0.0.1 ads2.clearchannel.com
127.0.0.1 ads2.collegclub.com
127.0.0.1 ads2.collegeclub.com
127.0.0.1 ads2.firingsquad.com
127.0.0.1 ads2.gamecity.net
127.0.0.1 ads2.jubii.dk
127.0.0.1 ads2.oneplace.com
127.0.0.1 ads2.osdn.com
127.0.0.1 ads2.pittsburghlive.com
127.0.0.1 ads2.top500.org
127.0.0.1 ads3.advance.net
127.0.0.1 ads3.gamecity.net
127.0.0.1 ads360.com
127.0.0.1 ads4.advance.net
127.0.0.1 ads4.clearchannel.com
127.0.0.1 ads4.gamecity.net
127.0.0.1 ads4.realcities.com
127.0.0.1 ads4homes.com
127.0.0.1 ads5.advance.net
127.0.0.1 ads5.canoe.ca
127.0.0.1 ads6.advance.net
127.0.0.1 ads6.gamecity.net
127.0.0.1 ads7.gamecity.net
127.0.0.1 ads8.com
127.0.0.1 adsag.com
127.0.0.1 Adsatt.ABCNews.starwave.com
127.0.0.1 adsatt.espn.starwave.com
127.0.0.1 Adsatt.go.starwave.com
127.0.0.1 adsdaq.com
127.0.0.1 adserv.geocomm.com
127.0.0.1 adserv.happypuppy.com
127.0.0.1 adserv.iafrica.com
127.0.0.1 adserv.lwmn.net
127.0.0.1 adserv.quality-channel.de
127.0.0.1 adserve.viaarena.com
127.0.0.1 adserver.71i.de
127.0.0.1 adserver.adultfriendfinder.com
127.0.0.1 adserver.anm.co.uk
127.0.0.1 adserver.billiger-surfen.de
127.0.0.1 adserver.billiger-telefonieren.de
127.0.0.1 adserver.bluewin.ch
127.0.0.1 adserver.colleges.com
127.0.0.1 adserver.com
127.0.0.1 adserver.developersnetwork.com
127.0.0.1 adserver.digitoday.com
127.0.0.1 adserver.dotcommedia.de
127.0.0.1 adserver.eudora.com
127.0.0.1 adserver.freecity.de
127.0.0.1 adserver.freenet.de
127.0.0.1 adserver.friendfinder.com
127.0.0.1 adserver.gamesquad.net
127.0.0.1 adserver.garden.com
127.0.0.1 adserver.gr
127.0.0.1 adserver.hardwareanalysis.com
127.0.0.1 adserver.hispavista.com
127.0.0.1 adserver.humanux.com
127.0.0.1 adserver.ign.com
127.0.0.1 adserver.janes.com
127.0.0.1 adserver.jolt.co.uk
127.0.0.1 adserver.journalinteractive.com
127.0.0.1 adserver.legacy-network.com
127.0.0.1 adserver.libero.it
127.0.0.1 adserver.m2kcore.com
127.0.0.1 adserver.monster.com
127.0.0.1 adserver.news.com.au
127.0.0.1 adserver.newtimes.com
127.0.0.1 adserver.ngz-network.de
127.0.0.1 adserver.nydailynews.com
127.0.0.1 adserver.nzoom.com
127.0.0.1 adserver.plhb.com
127.0.0.1 adserver.portalofevil.com
127.0.0.1 adserver.portugalmail.net
127.0.0.1 adserver.portugalmail.pt
127.0.0.1 adserver.ro
127.0.0.1 adserver.sanomawsoy.fi
127.0.0.1 adserver.securityfocus.com
127.0.0.1 adserver.sharewareonline.com
127.0.0.1 adserver.snowball.com
127.0.0.1 adserver.terra.es
127.0.0.1 adserver.theonering.net
127.0.0.1 adserver.track-star.com
127.0.0.1 adserver.trb.com
127.0.0.1 adserver.tribuneinteractive.com
127.0.0.1 adserver.ugo.com
127.0.0.1 adserver.usermagnet.com
127.0.0.1 adserver.virtuous.co.uk
127.0.0.1 adserver.yahoo.com
127.0.0.1 adserver1.backbeatmedia.com
127.0.0.1 adserver1.cdcovers.cc
127.0.0.1 adserver1.mediainsight.de
127.0.0.1 adserver1.ogilvy-interactive.de
127.0.0.1 adserver2.mediainsight.de
127.0.0.1 adserver2.popdata.de
127.0.0.1 adserver3.eudora.com
127.0.0.1 adserver4.eudora.com
127.0.0.1 adserversolutions.com
127.0.0.1 adservingcentral.com
127.0.0.1 adsfac.net
127.0.0.1 adsmart.co.uk
127.0.0.1 adsmart.net
127.0.0.1 adsmusic.com
127.0.0.1 adsnew.userfriendly.org
127.0.0.1 adsoftware.com
127.0.0.1 adsoldier.com
127.0.0.1 adsp.ilse.nl
127.0.0.1 adspace.ro
127.0.0.1 adsremote.scripps.com
127.0.0.1 adsrv.iol.co.za
127.0.0.1 adsweb.tiscali.cz
127.0.0.1 adsynergy.com
127.0.0.1 adsystem.tt-forums.net
127.0.0.1 adtech.de
127.0.0.1 adtrade.net
127.0.0.1 adtrading.de
127.0.0.1 adtrix.com
127.0.0.1 adv-banner.libero.it
127.0.0.1 adv.freeonline.it
127.0.0.1 adv.hwupgrade.it
127.0.0.1 adv.isdn.cz
127.0.0.1 adv.surinter.net
127.0.0.1 adv.webmd.com
127.0.0.1 adv.wp.pl
127.0.0.1 adv.yo.cz
127.0.0.1 adv1.videoprofessor.com
127.0.0.1 advariant.com
127.0.0.1 adventory.com
127.0.0.1 adverity.com
127.0.0.1 adverserve.net
127.0.0.1 advert.bayarea.com
127.0.0.1 advert.hi-media.com
127.0.0.1 adverticum.com
127.0.0.1 adverticum.net
127.0.0.1 advertising.com
127.0.0.1 advertising.se
127.0.0.1 advertisingbanners.com
127.0.0.1 advertmedia.de
127.0.0.1 advertpro.sitepoint.com
127.0.0.1 adverts.carltononline.com
127.0.0.1 advertserve.com
127.0.0.1 advertwizard.com
127.0.0.1 adview.ppro.de
127.0.0.1 adviva.net
127.0.0.1 advnt.com
127.0.0.1 advnt01.com
127.0.0.1 advnt02.com
127.0.0.1 advnt03.com
127.0.0.1 advnt04.com
127.0.0.1 adware.hu
127.0.0.1 adwealth.com
127.0.0.1 adweb.integctr.com
127.0.0.1 adworldnetwork.com
127.0.0.1 adworx.at
127.0.0.1 adx.allstar.cz
127.0.0.1 adx.arip.co.th
127.0.0.1 adx.atnext.com
127.0.0.1 adx.nu
127.0.0.1 ady.arip.co.th
127.0.0.1 adz.afterdawn.net
127.0.0.1 affiliate.1800flowers.com
127.0.0.1 affiliate.7host.com
127.0.0.1 affiliate.cfdebt.com
127.0.0.1 affiliate.doubleyourdating.com
127.0.0.1 affiliate.dtiserv.com
127.0.0.1 affiliate.gamestop.com
127.0.0.1 affiliate.grasscity.com
127.0.0.1 affiliate.travelnow.com
127.0.0.1 affiliate.viator.com
127.0.0.1 affiliates.allposters.com
127.0.0.1 affiliates.internationaljock.com
127.0.0.1 affiliatetracking.net
127.0.0.1 ah-ha.com
127.0.0.1 alladvantage.com
127.0.0.1 amedia.techies.com
127.0.0.1 app.lstdesign.com
127.0.0.1 arc1.msn.com
127.0.0.1 as.cmpnet.com
127.0.0.1 as.fotexnet.hu
127.0.0.1 as1.falkag.de
127.0.0.1 as2.falkag.de
127.0.0.1 as3.falkag.de
127.0.0.1 as4.falkag.de
127.0.0.1 as5000.com
127.0.0.1 asn.premium.cz
127.0.0.1 atdmt.com
127.0.0.1 atwola.com
127.0.0.1 audit.median.hu
127.0.0.1 audit.webinform.hu
127.0.0.1 autohits.dk
127.0.0.1 avenuea.com
127.0.0.1 awrz.net
127.0.0.1 azjmp.com
127.0.0.1 azoogleads.com
127.0.0.1 babs.tv2.dk
127.0.0.1 banerovec.cz
127.0.0.1 banex.cz
127.0.0.1 banik.redigy.cz
127.0.0.1 banman.cz
127.0.0.1 banner.ad.nu
127.0.0.1 banner.buempliz-online.ch
127.0.0.1 banner.casino.net
127.0.0.1 banner.coza.com
127.0.0.1 banner.cz
127.0.0.1 banner.easyspace.com
127.0.0.1 banner.elisa.net
127.0.0.1 banner.img.co.za
127.0.0.1 banner.inyourpocket.com
127.0.0.1 banner.jobsahead.com
127.0.0.1 banner.kiev.ua
127.0.0.1 banner.linux.se
127.0.0.1 banner.media-system.de
127.0.0.1 banner.mindshare.de
127.0.0.1 banner.nixnet.cz
127.0.0.1 banner.northsky.com
127.0.0.1 banner.orb.net
127.0.0.1 banner.penguin.cz
127.0.0.1 banner.relcom.ru
127.0.0.1 banner.rojakpot.com
127.0.0.1 banner.t-online.de
127.0.0.1 banner.tanto.de
127.0.0.1 banner.tpage.com
127.0.0.1 banner.webmersion.com
127.0.0.1 banner4all.dk
127.0.0.1 bannerads.de
127.0.0.1 bannerads.zwire.com
127.0.0.1 bannerbank.ru
127.0.0.1 bannerbox.hu
127.0.0.1 bannerboxes.com
127.0.0.1 bannercommunity.de
127.0.0.1 bannerexchange.cjb.net
127.0.0.1 bannerhost.com
127.0.0.1 bannerhosts.com
127.0.0.1 bannerimage.com
127.0.0.1 bannerlandia.com.ar
127.0.0.1 bannermarkt.nl
127.0.0.1 bannerpower.com
127.0.0.1 banners.adultfriendfinder.com
127.0.0.1 banners.amigos.com
127.0.0.1 banners.arachne.cz
127.0.0.1 banners.asiafriendfinder.com
127.0.0.1 banners.babylon-x.com
127.0.0.1 banners.babylonbucks.com
127.0.0.1 banners.bol.com.br
127.0.0.1 banners.clubseventeen.com
127.0.0.1 banners.czi.cz
127.0.0.1 banners.de.clara.net
127.0.0.1 banners.directnic.com
127.0.0.1 banners.dot.tk
127.0.0.1 banners.easydns.com
127.0.0.1 banners.freett.com
127.0.0.1 banners.friendfinder.com
127.0.0.1 banners.friendsfinder.com
127.0.0.1 banners.hetnet.nl
127.0.0.1 banners.internetsexprovider.com
127.0.0.1 banners.iq.pl
127.0.0.1 banners.isoftmarketing.com
127.0.0.1 banners.lifeserv.com
127.0.0.1 banners.netcraft.com
127.0.0.1 banners.resultonline.com
127.0.0.1 banners.tucson.com
127.0.0.1 banners.uk.clara.net
127.0.0.1 banners.wunderground.com
127.0.0.1 bannerserver.com
127.0.0.1 bannerserver.gator.com
127.0.0.1 bannersgomlm.com
127.0.0.1 bannersng.yell.com
127.0.0.1 bannerspace.com
127.0.0.1 bannerswap.com
127.0.0.1 bannertesting.com
127.0.0.1 bannieres.acces-contenu.com
127.0.0.1 bans.bride.ru
127.0.0.1 bansrv1.n1media.com
127.0.0.1 barnesandnoble.bfast.com
127.0.0.1 bbmedia.cz
127.0.0.1 bbn.img.com.ua
127.0.0.1 bestsearch.net
127.0.0.1 bidclix.net
127.0.0.1 bigads.guj.de
127.0.0.1 bigbangmedia.com
127.0.0.1 billboard.cz
127.0.0.1 bizban.net
127.0.0.1 blast4traffic.com
127.0.0.1 blogads.com
127.0.0.1 bluehavenmedia.com
127.0.0.1 bluestreak.com
127.0.0.1 bm.annonce.cz
127.0.0.1 bn.bfast.com
127.0.0.1 bpath.com
127.0.0.1 bravenet.com
127.0.0.1 british-banners.com
127.0.0.1 bs.yandex.ru
127.0.0.1 budsinc.com
127.0.0.1 burstnet.akadns.net
127.0.0.1 burstnet.com
127.0.0.1 businessfactory.prospero.com
127.0.0.1 c1.nowlinux.com
127.0.0.1 candidclicks.com
127.0.0.1 casalemedia.com
127.0.0.1 casalmedia.com
127.0.0.1 cash4banner.com
127.0.0.1 cash4banner.de
127.0.0.1 cash4popup.de
127.0.0.1 cashfiesta.com
127.0.0.1 cashpartner.com
127.0.0.1 cashpartner.net
127.0.0.1 casinogames.com
127.0.0.1 casinotraffic.com
127.0.0.1 casinotreasure.com
127.0.0.1 cben1.net
127.0.0.1 cbx.net
127.0.0.1 cdn2.adsdk.com
127.0.0.1 cgicounter.puretec.de
127.0.0.1 chart.dk
127.0.0.1 checkm8.com
127.0.0.1 chestionar.ro
127.0.0.1 ciaoclick.com
127.0.0.1 cibleclick.com
127.0.0.1 cityads.telus.net
127.0.0.1 cj.com
127.0.0.1 claria.com
127.0.0.1 click-fr.com
127.0.0.1 click.absoluteagency.com
127.0.0.1 click.fool.co.uk
127.0.0.1 click.fool.com
127.0.0.1 click.go2net.com
127.0.0.1 click2freemoney.com
127.0.0.1 clickability.com
127.0.0.1 clickagents.com
127.0.0.1 clickbank.com
127.0.0.1 clickbank.net
127.0.0.1 clickbroker.com
127.0.0.1 clickbrokers.com
127.0.0.1 clickedyclick.com
127.0.0.1 clickfinders.com
127.0.0.1 clickforwebmasters.com
127.0.0.1 clickhere.foronlinegames.com
127.0.0.1 clickhereforcellphones.com
127.0.0.1 clickhouse.com
127.0.0.1 clickhype.com
127.0.0.1 clickmedia.ro
127.0.0.1 clicks.equantum.com
127.0.0.1 clicks.stripsaver.com
127.0.0.1 clickserve.cc-dt.com
127.0.0.1 clicksor.com
127.0.0.1 clickthrutraffic.com
127.0.0.1 clicktracks.com
127.0.0.1 clicktrade.com
127.0.0.1 clickxchange.com
127.0.0.1 clickz.com
127.0.0.1 clictrafic.com
127.0.0.1 clients.tbo.com
127.0.0.1 clixgalore.com
127.0.0.1 cnt1.pocitadlo.cz
127.0.0.1 colonize.com
127.0.0.1 comclick.com
127.0.0.1 commission-junction.com
127.0.0.1 commissionmonster.com
127.0.0.1 commonname.com
127.0.0.1 compactbanner.com
127.0.0.1 cookies.cmpnet.com
127.0.0.1 cornflakes.pathfinder.com
127.0.0.1 counted.com
127.0.0.1 counter.bloke.com
127.0.0.1 counter.cnw.cz
127.0.0.1 counter.cz
127.0.0.1 counter.nowlinux.com
127.0.0.1 counter.times.lv
127.0.0.1 counter.webtrends.net
127.0.0.1 counter.yadro.ru
127.0.0.1 countercrazy.com
127.0.0.1 counters.honesty.com
127.0.0.1 counts.tucows.com
127.0.0.1 crazypopups.com
127.0.0.1 creative.whi.co.nz
127.0.0.1 creatives.as4x.tmcs.net
127.0.0.1 cserver.mii.instacontent.net
127.0.0.1 ctnetwork.hu
127.0.0.1 ctxtads.overture.com
127.0.0.1 custom-click.com
127.0.0.1 customad.cnn.com
127.0.0.1 cyberbounty.com
127.0.0.1 cybercount.com
127.0.0.1 cybereps.com
127.0.0.1 cybermonitor.com
127.0.0.1 cydoor.com
127.0.0.1 dbbsrv.com
127.0.0.1 dcad.tnn.net
127.0.0.1 dclk.net
127.0.0.1 dealhelper.com
127.0.0.1 desktop.kazaa.com
127.0.0.1 dgm2.com
127.0.0.1 dgmaustralia.com
127.0.0.1 dialerporn.com
127.0.0.1 didtheyreadit.com
127.0.0.1 digits.com
127.0.0.1 directleads.com
127.0.0.1 directtrack.com
127.0.0.1 discountclick.com
127.0.0.1 divicash.com
127.0.0.1 dnads.directnic.com
127.0.0.1 domainsponsor.com
127.0.0.1 doubleclick.com
127.0.0.1 doubleclick.de
127.0.0.1 doubleclick.net
127.0.0.1 e-bannerx.com
127.0.0.1 eads.com
127.0.0.1 ecoupons.com
127.0.0.1 elitetoplist.com
127.0.0.1 emarketer.com
127.0.0.1 emarketmakers.com
127.0.0.1 engage.everyone.net
127.0.0.1 engage.omaha.com
127.0.0.1 entercasino.com
127.0.0.1 erotic-ad.com
127.0.0.1 escati.linkopp.net
127.0.0.1 eshopads2.com
127.0.0.1 espotting.com
127.0.0.1 estats.com
127.0.0.1 eu-adcenter.net
127.0.0.1 euniverseads.com
127.0.0.1 euro4banner.com
127.0.0.1 europeanbanners.com
127.0.0.1 exchange-it.com
127.0.0.1 exchangead.com
127.0.0.1 exchangeclicksonline.com
127.0.0.1 exit76.com
127.0.0.1 exitexchange.com
127.0.0.1 exitfuel.com
127.0.0.1 extreme-dm.com
127.0.0.1 eyeblaster-bs.com
127.0.0.1 eyeblaster.com
127.0.0.1 falkag.net
127.0.0.1 fast-adv.it
127.0.0.1 fastclick.com
127.0.0.1 fastclick.com.edgesuite.net
127.0.0.1 fastclick.net
127.0.0.1 fastcounter.bcentral.com
127.0.0.1 feedbackresearch.com
127.0.0.1 findcommerce.com
127.0.0.1 findyourcasino.com
127.0.0.1 fineclicks.com
127.0.0.1 first.nova.cz
127.0.0.1 flowgo.com
127.0.0.1 fmads.osdn.com
127.0.0.1 focalex.com
127.0.0.1 foxcounter.com
127.0.0.1 fragmentserv.iac-online.de
127.0.0.1 free-banners.com
127.0.0.1 freebanner.com
127.0.0.1 freestats.com
127.0.0.1 freewebcounter.com
127.0.0.1 fuck-access.com
127.0.0.1 g-wizzads.net
127.0.0.1 galaxien.com
127.0.0.1 gamblingbanner.com
127.0.0.1 gator.com
127.0.0.1 gcads.osdn.com
127.0.0.1 gemius.pl
127.0.0.1 geoads.osdn.com
127.0.0.1 geocounter.net
127.0.0.1 globaltrack.com
127.0.0.1 goingplatinum.com
127.0.0.1 gold.weborama.fr
127.0.0.1 goldstats.com
127.0.0.1 googlesyndication.com
127.0.0.1 gorillanation.com
127.0.0.1 gostats.com
127.0.0.1 gp.dejanews.com
127.0.0.1 grafstat.ro
127.0.0.1 herbalaffiliateprogram.com
127.0.0.1 hightrafficads.com
127.0.0.1 hit.webcentre.lycos.co.uk
127.0.0.1 hitbox.com
127.0.0.1 hitcents.com
127.0.0.1 hitexchange.net
127.0.0.1 hitlist.ru
127.0.0.1 hitlounge.com
127.0.0.1 hitometer.com
127.0.0.1 hits4me.com
127.0.0.1 hitslink.com
127.0.0.1 hotlog.ru
127.0.0.1 hotrank.com.tw
127.0.0.1 hotstatistics.com
127.0.0.1 httpads.com
127.0.0.1 httpool.com
127.0.0.1 humanclick.com
127.0.0.1 hyperbanner.net
127.0.0.1 hypercount.com
127.0.0.1 i-clicks.net
127.0.0.1 i1img.com
127.0.0.1 iad.liveperson.net
127.0.0.1 iadnet.com
127.0.0.1 idot.cz
127.0.0.1 ilbanner.com
127.0.0.1 ilead.itrack.it
127.0.0.1 iliillliO00OO0.321.cn
127.0.0.1 image.ugo.com
127.0.0.1 imageads.canoe.ca
127.0.0.1 images.v3.com
127.0.0.1 imaginemedia.com
127.0.0.1 img.bannersxchange.com
127.0.0.1 imonitor.nethost.cz
127.0.0.1 imprese.cz
127.0.0.1 impressionz.co.uk
127.0.0.1 imrworldwide.com
127.0.0.1 inboxdollars.com
127.0.0.1 inc.com
127.0.0.1 inet-traffic.com
127.0.0.1 infinite-ads.com
127.0.0.1 information.com
127.0.0.1 insightexpress.com
127.0.0.1 instacontent.net
127.0.0.1 instantmadness.com
127.0.0.1 intelliads.com
127.0.0.1 internetfuel.com
127.0.0.1 interreklame.de
127.0.0.1 ip.ro
127.0.0.1 ireklama.cz
127.0.0.1 is.casalemedia.com
127.0.0.1 itfarm.com
127.0.0.1 itop.cz
127.0.0.1 iwin.com
127.0.0.1 jcount.com
127.0.0.1 jedonkey.cjt1.net
127.0.0.1 jinisearch.co.uk
127.0.0.1 jkazaa.cjt1.net
127.0.0.1 joetec.net
127.0.0.1 jokedollars.com
127.0.0.1 justwebads.com
127.0.0.1 kliks.nl
127.0.0.1 klipads.dvlabs.com
127.0.0.1 kliptracker.com
127.0.0.1 klix.cz
127.0.0.1 knownorigin.com
127.0.0.1 labeldaily.com
127.0.0.1 lbn.ru
127.0.0.1 leadingedgecash.com
127.0.0.1 lightspeedcash.com
127.0.0.1 link4ads.com
127.0.0.1 linkbuddies.com
127.0.0.1 linkexchange.com
127.0.0.1 linkexchange.ru
127.0.0.1 linkprice.com
127.0.0.1 linkreferral.com
127.0.0.1 linksponsor.com
127.0.0.1 linkswaper.com
127.0.0.1 linksynergy.com
127.0.0.1 liquidad.narrowcastmedia.com
127.0.0.1 lnads.osdn.com
127.0.0.1 log.btopenworld.com
127.0.0.1 log.go.com
127.0.0.1 logs.erasmas.com
127.0.0.1 look2me.com
127.0.0.1 lop.com
127.0.0.1 m.doubleclick.net
127.0.0.1 mads.gamespot.com
127.0.0.1 mainos2.mtv3.fi
127.0.0.1 marketbanker.com
127.0.0.1 marketing.nyi.com
127.0.0.1 marketing.nyi.net
127.0.0.1 masterbanners.com
127.0.0.1 masterstats.com
127.0.0.1 matchcraft.com
127.0.0.1 maximumcash.com
127.0.0.1 maxserving.com
127.0.0.1 mbuyu.nl
127.0.0.1 mdffa.com
127.0.0.1 media-adrunner.mycomputer.com
127.0.0.1 media.bigstep.com
127.0.0.1 media.ftv-publicite.fr
127.0.0.1 mediacharger.com
127.0.0.1 mediageneral.com
127.0.0.1 mediamgr.ugo.com
127.0.0.1 mediaplex.com
127.0.0.1 mediascale.de
127.0.0.1 megacash.de
127.0.0.1 megago.com
127.0.0.1 memorix.sdv.fr
127.0.0.1 metaad.econet.hu
127.0.0.1 metrics.webcriteria.net
127.0.0.1 microticker.com
127.0.0.1 mirror.qkimg.net
127.0.0.1 mjxads.internet.com
127.0.0.1 mkt.cz
127.0.0.1 monsterpops.com
127.0.0.1 mostcash.com
127.0.0.1 ms-links.com
127.0.0.1 msads.net
127.0.0.1 mtree.com
127.0.0.1 multi1.rmuk.co.uk
127.0.0.1 myaffiliateprogram.com
127.0.0.1 mytrix.com
127.0.0.1 navrcholu.cz
127.0.0.1 nedstat.com
127.0.0.1 nedstat.nl
127.0.0.1 nedstatbasic.net
127.0.0.1 netads.hotwired.com
127.0.0.1 netads.sohu.com
127.0.0.1 netdirect.nl
127.0.0.1 netdot.cz
127.0.0.1 netpool.netbookia.net
127.0.0.1 netvertising.be
127.0.0.1 network.realmedia.com
127.0.0.1 new-ads.eurogamer.net
127.0.0.1 newads.cmpnet.com
127.0.0.1 newtopsites.com
127.0.0.1 ng3.ads.warnerbros.com
127.0.0.1 ngadcenter.net
127.0.0.1 nitroclicks.com
127.0.0.1 nsads.hotwired.com
127.0.0.1 ntbanner.digitalriver.com
127.0.0.1 oas-central.realmedia.com
127.0.0.1 oas.benchmark.fr
127.0.0.1 oas.foxnews.com
127.0.0.1 oas.signonsandiego.com
127.0.0.1 oas.toronto.com
127.0.0.1 oas.uniontrib.com
127.0.0.1 oas.villagevoice.com
127.0.0.1 oascentral.chicagobusiness.com
127.0.0.1 oascentral.redherring.com
127.0.0.1 oascentral.theonion.com
127.0.0.1 oascentral.thesmokinggun.com
127.0.0.1 oasis.promon.cz
127.0.0.1 observer.cz
127.0.0.1 offeroptimizer.com
127.0.0.1 oneandonlynetwork.com
127.0.0.1 onestat.com
127.0.0.1 onresponse.com
127.0.0.1 openad.infobel.com
127.0.0.1 openad.travelnow.com
127.0.0.1 oxcash.com
127.0.0.1 p5.omaha.com
127.0.0.1 partner-ads.com
127.0.0.1 partner1.kanoodle.com
127.0.0.1 partner2profit.com
127.0.0.1 partnerkonto.de
127.0.0.1 partners.starnetsystems.net
127.0.0.1 paycounter.com
127.0.0.1 paypopup.com
127.0.0.1 payserve.com
127.0.0.1 pcwizz.com
127.0.0.1 pennyweb.com
127.0.0.1 phoenix-adrunner.mycomputer.com
127.0.0.1 phpads.astalavista.us
127.0.0.1 phpads.i-merge.net
127.0.0.1 pillscash.com
127.0.0.1 pimproll.com
127.0.0.1 play4traffic.com
127.0.0.1 pointroll.com
127.0.0.1 pops.freeze.com
127.0.0.1 popup.msn.com
127.0.0.1 popupad.net
127.0.0.1 popupmoney.com
127.0.0.1 popupnation.com
127.0.0.1 popups.infostart.com
127.0.0.1 popupsponsor.com
127.0.0.1 popuptraffic.com
127.0.0.1 porngraph.com
127.0.0.1 porntrack.com
127.0.0.1 postmasterbannernet.com
127.0.0.1 premium-offers.com
127.0.0.1 premiumcash.de
127.0.0.1 primaryads.com
127.0.0.1 primetime.net
127.0.0.1 pro-advertising.com
127.0.0.1 profero.com
127.0.0.1 promote.pair.com
127.0.0.1 provexia.com
127.0.0.1 psstt.com
127.0.0.1 pub-g.ifrance.com
127.0.0.1 pub.club-internet.fr
127.0.0.1 pub.hardware.fr
127.0.0.1 pub.realmedia.fr
127.0.0.1 publi.grupocorreo.es
127.0.0.1 publi1.grupocorreo.es
127.0.0.1 publi2.grupocorreo.es
127.0.0.1 publiads.com
127.0.0.1 publicidad.elmundo.es
127.0.0.1 publicidad.ya.com
127.0.0.1 publimedia.es.realmedia.com
127.0.0.1 pubs.branchez-vous.com
127.0.0.1 pubs.lemonde.fr
127.0.0.1 q.azcentral.com
127.0.0.1 qksrv.net
127.0.0.1 questaffiliates.net
127.0.0.1 quinst.com
127.0.0.1 r.hotwired.com
127.0.0.1 r.kde.cz
127.0.0.1 rad.msn.com
127.0.0.1 radiate.com
127.0.0.1 rampidads.com
127.0.0.1 rankyou.com
127.0.0.1 re.e-slovenija.com
127.0.0.1 realads.realmedia.com
127.0.0.1 realclix.com
127.0.0.1 realmedia-a800.d4p.net
127.0.0.1 realtracker.com
127.0.0.1 redsherriff.com
127.0.0.1 referralware.com
127.0.0.1 regnow.com
127.0.0.1 reklam.rfsl.se
127.0.0.1 reklama.internet.cz
127.0.0.1 reklama.pmatousek.com
127.0.0.1 reklama.reflektor.cz
127.0.0.1 relmaxtop.com
127.0.0.1 remotead.cnet.com
127.0.0.1 reply.mediatris.net
127.0.0.1 retaildirect.realmedia.com
127.0.0.1 revenue.net
127.0.0.1 richmails.com
127.0.0.1 richwebmaster.com
127.0.0.1 rightstats.com
127.0.0.1 rmads.msn.com
127.0.0.1 rmedia.boston.com
127.0.0.1 roar.com
127.0.0.1 roosevelt.gjbig.com
127.0.0.1 rose.ixbt.com
127.0.0.1 ru4.com
127.0.0.1 safe-audit.com
127.0.0.1 safelists.com
127.0.0.1 sageanalyst.net
127.0.0.1 sat-city-ads.com
127.0.0.1 searchramp.com
127.0.0.1 secure.webconnect.net
127.0.0.1 seeq.com
127.0.0.1 servethis.com
127.0.0.1 serving-sys.com
127.0.0.1 sexcounter.com
127.0.0.1 sexlist.com
127.0.0.1 sextracker.com
127.0.0.1 sfads.osdn.com
127.0.0.1 shareasale.com
127.0.0.1 sher.index.hu
127.0.0.1 shinystat.it
127.0.0.1 siccash.com
127.0.0.1 sitemeter.com
127.0.0.1 sma.punto.net
127.0.0.1 smartadserver.com
127.0.0.1 smartclicks.net
127.0.0.1 smartdirect.com
127.0.0.1 smartstats.com
127.0.0.1 smile.modchipstore.com
127.0.0.1 softadvertising.com
127.0.0.1 softclick.com.br
127.0.0.1 software.global-netcom.de
127.0.0.1 softwaresponsor.com
127.0.0.1 specificclick.com
127.0.0.1 specificpop.com
127.0.0.1 spezialreporte.de
127.0.0.1 spinbox.maccentral.com
127.0.0.1 spinbox.net
127.0.0.1 spinbox.techtracker.com
127.0.0.1 spinbox.versiontracker.com
127.0.0.1 sponsor4you.net
127.0.0.1 sponsoradulto.com
127.0.0.1 sprinks-clicks.about.com
127.0.0.1 spylog.com
127.0.0.1 spywarenuker.com
127.0.0.1 ssads.osdn.com
127.0.0.1 starffa.com
127.0.0.1 start.freeze.com
127.0.0.1 stat.doxod.net
127.0.0.1 stat.webmedia.pl
127.0.0.1 stat.zenon.net
127.0.0.1 statcounter.com
127.0.0.1 static.itrack.it
127.0.0.1 static.smni.com
127.0.0.1 staticads.btopenworld.com
127.0.0.1 stats.blogger.com
127.0.0.1 stats.cts-bv.nl
127.0.0.1 stats.darkbluesea.com
127.0.0.1 stats.klsoft.com
127.0.0.1 stats4all.com
127.0.0.1 sugoicounter.com
127.0.0.1 superclix.de
127.0.0.1 superstats.com
127.0.0.1 supertop.ru
127.0.0.1 synergiinteractive.com
127.0.0.1 targetnet.com
127.0.0.1 targetshop.com
127.0.0.1 teknosurf2.com
127.0.0.1 teknosurf3.com
127.0.0.1 test.com
127.0.0.1 textads.biz
127.0.0.1 textlinks.com
127.0.0.1 tfag.de
127.0.0.1 the-counter.net
127.0.0.1 theanswerto.com
127.0.0.1 thebannerguru.com
127.0.0.1 thecounter.com
127.0.0.1 thevictorynetwork.com
127.0.0.1 thisbanner.com
127.0.0.1 thruport.com
127.0.0.1 tinybar.com
127.0.0.1 tmsads.tribune.com
127.0.0.1 toads.osdn.com
127.0.0.1 toolbar.netscape.com
127.0.0.1 top.list.ru
127.0.0.1 top100-images.rambler.ru
127.0.0.1 top20.com
127.0.0.1 topbarh.box.sk
127.0.0.1 toplist.cz
127.0.0.1 topofferz.net
127.0.0.1 topprofits.info
127.0.0.1 topsearcher.com
127.0.0.1 topstats.com
127.0.0.1 topstats.net
127.0.0.1 tracking.frantic.com
127.0.0.1 tracking101.com
127.0.0.1 trackmysales.com
127.0.0.1 tradedoubler.com
127.0.0.1 traffic-exchange.com
127.0.0.1 trafficdiscount.com
127.0.0.1 trafficmp.com
127.0.0.1 trafficswarm.com
127.0.0.1 trafficsyndicate.com
127.0.0.1 traffictrader.net
127.0.0.1 trafic.ro
127.0.0.1 trakkerd.net
127.0.0.1 trekblue.com
127.0.0.1 trekdata.com
127.0.0.1 tribalfusion.com
127.0.0.1 trix.net
127.0.0.1 truehits.net
127.0.0.1 truehits1.gits.net.th
127.0.0.1 truehits2.gits.net.th
127.0.0.1 tsms-ad.tsms.com
127.0.0.1 ukaffiliates2.com
127.0.0.1 ukbanners.com
127.0.0.1 usapromotravel.com
127.0.0.1 usmsad.tom.com
127.0.0.1 utarget.co.uk
127.0.0.1 utils.mediageneral.net
127.0.0.1 valuead.com
127.0.0.1 valueclick.com
127.0.0.1 valuecommerce.com
127.0.0.1 valuesponsor.com
127.0.0.1 vericlick.com
127.0.0.1 vg.ad.asap-asp.net
127.0.0.1 vibrantmedia.com
127.0.0.1 viewpoint.com
127.0.0.1 vortextraffic.com
127.0.0.1 vx2.cc
127.0.0.1 w3exit.com
127.0.0.1 web-stat.com
127.0.0.1 web2.deja.com
127.0.0.1 webads.bizservers.com
127.0.0.1 webads.co.nz
127.0.0.1 webads.nl
127.0.0.1 webcash.nl
127.0.0.1 webcounter.goweb.de
127.0.0.1 webmasterplan.com
127.0.0.1 webpdp.gator.com
127.0.0.1 webpower.com
127.0.0.1 websponsors.com
127.0.0.1 webstars2000.com
127.0.0.1 webstat.com
127.0.0.1 webstat.net
127.0.0.1 webtraxx.de
127.0.0.1 webtrendslive.com
127.0.0.1 wegcash.com
127.0.0.1 whenu.com
127.0.0.1 whispa.com
127.0.0.1 wipub.com
127.0.0.1 worldbe.com
127.0.0.1 wtlive.com
127.0.0.1 wustat.windows.com
127.0.0.1 http://www.adsxchange.lv
127.0.0.1 http://www.banner-link.com.br
127.0.0.1 http://www.dnps.com
127.0.0.1 http://www.kaplanindex.com
127.0.0.1 http://www.money4exit.de
127.0.0.1 http://www.photo-ads.co.uk
127.0.0.1 http://www.sponsor2002.de
127.0.0.1 x.mycity.com
127.0.0.1 xiti.com
127.0.0.1 xq1.net
127.0.0.1 xtrocash.org
127.0.0.1 xxxcounter.com
127.0.0.1 xxxtoolbar.com
127.0.0.1 xzoomy.com
127.0.0.1 y.ibsys.com
127.0.0.1 yesadvertising.com
127.0.0.1 youclick2earn.com
127.0.0.1 z.times.lv
127.0.0.1 zanox-affiliate.de
127.0.0.1 zanox.com
127.0.0.1 zedo.com
127.0.0.1 zencudo.co.uk
127.0.0.1 zi.r.tv.com
127.0.0.1 zmedia.com
127.0.0.1 sbx.pagesjaunes.fr
127.0.0.1 ad.adriver.ru
127.0.0.1 ad.itmedia.co.jp
127.0.0.1 ads.collegemix.com
127.0.0.1 ads.specificpop.com
127.0.0.1 partner.topcities.com
127.0.0.1 ad.adver.com.tw
127.0.0.1 ad.ae.doubleclick.net
127.0.0.1 ad.au.doubleclick.net
127.0.0.1 ad.ad.ad.bulla.com
127.0.0.1 ad.ca.doubleclick.net
127.0.0.1 ad.clok.creative.com
127.0.0.1 ad.de.doubleclick.net
127.0.0.1 ad.distrigame.com
127.0.0.1 ad.doubleclick.net
127.0.0.1 ad.erasercash.com
127.0.0.1 ad.es.doubleclick.net
127.0.0.1 ad.fi.doubleclick.net
127.0.0.1 ad.fr.doubleclick.net
127.0.0.1 ad.freefind.com
127.0.0.1 Ad.go.com
127.0.0.1 ad.hotlog.ru
127.0.0.1 ad.jp.doubleclick.net
127.0.0.1 ad.kr.doubleclick.net
127.0.0.1 ad.linkexchange.com
127.0.0.1 ad.linksynergy.com
127.0.0.1 ad.naked-celebs.com
127.0.0.1 ad.nl.doubleclick.net
127.0.0.1 ad.no.doubleclick.net
127.0.0.1 ad.nobreak.com
127.0.0.1 ad.nz.doubleclick.net
127.0.0.1 ad.point.sk
127.0.0.1 ad.pt.doubleclick.net
127.0.0.1 ad.realmedia.co.kr
127.0.0.1 ad.se.doubleclick.net
127.0.0.1 ad.searchsquire.com
127.0.0.1 ad.shinbiro.com
127.0.0.1 ad.sma.punto.net
127.0.0.1 ad.trafficmp.com
127.0.0.1 ad.tw.doubleclick.net
127.0.0.1 ad.uk.doubleclick.net
127.0.0.1 ad.us.doubleclick.net
127.0.0.1 ad.valuehost.ru
127.0.0.1 ad0.haynet.com
127.0.0.1 ad1.adsolution.de
127.0.0.1 ad1.pamedia.com.au
127.0.0.1 ad1.peel.com
127.0.0.1 ad2.doubleclick.net
127.0.0.1 ad3.peel.com
127.0.0.1 ad4.lbn.ru
127.0.0.1 ad5.adrevolver.com
127.0.0.1 adadmin.internetfuel.com
127.0.0.1 adatom.com
127.0.0.1 adbest.com
127.0.0.1 ad-blaster.com
127.0.0.1 adblaster2.info
127.0.0.1 adcenter.in2.com
127.0.0.1 adclst03.valueclick.com
127.0.0.1 adcluster.humaniq.com
127.0.0.1 adcounter.theglobeandmail.com
127.0.0.1 adcycle.isoftmarketing.com
127.0.0.1 addeliver.net
127.0.0.1 addev.internetfuel.com
127.0.0.1 address.3721.com
127.0.0.1 adfarm.snv.mediaplex.com
127.0.0.1 AD-MAN.NODES.net.ad-flow.com
127.0.0.1 admaster.candela.com.au
127.0.0.1 admin.abcsearch.com
127.0.0.1 admin.exitfuel.com
127.0.0.1 admin.internetfuel.com
127.0.0.1 admin.popupsponsor.com
127.0.0.1 admin.startsurfing.com
127.0.0.1 adnetintads.valuead.com
127.0.0.1 adopt.hotbar.com
127.0.0.1 adp.ikena.com
127.0.0.1 adrates.theglobeandmail.com
127.0.0.1 adremote.timeinc.net
127.0.0.1 adrunner.mycomputer.com
127.0.0.1 ads.180solutions.com
127.0.0.1 ads.1stblaze.com
127.0.0.1 ads.adcorps.com
127.0.0.1 ads.addynamix.com
127.0.0.1 ads.ad-flow.com
127.0.0.1 ads.adfuzz.com
127.0.0.1 ads.admaximize.com
127.0.0.1 ads.adorigin.com
127.0.0.1 ads.adpowerzone.com
127.0.0.1 ads.adroar.com
127.0.0.1 ads.ads360.com
127.0.0.1 ads.adsag.com
127.0.0.1 ads.advertise.net
127.0.0.1 ads.asexstories.com
127.0.0.1 ads.bluemongoose.com
127.0.0.1 ads.bmais.net
127.0.0.1 ads.ads.businessweek.com
127.0.0.1 ads.cars.com
127.0.0.1 ads.cc-dt.com
127.0.0.1 ads.chickclick.com
127.0.0.1 ads.clickagents.com
127.0.0.1 ads.clickthru.net
127.0.0.1 ads.console.net
127.0.0.1 ads.crosswinds.net
127.0.0.1 ads.danni.com
127.0.0.1 ads.downloadaccelerator.com
127.0.0.1 ads.expedia.com
127.0.0.1 ads.ezcybersearch.com
127.0.0.1 ads.flightsim.com
127.0.0.1 ads.fp.sandpiper.net
127.0.0.1 ads.free-banners.com
127.0.0.1 ads.freevisits.com
127.0.0.1 ads.greensboro.com
127.0.0.1 ads.hitcents.com
127.0.0.1 ads.home.net
127.0.0.1 ads.hyperbanner.net
127.0.0.1 ads.inet1.com
127.0.0.1 ads.intelihealth.com
127.0.0.1 ads.intermezzia.com
127.0.0.1 ads.internet-optimizer.com
127.0.0.1 ads.mamma.com
127.0.0.1 ads.mircx.com
127.0.0.1 ads.mm.ap.org
127.0.0.1 ads.monstermoving.com
127.0.0.1 ads.netsol.com
127.0.0.1 ads.newline.aol.com
127.0.0.1 ads.odigo.com
127.0.0.1 ads.ads.onwebmedia.com
127.0.0.1 ads.pennyweb.com
127.0.0.1 ads.photosight.ru
127.0.0.1 ads.pilotonline.com
127.0.0.1 ads.popupsponsor.com
127.0.0.1 ads.purefuck.com
127.0.0.1 ads.roanoke.com
127.0.0.1 ads.searchseekfind.com
127.0.0.1 ads.seattletimes.com
127.0.0.1 ads.sexspaces.com
127.0.0.1 ads.sitemeter.com
127.0.0.1 ads.spaceports.com
127.0.0.1 ads.specificclick.com
127.0.0.1 ads.stockbanners.com
127.0.0.1 ads.techtv.com
127.0.0.1 ads.track-star.com
127.0.0.1 ads.ucomics.com
127.0.0.1 ads.unlimitedbanners.com
127.0.0.1 ads.v3.com
127.0.0.1 ads.valuead.com
127.0.0.1 ads.webads360.com
127.0.0.1 ads.webshots.com
127.0.0.1 ads.websponsors.com
127.0.0.1 ads.xbiz.com
127.0.0.1 ads.zedo.com
127.0.0.1 ads05.bpath.com
127.0.0.1 ads06.bpath.com
127.0.0.1 ads07.bpath.com
127.0.0.1 ads08.bpath.com
127.0.0.1 ads09.bpath.com
127.0.0.1 ads1.tripod.com
127.0.0.1 ads1.updated.com
127.0.0.1 ads1.zdnet.com
127.0.0.1 ads10.bpath.com
127.0.0.1 ads10.hyperbanner.net
127.0.0.1 ads11.hyperbanner.net
127.0.0.1 ads12.bpath.com
127.0.0.1 ads12.hyperbanner.net
127.0.0.1 ads13.bpath.com
127.0.0.1 ads13.hyperbanner.net
127.0.0.1 ads14.bpath.com
127.0.0.1 ads14.hyperbanner.net
127.0.0.1 ads15.bpath.com
127.0.0.1 ads15.hyperbanner.net
127.0.0.1 ads16.bpath.com
127.0.0.1 ads16.hyperbanner.net
127.0.0.1 ads17.bpath.com
127.0.0.1 ads17.hyperbanner.net
127.0.0.1 ads18.bpath.com
127.0.0.1 ads18.hyperbanner.net
127.0.0.1 ads19.bpath.com
127.0.0.1 ads19.hyperbanner.net
127.0.0.1 ads2.callwave.com
127.0.0.1 ads2.gotpb.com
127.0.0.1 ads2.playnet.com
127.0.0.1 ads2.speedbit.com
127.0.0.1 ads20.bpath.com
127.0.0.1 ads20.hyperbanner.net
127.0.0.1 ads21.bpath.com
127.0.0.1 ads22.bpath.com
127.0.0.1 ads23.bpath.com
127.0.0.1 ads24.bpath.com
127.0.0.1 ads25.bpath.com
127.0.0.1 ads26.bpath.com
127.0.0.1 ads27.bpath.com
127.0.0.1 ads28.bpath.com
127.0.0.1 ads29.bpath.com
127.0.0.1 ads3.speedbit.com
127.0.0.1 ads3.wunderground.com
127.0.0.1 ads4.speedbit.com
127.0.0.1 ads5.peel.com
127.0.0.1 ads7.inet1.com
127.0.0.1 ads7.speedbit.com
127.0.0.1 ads8.speedbit.com
127.0.0.1 ads9.speedbit.com
127.0.0.1 adscholar.com
127.0.0.1 adscpm.com
127.0.0.1 adserv.adbonus.com
127.0.0.1 adserv.bigwebtools.com
127.0.0.1 adserv.exxxit.com
127.0.0.1 adserv.internetfuel.com
127.0.0.1 adserv.net
127.0.0.1 adserv.search-exe.com
127.0.0.1 adserv1.internetfuel.com
127.0.0.1 adserv2.bigwebtools.com
127.0.0.1 adserv2.internetfuel.com
127.0.0.1 adserv3.internetfuel.com
127.0.0.1 adserv4.internetfuel.com
127.0.0.1 adserv5.internetfuel.com
127.0.0.1 adserv6.internetfuel.com
127.0.0.1 adserve.advertising.com
127.0.0.1 adserve.bess.net
127.0.0.1 adserver.100free.com
127.0.0.1 adserver.ads360.com
127.0.0.1 adserver.adtech.de
127.0.0.1 adserver.chickclick.com
127.0.0.1 adserver.creative-asia.com
127.0.0.1 adserver.gorillanation.com
127.0.0.1 adserver.adserver.monster.com
127.0.0.1 adserver.sextracker.com
127.0.0.1 adserver1.realtracker.com
127.0.0.1 adserver2.realtracker.com
127.0.0.1 adservice.recon-networks.com
127.0.0.1 adserving.autotrader.com
127.0.0.1 adsrvr.com
127.0.0.1 adtactics.com
127.0.0.1 adtag.sympatico.ca
127.0.0.1 adtegrity.com
127.0.0.1 adtegrity.adtracker.411web.com
127.0.0.1 adtrak.net
127.0.0.1 banner.50megs.com
127.0.0.1 banner.avp2000.com
127.0.0.1 banner.date.com
127.0.0.1 banner.freeservers.com
127.0.0.1 banner.missingkids.com
127.0.0.1 banner.rootsweb.com
127.0.0.1 banner1.inet-traffic.com
127.0.0.1 bannerco-op.com
127.0.0.1 banner-exchange.directbanners.com
127.0.0.1 bannerfarm.ace.advertising.com
127.0.0.1 banner-farm.de
127.0.0.1 banner-net.com
127.0.0.1 banners.ads360.com
127.0.0.1 banners.affiliatefuel.com
127.0.0.1 banners.dealcatcher.com
127.0.0.1 banners.hotlinks.net
127.0.0.1 banners.hotqueens.com
127.0.0.1 banners.kanoodle.com
127.0.0.1 banners.largecash.com
127.0.0.1 banners.ols2000.com
127.0.0.1 banners.orbitcycle.com
127.0.0.1 banners.outster.com
127.0.0.1 banners.pennyweb.com
127.0.0.1 banners.playboystore.com
127.0.0.1 banners.pythonvideo.com
127.0.0.1 banners.sextracker.com
127.0.0.1 banners.specificpop.com
127.0.0.1 banners.truecash.com
127.0.0.1 banners.valuead.com
127.0.0.1 banners.webmasterplan.com
127.0.0.1 banners2.pythonvideo.com
127.0.0.1 bannersgomlm.buildreferrals.com
127.0.0.1 bannersxchange.com
127.0.0.1 bannervip.web1000.com
127.0.0.1 bannerx.adtactics.com
127.0.0.1 gd10.doubleclick.net
127.0.0.1 gd11.doubleclick.net
127.0.0.1 gd12.doubleclick.net
127.0.0.1 gd13.doubleclick.net
127.0.0.1 gd14.doubleclick.net
127.0.0.1 gd15.doubleclick.net
127.0.0.1 gd16.doubleclick.net
127.0.0.1 gd20.doubleclick.net
127.0.0.1 gd25.doubleclick.net
127.0.0.1 gd28.doubleclick.net
127.0.0.1 gd29.doubleclick.net
127.0.0.1 gd30.doubleclick.net
127.0.0.1 gd31.doubleclick.net
127.0.0.1 gd5.doubleclick.net
127.0.0.1 gd6.doubleclick.net
127.0.0.1 gd7.doubleclick.net
127.0.0.1 gd8.doubleclick.net
127.0.0.1 gd9.doubleclick.net
127.0.0.1 media.media.popunder.com
127.0.0.1 media.popuptraffic.com
127.0.0.1 media.superstats.com
127.0.0.1 48.fes.linknclick.com
127.0.0.1 ad.ad.bannernetwork.it
127.0.0.1 ad.betanews.com
127.0.0.1 ad.comedie.lbn.fr
127.0.0.1 ad.es.chilinext.com
127.0.0.1 ad.family.go.com
127.0.0.1 ad.it.chilinext.com
127.0.0.1 ad.novasol.com
127.0.0.1 ad.recursosgratis.com
127.0.0.1 ad.treiber.de
127.0.0.1 ad0.gamesweb.com
127.0.0.1 ad1.radioreti.it
127.0.0.1 ad1.targetgraph.com
127.0.0.1 ad2.billboard.sk
127.0.0.1 ad2.targetgraph.com
127.0.0.1 ad3.sina.com.cn
127.0.0.1 ad4.sina.com.cn
127.0.0.1 ad7.ad7.netian.com
127.0.0.1 adbot.de
127.0.0.1 adclub.de
127.0.0.1 adcycle.standard.net
127.0.0.1 adflow.orbitcycle.com
127.0.0.1 adman.medius.net
127.0.0.1 admanager.sportal.net
127.0.0.1 adnet.imgserv.com
127.0.0.1 adrunner.superstats.com
127.0.0.1 ads.118.lv
127.0.0.1 ads.2xmoinscher.com
127.0.0.1 ads.active.com
127.0.0.1 ads.apollo.lv
127.0.0.1 ads.assobanner.it
127.0.0.1 ads.audiencebank.com
127.0.0.1 ads.autotrader.co.uk
127.0.0.1 ads.britishexpats.com
127.0.0.1 ads.buysell.com
127.0.0.1 ads.calexo.com
127.0.0.1 ads.camrecord.com
127.0.0.1 ads.cdmediaworld.com
127.0.0.1 ads.cgi.enthusiastonline.com
127.0.0.1 ads.clicks.net
127.0.0.1 ads.clubphoto.com
127.0.0.1 ads.cndb.com
127.0.0.1 ads.communitech.net
127.0.0.1 ads.computer.org
127.0.0.1 ads.consolemul.com
127.0.0.1 ads.corky.net
127.0.0.1 ads.date.com
127.0.0.1 ads.denverbroncos.com
127.0.0.1 ads.dk.danban.com
127.0.0.1 ads.educationworld.com
127.0.0.1 ads.fish4.co.uk
127.0.0.1 ads.ftd.de
127.0.0.1 ads.gateway.com
127.0.0.1 ads.goantiques.com
127.0.0.1 ads.granadamedia.com
127.0.0.1 ads.greenvilleonline.com
127.0.0.1 ads.hecklers.org
127.0.0.1 ads.herplanet.com
127.0.0.1 ads.interactivetools.com
127.0.0.1 ads.killerapp.com
127.0.0.1 ads.lycos.fr
127.0.0.1 ads.mayoclinic.com
127.0.0.1 ads.metromanager.com
127.0.0.1 ads.mp3mediaworld.com
127.0.0.1 ads.mustangworks.com
127.0.0.1 ads.newsland.it
127.0.0.1 ads.nit.firstream.net
127.0.0.1 ads.norindex.no
127.0.0.1 ads.northjersey.com
127.0.0.1 ads.ocean12tech.com
127.0.0.1 ads.ontheweb.com
127.0.0.1 ads.pennnet.com
127.0.0.1 ads.pno.net
127.0.0.1 ads.pojonews.com
127.0.0.1 ads.rmbclick.com
127.0.0.1 ads.salary.com
127.0.0.1 ads.showbizz.net
127.0.0.1 ads.sina.com.tw
127.0.0.1 ads.spystocks.com
127.0.0.1 ads.stupid.com
127.0.0.1 ads.thebubbler.com
127.0.0.1 ads.thebugs.ws
127.0.0.1 ads.theithacajournal.com
127.0.0.1 ads.totallyfreestuff.com
127.0.0.1 ads.upa.com.br
127.0.0.1 ads.vcix.com
127.0.0.1 ads.vegas.com
127.0.0.1 ads.wiredkingdom.com
127.0.0.1 ads.wnd.com
127.0.0.1 ads.worldemail.com
127.0.0.1 ads1.spiderware.com
127.0.0.1 ads1.ucomics.com
127.0.0.1 ads3.ucomics.com
127.0.0.1 ads5.gamecity.org
127.0.0.1 adserv.arrow.com
127.0.0.1 adserv.gamezone.de
127.0.0.1 adserv.usps.com
127.0.0.1 adserver-espnet.sportszone.net
127.0.0.1 adserver.2618.com
127.0.0.1 adserver.advertist.com
127.0.0.1 adserver.artempireindustries.com
127.0.0.1 adserver.atari.net
127.0.0.1 adserver.click4cash.de
127.0.0.1 adserver.directforce.com
127.0.0.1 adserver.emulation64.com
127.0.0.1 adserver.gameparty.net
127.0.0.1 adserver.hg-computer.de
127.0.0.1 adserver.ixm.co.uk
127.0.0.1 adserver.lanacion.com.ar
127.0.0.1 adserver.lostreality.com
127.0.0.1 adserver.smashtv.com
127.0.0.1 adserver.telalink.net
127.0.0.1 adserver.thirty4.com
127.0.0.1 adserver.virgin.net
127.0.0.1 adsrv.heraldtribune.com
127.0.0.1 adsrv2.wilmingtonstar.com
127.0.0.1 adtraq.com
127.0.0.1 adv.247realmedia.com
127.0.0.1 adv.easyurl.org
127.0.0.1 advert.cdmediaworld.com
127.0.0.1 advert.trainingtools.com
127.0.0.1 advert.webdifusao-server.com
127.0.0.1 advertiser.co.il
127.0.0.1 advertising.christiansunite.com
127.0.0.1 advertising.hiasys.com
127.0.0.1 ad.bol.bg
127.0.0.1 ad.fulano.com.br
127.0.0.1 ad.orbitel.bg
127.0.0.1 ad1.ixo.com
127.0.0.1 adclient.detelefoongids.nl
127.0.0.1 ads.dir.bg
127.0.0.1 ads.somethingawful.com
127.0.0.1 ads.webnetad.com
127.0.0.1 adsnew.userfriendly.com
127.0.0.1 adv2.absoluteagency.com
127.0.0.1 ehg-bestbuy.hitbox.com
127.0.0.1 sfnstatic.smni.com
127.0.0.1 usatravelpro.com
127.0.0.1 adv.realmedia.com
127.0.0.1 dcstest.wtlive.com
127.0.0.1 banners.ksl.com
127.0.0.1 image.imgfarm.com
127.0.0.1 cache.megabyte.crosswinds.net
127.0.0.1 ad0.doubleclick.be
127.0.0.1 mobileproxy-vip.us.doubleclick.net
127.0.0.1 http://www.ad0.doubleclick.be
127.0.0.1 banner.bpaserver.net
127.0.0.1 banner.i-3.de
127.0.0.1 banner2tausch.de
127.0.0.1 bannerads.anytimenews.com
127.0.0.1 bannerexchange4free.de
127.0.0.1 banners.buscarsexo.com
127.0.0.1 banners.cj.com
127.0.0.1 banners.moviegoods.com
127.0.0.1 banners.winfire.com
127.0.0.1 ad.deremate.com
127.0.0.1 ad.shop.tbn.ru
127.0.0.1 ad.webm.tbn.ru
127.0.0.1 ad.webm120.tbn.ru
127.0.0.1 ad1.primorye.ru
127.0.0.1 ad3.allbanners.ru
127.0.0.1 ad5.peel.com
127.0.0.1 adclick.ru
127.0.0.1 addserver.payback.pl
127.0.0.1 ads-dk.spray.net
127.0.0.1 ads-it.spray.net
127.0.0.1 ads-nl.spray.net
127.0.0.1 ads-se.spray.net
127.0.0.1 ads-uk.spray.net
127.0.0.1 ads.berrynet.com
127.0.0.1 ads.flashtrack.net
127.0.0.1 ads.lycos.spray.net
127.0.0.1 ads.mouseplanet.com
127.0.0.1 ads.netfire.com
127.0.0.1 ads.orbitz.com
127.0.0.1 adserver.softonic.com
127.0.0.1 adv.aport.ru
127.0.0.1 adv.hardwarez.ru
127.0.0.1 banner.oddcast.com
127.0.0.1 banner.svitonline.com
127.0.0.1 ad.163.com
127.0.0.1 ad.bb.ru
127.0.0.1 ad.east.net.cn
127.0.0.1 ad.ero.ru
127.0.0.1 ad.horvitznewspapers.net
127.0.0.1 ad2.asit.de
127.0.0.1 ad4.enet.com.cn
127.0.0.1 ad4.peel.com
127.0.0.1 ads-direct.prodigy.net
127.0.0.1 ads.adprofs.com
127.0.0.1 ads.asap-asp.net
127.0.0.1 ads.filads.intermezzia.com
127.0.0.1 ads.mediacapital.pt
127.0.0.1 ads.mweb.co.th
127.0.0.1 ads.planetactive.com
127.0.0.1 adserver.phillyburbs.com
127.0.0.1 adserver.prodigy.net
127.0.0.1 adserver.synergetic.de
127.0.0.1 ad.120.tbn.ru
127.0.0.1 ad.clickhere.ru
127.0.0.1 ad.fr.ulimit.com
127.0.0.1 ad.jp.ap.valuecommerce.com
127.0.0.1 ad.lbb.org
127.0.0.1 ad.lbn.ru
127.0.0.1 ad.network60.com
127.0.0.1 ad.nifty.com
127.0.0.1 ad.pointer.ru
127.0.0.1 ad.pro-advertising.com
127.0.0.1 ad.pupsik.ru
127.0.0.1 ad.showbizz.net
127.0.0.1 ad.strict.tbn.ru
127.0.0.1 ad.text.tbn.ru
127.0.0.1 ad.trafficgate.net
127.0.0.1 ad2.allbanners.ru
127.0.0.1 ad4.ad4.bb.ru
127.0.0.1 adm1.admarketplace.co.jp
127.0.0.1 ads-fr.spray.net
127.0.0.1 ads-no.spray.net
127.0.0.1 ads.100megswebhosting.com
127.0.0.1 ads.analitica.com
127.0.0.1 ads.applelinks.com
127.0.0.1 ads.aspectgroup.co.uk
127.0.0.1 ads.baazee.com
127.0.0.1 ads.chumcity.com
127.0.0.1 ads.dada.it
127.0.0.1 ads.doktoronline.no
127.0.0.1 ads.epatra.com
127.0.0.1 ads.fortunecity.co.uk
127.0.0.1 ads.globo.com
127.0.0.1 ads.hardwarezone.com
127.0.0.1 ads.hi-ho.ne.jp
127.0.0.1 ads.indiainfo.com
127.0.0.1 ads.infonet-thueringen.de
127.0.0.1 ads.justscored.co.uk
127.0.0.1 ads.mandrakesoft.com
127.0.0.1 ads.marketing-internet.com
127.0.0.1 ads.mdchoice.com
127.0.0.1 ads.mh5.com
127.0.0.1 ads.msn.co.il
127.0.0.1 ads.music-sites.net
127.0.0.1 ads.southbendtribune.com
127.0.0.1 ads.x.techno.net
127.0.0.1 adserver.co.il
127.0.0.1 adserver.virtualminds.nl
127.0.0.1 adserver.ya.com
127.0.0.1 adsweb.tiscali.de
127.0.0.1 adsweb.tiscali.it
127.0.0.1 adv.bannercity.ru
127.0.0.1 adv01.interfree.it
127.0.0.1 oz.valueclick.ne.jp
127.0.0.1 banner.maxximum.org
127.0.0.1 bannerbooster.free.fr
127.0.0.1 bannerexchange.klikklik.nl
127.0.0.1 banners.dollarmachine.com
127.0.0.1 banners.gribel.com
127.0.0.1 banners.interq.or.jp
127.0.0.1 banners.webcounter.com
127.0.0.1 http://www.bannner.com
127.0.0.1 www3.bannner.com
127.0.0.1 ad.zdnet.co.jp
127.0.0.1 http://www.mediaclick.jp
127.0.0.1 4at3.net
127.0.0.1 abacus.geocities.com
127.0.0.1 ad.adrenaline.cz
127.0.0.1 ad.ads.dk
127.0.0.1 ad.advert.hu
127.0.0.1 ad.ar.doubleclick.net
127.0.0.1 ad.asv.de
127.0.0.1 ad.at.doubleclick.net
127.0.0.1 ad.au.doubleclick.be
127.0.0.1 ad.be.doubleclick.be
127.0.0.1 ad.blm.org
127.0.0.1 ad.bs.doubleclick.net
127.0.0.1 ad.ca.doubleclick.be
127.0.0.1 ad.caramail.com
127.0.0.1 ad.ch.doubleclick.be
127.0.0.1 ad.cl.doubleclick.net
127.0.0.1 ad.co.doubleclick.net
127.0.0.1 ad.cz.doubleclick.net
127.0.0.1 ad.de.doubleclick.be
127.0.0.1 ad.dk.doubleclick.net
127.0.0.1 ad.doubleclick.be
127.0.0.1 ad.ad.eg.doubleclick.net
127.0.0.1 ad.ero.be
127.0.0.1 ad.ero.nl
127.0.0.1 ad.excite.co.jp
127.0.0.1 ad.fr.advertissimo.net
127.0.0.1 ad.fr.doubleclick.be
127.0.0.1 ad.goo.ne.jp
127.0.0.1 ad.gr.doubleclick.net
127.0.0.1 ad.gt.doubleclick.net
127.0.0.1 ad.hu.doubleclick.net
127.0.0.1 ad.ibest.com.br
127.0.0.1 ad.id.doubleclick.net
127.0.0.1 ad.ie.doubleclick.net
127.0.0.1 ad.iemg.com
127.0.0.1 ad.iii.co.uk
127.0.0.1 ad.il.doubleclick.net
127.0.0.1 ad.in.doubleclick.net
127.0.0.1 ad.is.doubleclick.net
127.0.0.1 ad.jp.doubleclick.be
127.0.0.1 ad.jpln.doubleclick.net
127.0.0.1 ad.kw.doubleclick.net
127.0.0.1 ad.linkexchange.nl
127.0.0.1 ad.linx.sk
127.0.0.1 ad.ma.doubleclick.net
127.0.0.1 ad.mx.doubleclick.net
127.0.0.1 ad.my.doubleclick.be
127.0.0.1 ad.myrice.com
127.0.0.1 ad.napigator.com
127.0.0.1 ad.nl.doubleclick.be
127.0.0.1 ad.no.doubleclick.be
127.0.0.1 ad.nttnavi.co.jp
127.0.0.1 ad.pchome.com.tw
127.0.0.1 ad.pe.doubleclick.net
127.0.0.1 ad.ph.doubleclick.net
127.0.0.1 ad.preferences.net
127.0.0.1 ad.ro.doubleclick.net
127.0.0.1 ad.ru.doubleclick.net
127.0.0.1 ad.sa.doubleclick.net
127.0.0.1 ad.sales.olympics.nl
127.0.0.1 ad.se.doubleclick.be
127.0.0.1 ad.search.ch
127.0.0.1 ad.sg.doubleclick.be
127.0.0.1 ad.sizzle.com
127.0.0.1 ad.sma.punto.org
127.0.0.1 ad.telnet.hu
127.0.0.1 ad.th.doubleclick.net
127.0.0.1 ad.tr.doubleclick.net
127.0.0.1 ad.uk.doubleclick.be
127.0.0.1 ad.ve.doubleclick.net
127.0.0.1 ad.walla.co.il
127.0.0.1 ad.webadvertising.ch
127.0.0.1 ad.wedoo.com
127.0.0.1 ad.wt50.com
127.0.0.1 ad.yourmedia.com
127.0.0.1 ad.za.doubleclick.net
127.0.0.1 ad1.adverticum.net
127.0.0.1 ad1.doubleclick.be
127.0.0.1 ad1.doubleclick.com
127.0.0.1 ad1.gamezone.de
127.0.0.1 ad1.lbn.ru
127.0.0.1 ad10.doubleclick.be
127.0.0.1 ad10.lbn.ru
127.0.0.1 ad11.doubleclick.be
127.0.0.1 ad11.lbn.ru
127.0.0.1 ad12.doubleclick.be
127.0.0.1 ad12.lbn.ru
127.0.0.1 ad13.doubleclick.be
127.0.0.1 ad13.lbn.ru
127.0.0.1 ad14.doubleclick.be
127.0.0.1 ad15.doubleclick.be
127.0.0.1 ad16.doubleclick.be
127.0.0.1 ad17.doubleclick.be
127.0.0.1 ad18.doubleclick.be
127.0.0.1 ad19.doubleclick.be
127.0.0.1 ad2.ad2.doubleclick.be
127.0.0.1 ad2.doubleclick.com
127.0.0.1 ad2.lbn.ru
127.0.0.1 ad2.peel.com
127.0.0.1 ad2.yam.com.tw
127.0.0.1 ad20.doubleclick.be
127.0.0.1 ad3.doubleclick.be
127.0.0.1 ad3.doubleclick.com
127.0.0.1 ad3.doubleclick.net
127.0.0.1 ad3.lbn.ru
127.0.0.1 ad4.doubleclick.be
127.0.0.1 ad4.doubleclick.com
127.0.0.1 ad4.doubleclick.net
127.0.0.1 ad5.doubleclick.be
127.0.0.1 ad5.doubleclick.com
127.0.0.1 ad5.doubleclick.net
127.0.0.1 ad5.lbn.ru
127.0.0.1 ad6.doubleclick.be
127.0.0.1 ad6.doubleclick.com
127.0.0.1 ad6.doubleclick.net
127.0.0.1 ad6.lbn.ru
127.0.0.1 ad7.doubleclick.be
127.0.0.1 ad7.doubleclick.com
127.0.0.1 ad7.doubleclick.net
127.0.0.1 ad7.lbn.ru
127.0.0.1 ad8.doubleclick.be
127.0.0.1 ad8.doubleclick.com
127.0.0.1 ad8.doubleclick.net
127.0.0.1 ad8.lbn.ru
127.0.0.1 ad9.doubleclick.be
127.0.0.1 ad9.doubleclick.com
127.0.0.1 ad9.doubleclick.net
127.0.0.1 ad9.lbn.ru
127.0.0.1 adbanner.sweepsclub.com
127.0.0.1 adbest.net
127.0.0.1 adbonus.com
127.0.0.1 adcentral.gtmi.net
127.0.0.1 adclick.de
127.0.0.1 adclick.dig-online.de
127.0.0.1 adcount.hollywood.nl
127.0.0.1 adcreatives.imaginemedia.net
127.0.0.1 adengine.po.com
127.0.0.1 adengine.theglobe.net
127.0.0.1 adimage.blm.net
127.0.0.1 adimage.blm.org
127.0.0.1 adimages.tmpw.net
127.0.0.1 adimg.activeadv.net
127.0.0.1 adlink.deh.nl
127.0.0.1 adlink.preferences.net
127.0.0.1 adlog.profero.com
127.0.0.1 admonitor.com
127.0.0.1 adn4.activeadv.net
127.0.0.1 adp.cplaza.ne.jp
127.0.0.1 adpick.switchboard.org
127.0.0.1 adpop.theglobe.net
127.0.0.1 adpulse.ads.targetnet.com
127.0.0.1 adrunner.mycomputer.nl
127.0.0.1 ads.51.net
127.0.0.1 ads.adhostcenter.com
127.0.0.1 ads.ads.ads.ahds.ac.uk
127.0.0.1 ads.allotraffic.com
127.0.0.1 ads.amusive.com
127.0.0.1 ads.as4x.tmcs.ticketmaster.com
127.0.0.1 ads.avn.valueclick.net
127.0.0.1 ads.bangkokpost.co.th
127.0.0.1 ads.banner.t-online.de
127.0.0.1 ads.banner-link.com.br
127.0.0.1 ads.bigasia.com
127.0.0.1 ads.bluemountain.nl
127.0.0.1 ads.bolt.com
127.0.0.1 ads.bomis.com
127.0.0.1 ads.cashsurfers.com
127.0.0.1 ads.click2paid.com
127.0.0.1 ads.clickad.com.pl
127.0.0.1 ads.cmpnet.com
127.0.0.1 ads.coolads.de
127.0.0.1 ads.dai.nl
127.0.0.1 ads.dealnews.com
127.0.0.1 ads.delfi.ee
127.0.0.1 ads.democratandchronicle.com
127.0.0.1 ads.desertsunonline.com
127.0.0.1 ads.digitalhealthcare.com
127.0.0.1 ads.doubleclick.be
127.0.0.1 ads.dwclick.com
127.0.0.1 ads.economist.com
127.0.0.1 ads.enliven.net
127.0.0.1 ads.enliven.org
127.0.0.1 ads.erotism.net
127.0.0.1 ads.erotism.nl
127.0.0.1 ads.erotism.org
127.0.0.1 ads.fool.org
127.0.0.1 ads.fortunecity.de
127.0.0.1 ads.fortunecity.fr
127.0.0.1 ads.fortunecity.org
127.0.0.1 ads.foxhome.com
127.0.0.1 ads.hollywood.nl
127.0.0.1 ads.iac-online.de
127.0.0.1 ads.imdb.nl
127.0.0.1 ads.imdb.org
127.0.0.1 ads.interfun.net
127.0.0.1 ads.internova.de
127.0.0.1 ads.ixo.com
127.0.0.1 ads.jobclicks.net
127.0.0.1 ads.kleinman.com
127.0.0.1 ads.live365.com
127.0.0.1 ads.lx.hu
127.0.0.1 ads.lycos.de
127.0.0.1 ads.necker-online.de
127.0.0.1 ads.nerve.com
127.0.0.1 ads.netdok.net
127.0.0.1 ads.ninemsn.net
127.0.0.1 ads.ole.org
127.0.0.1 ads.onecenter.com
127.0.0.1 ads.pentoninteractive.com
127.0.0.1 ads.playnet.com
127.0.0.1 ads.playnet.nl
127.0.0.1 ads.pointroll.com
127.0.0.1 ads.quicken.com
127.0.0.1 ads.sexspaces.net
127.0.0.1 ads.sexspaces.nl
127.0.0.1 ads.sol.no
127.0.0.1 ads.spaceports.net
127.0.0.1 ads.sublimedirectory.com
127.0.0.1 ads.sublimedirectory.org
127.0.0.1 ads.surfsolutions.com
127.0.0.1 ads.swirve.com
127.0.0.1 ads.switchboard.org
127.0.0.1 ads.terra.com.br
127.0.0.1 ads.toronto.com
127.0.0.1 ads.ugo.nl
127.0.0.1 ads.viaarena.com
127.0.0.1 ads.web.compuserve.com
127.0.0.1 ads.web21.de
127.0.0.1 ads.webcoretech.com
127.0.0.1 ads.xpics.com
127.0.0.1 ads.xserv.net
127.0.0.1 ads.yifan.com
127.0.0.1 ads.yupimsn.com
127.0.0.1 ads.zdnet.org
127.0.0.1 ads-03.tor.focusin.ads.targetnet.com
127.0.0.1 ads1.clickad.com.pl
127.0.0.1 ads1.crgaming.com
127.0.0.1 ads1.vip.sc5.yahoo.com
127.0.0.1 ads1.zdnet.org
127.0.0.1 ads2.cgi.eohub.com
127.0.0.1 ads2.clickad.com.pl
127.0.0.1 ads2.delfi.ee
127.0.0.1 ads2.pentoninteractive.com
127.0.0.1 ads2.zdnet.org
127.0.0.1 ads3.bigasia.com
127.0.0.1 ads3.zdnet.org
127.0.0.1 ads4.bigasia.com
127.0.0.1 ads4.zdnet.org
127.0.0.1 ads5.bigasia.com
127.0.0.1 ads7.c.no1.asap-asp.net
127.0.0.1 ads8.c.no1.asap-asp.net
127.0.0.1 adsadmin.nandomedia.com
127.0.0.1 adserv.bravenet.com
127.0.0.1 adserv.de
127.0.0.1 adserv.floppybank.com
127.0.0.1 adserv.quality-channel.com
127.0.0.1 adserv001.adtech.de
127.0.0.1 adserv002.adtech.de
127.0.0.1 adserv003.adtech.de
127.0.0.1 adserv004.adtech.de
127.0.0.1 adserv005.adtech.de
127.0.0.1 adserv006.adtech.de
127.0.0.1 adserv007.adtech.de
127.0.0.1 adserv008.adtech.de
127.0.0.1 adservant.guj.net
127.0.0.1 adserver.ad-it.dk
127.0.0.1 adserver.airmiles.ca
127.0.0.1 adserver.akqa.net
127.0.0.1 adserver.arttoday.com
127.0.0.1 adserver.clubic.com
127.0.0.1 adserver.comparatel.fr
127.0.0.1 adserver.com-solutions.com
127.0.0.1 adserver.digitalpartners.com
127.0.0.1 adserver.harvestadsdepot.com
127.0.0.1 adserver.interfree.it
127.0.0.1 adserver.janes.net
127.0.0.1 adserver.janes.org
127.0.0.1 adserver.lunarpages.com
127.0.0.1 adserver.myownemail.com
127.0.0.1 adserver.netshelter.net
127.0.0.1 adserver.onwisconsin.com
127.0.0.1 adserver.phatmax.net
127.0.0.1 adserver.portal.pl
127.0.0.1 adserver.ratestar.net
127.0.0.1 adserver.te.pt
127.0.0.1 adserver.trader.ca
127.0.0.1 adserver.tweakers.net
127.0.0.1 adserver.ugo.nl
127.0.0.1 adserver.voir.ca
127.0.0.1 adserver.wemnet.nl
127.0.0.1 adserver1.harvestadsdepot.com
127.0.0.1 adsmart.de
127.0.0.1 adsmart.nl
127.0.0.1 adsrv.hpg.com.br
127.0.0.1 adsrv.ilife.com
127.0.0.1 adsrv.news.com.au
127.0.0.1 adssl01.adtech.de
127.0.0.1 adssl02.adtech.de
127.0.0.1 adsv.interia.pl
127.0.0.1 adtegrity.spinbox.org
127.0.0.1 adv4.activeadv.net
127.0.0.1 advert.heise.org
127.0.0.1 advert.stealth.nl
127.0.0.1 advertising.paltalk.com
127.0.0.1 adwaver.de
127.0.0.1 adx.adrenaline.cz
127.0.0.1 adx.adrenalinesk.sk
127.0.0.1 adx1.adrenaline.cz
127.0.0.1 affiliates.turbo-surfer.com
127.0.0.1 affiliatetargetad.com
127.0.0.1 ai.net
127.0.0.1 all69.awesomeporn.com
127.0.0.1 altfarm.mediaplex.com
127.0.0.1 ap.delfi.ee
127.0.0.1 arbo.aru.index.hu
127.0.0.1 asacp.org
127.0.0.1 asp.myfree.com
127.0.0.1 atlas.services.ou.edu
127.0.0.1 au1.doubleclick.net
127.0.0.1 b.porncity.org
127.0.0.1 bangbus.com
127.0.0.1 banner.0catch.com
127.0.0.1 banner.adrenaline.cz
127.0.0.1 banner.freeservers.net
127.0.0.1 banner.infomaniak.ch
127.0.0.1 banner.linkexchange.nl
127.0.0.1 banner.listinus.de
127.0.0.1 banner.pornoguru.de
127.0.0.1 banner.rootsweb.net
127.0.0.1 banner.sda.t-online.de
127.0.0.1 banner.technorail.com
127.0.0.1 banner.tripple.at
127.0.0.1 banner2.babenet.be
127.0.0.1 banner2.babenet.com
127.0.0.1 banner2.babenet.nl
127.0.0.1 banner3.a411.com
127.0.0.1 bannerbank.com
127.0.0.1 bannerbank.de
127.0.0.1 bannercampaign.com
127.0.0.1 bannercash.com.cz
127.0.0.1 bannercash.de
127.0.0.1 banner-mania.com
127.0.0.1 bannernetwork.cearchives.com
127.0.0.1 banners.babylon-boy.com
127.0.0.1 banners.easydns.nl
127.0.0.1 banners.fantasycorp.com
127.0.0.1 banners.freerun.com
127.0.0.1 banners.gayweb.com
127.0.0.1 banners.img.uol.com.br
127.0.0.1 banners.intergal.com
127.0.0.1 banners.sextracker.be
127.0.0.1 banners.unfaithful.com
127.0.0.1 banners.xxxwebhosting.com
127.0.0.1 bannerswap.de
127.0.0.1 bannerswap.nl
127.0.0.1 banserv.internetfuel.com
127.0.0.1 bidclix.com
127.0.0.1 bighits.net
127.0.0.1 biz.zairmail.com
127.0.0.1 bizad.nikkeibp.co.jp
127.0.0.1 bizrate.com
127.0.0.1 br1.doubleclick.net
127.0.0.1 brainteasers.freestats.com
127.0.0.1 c1.zedo.com
127.0.0.1 c3.xxxcounter.com
127.0.0.1 califia.imaginemedia.net
127.0.0.1 cgicounter.onlinehome.de
127.0.0.1 cidyweb.free.fr
127.0.0.1 clexchange.usww.com
127.0.0.1 click.linksynergy.com
127.0.0.1 clickagents.de
127.0.0.1 ClickCash.WebPower.com
127.0.0.1 clicks.about.nl
127.0.0.1 clicksxchange.com
127.0.0.1 clicktrade.linkexchange.nl
127.0.0.1 clickXchange.net
127.0.0.1 cn.adserver.yahoo.com
127.0.0.1 cn1.doubleclick.net
127.0.0.1 code.newsclicker.com
127.0.0.1 code-adrunner.mycomputer.com
127.0.0.1 console.popupsponsor.com
127.0.0.1 count.freeyellow.com
127.0.0.1 count.yourmusic.cc
127.0.0.1 counter.hitbox.com
127.0.0.1 counter.hitslink.com
127.0.0.1 counter18.bravenet.com
127.0.0.1 countus.editeurjavascript.com
127.0.0.1 ct.sexadnet.com
127.0.0.1 ctc.japaneseanime.com
127.0.0.1 cz3.clickzs.com
127.0.0.1 cz6.clickzs.com
127.0.0.1 dailyradar.ads.imaginemedia.net
127.0.0.1 db0.sitestats.com
127.0.0.1 direct.travelocity.com
127.0.0.1 download.cashsurfers.com
127.0.0.1 ds1.onet.pl
127.0.0.1 dsa.er.cyberwing.co.jp
127.0.0.1 earth.goclick.com
127.0.0.1 ebates.com
127.0.0.1 ehg.hitbox.com
127.0.0.1 ehg-dig.hitbox.com
127.0.0.1 ehg-espn.hitbox.com
127.0.0.1 ehg-learningco.hitbox.com
127.0.0.1 elf.box.sk
127.0.0.1 exitstitial.gopher.com
127.0.0.1 fast.mediacharger.com
127.0.0.1 fastcounter.linkexchange.nl
127.0.0.1 fr.nedstatbasic.net
127.0.0.1 free.realtracker.com
127.0.0.1 g.fool.co.uk
127.0.0.1 gd1.doubleclick.net
127.0.0.1 gd2.doubleclick.net
127.0.0.1 gd27.doubleclick.net
127.0.0.1 geogi.gator.com
127.0.0.1 global.go4media.com
127.0.0.1 gs.gator.com
127.0.0.1 help.adtech.de
127.0.0.1 hg1.hitbox.com
127.0.0.1 hit.reference-sexe.com
127.0.0.1 hk1.doubleclick.net
127.0.0.1 holland.hyperbanner.com
127.0.0.1 houseads.bizspace.com
127.0.0.1 hv.nwd42.com
127.0.0.1 ifcol1.internetfuel.com
127.0.0.1 ifcol2.internetfuel.com
127.0.0.1 image.linkexchange.nl
127.0.0.1 image73.eguard.com
127.0.0.1 images.francite.com
127.0.0.1 images.popupsponsor.com
127.0.0.1 images.webads.nl
127.0.0.1 img.mediaplex.com
127.0.0.1 img-iad.wip.mediaplex.com
127.0.0.1 imgserv.adbutler.com
127.0.0.1 imserv001.adtech.de
127.0.0.1 imserv002.adtech.de
127.0.0.1 imserv003.adtech.de
127.0.0.1 imserv004.adtech.de
127.0.0.1 imserv005.adtech.de
127.0.0.1 imserv006.adtech.de
127.0.0.1 info.learningco.com
127.0.0.1 iv.doubleclick.net
127.0.0.1 join.netbroadcaster.com
127.0.0.1 jp1.doubleclick.net
127.0.0.1 js.zmedia.com
127.0.0.1 kansas.valueclick.com
127.0.0.1 kansas.valueclick.ne.jp
127.0.0.1 kr1.doubleclick.net
127.0.0.1 leader.linkexchange.com
127.0.0.1 leader.linkexchange.nl
127.0.0.1 link.exitdirect.com
127.0.0.1 linkexchange.be
127.0.0.1 linktracker.angelfire.com
127.0.0.1 ln.doubleclick.be
127.0.0.1 ln.doubleclick.com
127.0.0.1 load.focalex.com
127.0.0.1 logs.sexy-parade.com
127.0.0.1 lt.angelfire.com
127.0.0.1 m.doubleclick.be
127.0.0.1 m.tribalfusion.com
127.0.0.1 m.us.doubleclick.net
127.0.0.1 m1.nedstatbasic.net
127.0.0.1 m2.doubleclick.be
127.0.0.1 map.eguard.com
127.0.0.1 maximumpcads.imaginemedia.net
127.0.0.1 media.snowball.com
127.0.0.1 media-mc-adrunner.mycomputer.com
127.0.0.1 memoweb3.goto.fr
127.0.0.1 mobileproxy-vip1.us.doubleclick.net
127.0.0.1 mojofarm.mediaplex.com
127.0.0.1 mrad.webjump.com
127.0.0.1 mr-cash.com
127.0.0.1 mx.adserver.yahoo.com
127.0.0.1 newadserver.interfree.it
127.0.0.1 nitrous.exitfuel.com
127.0.0.1 nitrous1.internetfuel.com
127.0.0.1 nitrous10.internetfuel.com
127.0.0.1 nitrous11.internetfuel.com
127.0.0.1 nitrous2.internetfuel.com
127.0.0.1 nitrous3.internetfuel.com
127.0.0.1 nitrous4.internetfuel.com
127.0.0.1 nitrous5.internetfuel.com
127.0.0.1 nitrous6.internetfuel.com
127.0.0.1 nitrous7.internetfuel.com
127.0.0.1 nitrous8.internetfuel.com
127.0.0.1 nitrous9.internetfuel.com
127.0.0.1 nl.adserver.yahoo.com
127.0.0.1 no1.ad.asap-asp.net
127.0.0.1 no2.ad.asap-asp.net
127.0.0.1 nxads.internet.com
127.0.0.1 oad.realmedia.com
127.0.0.1 one-time-offer.com
127.0.0.1 oz.valueclick.com
127.0.0.1 p01.com
127.0.0.1 pbid.pro-market.net
127.0.0.1 pixel3.about.com
127.0.0.1 popup.found404.com
127.0.0.1 probe.prohosting.com
127.0.0.1 project2.realtracker.com
127.0.0.1 promo.yahoo.com
127.0.0.1 pub21.bravenet.com
127.0.0.1 pubsec.goto.fr
127.0.0.1 ranking.buscarsexo.com
127.0.0.1 rd.au.doubleclick.net
127.0.0.1 rd.br.doubleclick.net
127.0.0.1 rd.cn.doubleclick.net
127.0.0.1 rd.de.doubleclick.net
127.0.0.1 rd.eshop.msn.com
127.0.0.1 rd.fr.doubleclick.net
127.0.0.1 rd.hk.doubleclick.net
127.0.0.1 rd.intl.doubleclick.net
127.0.0.1 rd.jp.doubleclick.net
127.0.0.1 rd.kr.doubleclick.net
127.0.0.1 rd.se.doubleclick.net
127.0.0.1 rd.sg.doubleclick.net
127.0.0.1 rd.terra.doubleclick.net
127.0.0.1 rd.uk.doubleclick.net
127.0.0.1 realmedia.m6.fr
127.0.0.1 realmedia-a592.d4p.net
127.0.0.1 redirect.winnersplaycasinos.com
127.0.0.1 remotead-internal.cnet.com
127.0.0.1 report02.adtech.de
127.0.0.1 reporter.adtech.de
127.0.0.1 reporter001.adtech.de
127.0.0.1 reportimage.adtech.de
127.0.0.1 revenueservice.com
127.0.0.1 rm.myoc.com
127.0.0.1 rs.gator.com
127.0.0.1 s0b.bluestreak.com
127.0.0.1 sb1.realtrackerbe.com
127.0.0.1 sb1.realtrackernl.com
127.0.0.1 schumacher.adtech.de
127.0.0.1 se.adserver.yahoo.com
127.0.0.1 secserv.adtech.de
127.0.0.1 server224.smartbotpro.net
127.0.0.1 server5.affiliatetarget.com
127.0.0.1 service001.adtech.de
127.0.0.1 service002.adtech.de
127.0.0.1 service003.adtech.de
127.0.0.1 sg1.doubleclick.net
127.0.0.1 si.homestore.com
127.0.0.1 siteminer.mycomputer.com
127.0.0.1 sitestat.nedstat.nl
127.0.0.1 sm.banner-link.com.br
127.0.0.1 stats.2u.ru
127.0.0.1 stats.gograph.com
127.0.0.1 stats.go-west.nl
127.0.0.1 stats1.porntrack.com
127.0.0.1 talkcity.realtracker.com
127.0.0.1 telecharger.01net.com
127.0.0.1 telstra.thinknyc.eu-tpl1.realtracker.com
127.0.0.1 trakka.zdnet.com.au
127.0.0.1 trickle.gator.com
127.0.0.1 ts.gator.com
127.0.0.1 UGO.eu-uk.adserver.yahoo.com
127.0.0.1 uk.nedstat.net
127.0.0.1 us.usa.nedstat.com
127.0.0.1 v0.extreme-dm.com
127.0.0.1 v1.extreme-dm.com
127.0.0.1 v1.nedstatbasic.net
127.0.0.1 van.VNU.eu-w113.hitbox.com
127.0.0.1 w25.hitbox.com
127.0.0.1 ww2.absadirect.co.za
127.0.0.1 http://www.2001-007.com
127.0.0.1 http://www.actionsplash.com
127.0.0.1 http://www.ad.au.doubleclick.be
127.0.0.1 http://www.ad.be.doubleclick.be
127.0.0.1 http://www.ad.blm.org
127.0.0.1 http://www.ad.ca.doubleclick.be
127.0.0.1 http://www.ad.ch.doubleclick.be
127.0.0.1 http://www.ad.de.doubleclick.be
127.0.0.1 http://www.ad.doubleclick.be
127.0.0.1 http://www.ad.ero.be
127.0.0.1 http://www.ad.ero.nl
127.0.0.1 http://www.ad.fr.doubleclick.be
127.0.0.1 http://www.ad.infoseek.com
127.0.0.1 http://www.ad.jp.doubleclick.be
127.0.0.1 http://www.ad.linkexchange.nl
127.0.0.1 http://www.ad.my.doubleclick.be
127.0.0.1 http://www.ad.nl.doubleclick.be
127.0.0.1 http://www.ad.no.doubleclick.be
127.0.0.1 http://www.www.ad.preferences.net
127.0.0.1 http://www.ad.sales.olympics.nl
127.0.0.1 http://www.ad.se.doubleclick.be
127.0.0.1 http://www.ad.sg.doubleclick.be
127.0.0.1 http://www.ad.sma.punto.org
127.0.0.1 http://www.www.ad.uk.doubleclick.be
127.0.0.1 http://www.ad1.doubleclick.be
127.0.0.1 http://www.ad1.gamezone.de
127.0.0.1 http://www.ad10.doubleclick.be
127.0.0.1 http://www.ad11.doubleclick.be
127.0.0.1 http://www.ad12.doubleclick.be
127.0.0.1 http://www.ad13.doubleclick.be
127.0.0.1 http://www.ad14.doubleclick.be
127.0.0.1 http://www.ad15.doubleclick.be
127.0.0.1 http://www.ad16.doubleclick.be
127.0.0.1 http://www.ad17.doubleclick.be
127.0.0.1 http://www.ad18.doubleclick.be
127.0.0.1 http://www.ad19.doubleclick.be
127.0.0.1 http://www.ad2.doubleclick.be
127.0.0.1 http://www.ad20.doubleclick.be
127.0.0.1 http://www.ad2000.org
127.0.0.1 http://www.ad3.doubleclick.be
127.0.0.1 http://www.ad4.doubleclick.be
127.0.0.1 http://www.ad5.doubleclick.be
127.0.0.1 http://www.ad6.doubleclick.be
127.0.0.1 http://www.ad7.doubleclick.be
127.0.0.1 http://www.ad8.doubleclick.be
127.0.0.1 http://www.ad9.doubleclick.be
127.0.0.1 http://www.adbot.de
127.0.0.1 http://www.adcentriconline.com
127.0.0.1 http://www.adcreatives.imaginemedia.net
127.0.0.1 http://www.adengine.theglobe.net
127.0.0.1 http://www.adexit.de
127.0.0.1 http://www.adimage.blm.org
127.0.0.1 http://www.www.adlink.deh.nl
127.0.0.1 http://www.adlink.preferences.net
127.0.0.1 http://www.admex.com
127.0.0.1 http://www.www.adready.net
127.0.0.1 http://www.www.www.www.ads.bluemountain.nl
127.0.0.1 http://www.www.ads.dai.nl
127.0.0.1 http://www.www.www.ads.doubleclick.be
127.0.0.1 http://www.ads.enliven.net
127.0.0.1 http://www.ads.enliven.org
127.0.0.1 http://www.ads.erotism.net
127.0.0.1 http://www.ads.erotism.nl
127.0.0.1 http://www.ads.erotism.org
127.0.0.1 http://www.www.ads.fool.org
127.0.0.1 http://www.ads.fortunecity.org
127.0.0.1 http://www.ads.hollywood.nl
127.0.0.1 http://www.www.ads.imdb.nl
127.0.0.1 http://www.www.ads.ole.org
127.0.0.1 http://www.ads.playnet.nl
127.0.0.1 http://www.ads.sexspaces.nl
127.0.0.1 http://www.ads.spaceports.com
127.0.0.1 http://www.ads.spaceports.net
127.0.0.1 http://www.ads.sublimedirectory.org
127.0.0.1 http://www.ads.switchboard.org
127.0.0.1 http://www.www.ads.ugo.nl
127.0.0.1 http://www.ads.web.com
127.0.0.1 http://www.www.ads.web21.de
127.0.0.1 http://www.www.ads.x10.net
127.0.0.1 http://www.ads.zdnet.org
127.0.0.1 http://www.ads-03.tor.focusin.ads.targetnet.com
127.0.0.1 http://www.www.ads1.zdnet.org
127.0.0.1 http://www.www.ads2.hyperbanner.net
127.0.0.1 http://www.ads2.zdnet.org
127.0.0.1 http://www.www.ads3.zdnet.org
127.0.0.1 http://www.www.ads4.zdnet.org
127.0.0.1 http://www.ads4texas.com
127.0.0.1 http://www.www.www.adservant.guj.net
127.0.0.1 http://www.www.adserver.janes.net
127.0.0.1 http://www.adserver.janes.org
127.0.0.1 http://www.www.adserver.ugo.nl
127.0.0.1 http://www.adserver-espnet.sportszone.net
127.0.0.1 http://www.www.adtegrity.spinbox.org
127.0.0.1 http://www.ad-up.com
127.0.0.1 http://www.www.advert.heise.org
127.0.0.1 http://www.advert.stealth.nl
127.0.0.1 http://www.advertising.com
127.0.0.1 http://www.alibuba.web1000.com
127.0.0.1 http://www.www.avenuea.com
127.0.0.1 http://www.www.b.porncity.org
127.0.0.1 http://www.bannedindia.com
127.0.0.1 http://www.banner.linkexchange.nl
127.0.0.1 http://www.banner2.babenet.be
127.0.0.1 http://www.banner2.babenet.nl
127.0.0.1 http://www.bannercampaign.com
127.0.0.1 http://www.banneroverdrive.com
127.0.0.1 http://www.www.www.banners.easydns.nl
127.0.0.1 http://www.banners.sextracker.be
127.0.0.1 http://www.www.bannervip.webjump.com
127.0.0.1 http://www.bns2.net
127.0.0.1 http://www.www.califia.imaginemedia.net
127.0.0.1 http://www.centrport.net
127.0.0.1 http://www.www.clicktrade.linkexchange.nl
127.0.0.1 http://www.clickxchange.com
127.0.0.1 http://www.commission-junction.com
127.0.0.1 http://www.dailyradar.ads.imaginemedia.net
127.0.0.1 http://www.ddi2.com
127.0.0.1 http://www.doubleclick.be
127.0.0.1 http://www.www.doubleclick.net
127.0.0.1 http://www.doubleclick.nl
127.0.0.1 http://www.www.engage.com
127.0.0.1 http://www.fastcounter.linkexchange.nl
127.0.0.1 http://www.freestats.com
127.0.0.1 http://www.i-clicks.net
127.0.0.1 http://www.image.linkexchange.nl
127.0.0.1 http://www.imaginemedia.com
127.0.0.1 http://www.imaginemedia.net
127.0.0.1 http://www.imaginemedia.org
127.0.0.1 http://www.leader.linkexchange.nl
127.0.0.1 http://www.linkexchange.nl
127.0.0.1 http://www.ln.doubleclick.be
127.0.0.1 http://www.m.doubleclick.be
127.0.0.1 http://www.m2.doubleclick.be
127.0.0.1 http://www.maximumpcads.imaginemedia.net
127.0.0.1 http://www.netdirect.nl
127.0.0.1 http://www.oneandonlynetwork.com
127.0.0.1 http://www.publicadvertising.com
127.0.0.1 http://www.qksrv.net
127.0.0.1 http://www.rankyou.com
127.0.0.1 http://www.rgs2.net
127.0.0.1 http://www.theadstop.com
127.0.0.1 http://www.valueclick.com
127.0.0.1 www2.www3.ad.tomshardware.com
127.0.0.1 www3.bannerspace.com
127.0.0.1 www4.trix.net
127.0.0.1 www80.valueclick.com
127.0.0.1 xjohnnyx.virtualave.net
127.0.0.1 xml.adtech.de
127.0.0.1 z.extreme-dm.com
127.0.0.1 z0.extreme-dm.com
127.0.0.1 z1.extreme-dm.com
127.0.0.1 ad.interreklame.de
127.0.0.1 ads.comediagroup.hu
127.0.0.1 ads.isum.de
127.0.0.1 adserv2.bravenet.com
127.0.0.1 adserver.pl
127.0.0.1 advertising.publishededitions.co.uk
127.0.0.1 advertisingbargains.com
127.0.0.1 ak.alladvantage.com
127.0.0.1 ar.atwola.com
127.0.0.1 ar1.atwola.com
127.0.0.1 au.autohits.dk
127.0.0.1 bbanerovec.cz
127.0.0.1 bsbusinessfactory.prospero.com
127.0.0.1 cbx.heartlight.org
127.0.0.1 click.greenlightmail.com
127.0.0.1 click2paid.com
127.0.0.1 directldiscountclick.com
127.0.0.1 eu-euniverseur.exchange-it.com
127.0.0.1 fastcounter.linkexchange.com
127.0.0.1 freeinvisiblecounters.com
127.0.0.1 gcgetmytraffic.com
127.0.0.1 globalwebads.com
127.0.0.1 hitlogger.com
127.0.0.1 k5kliks.nl
127.0.0.1 kr-adimage.lycos.co.kr
127.0.0.1 leadcart.com
127.0.0.1 linktrack.bravenet.com
127.0.0.1 lnlog.btopenworld.com
127.0.0.1 ngnitroclicks.com
127.0.0.1 nitrous.internetfuel.com
127.0.0.1 offshoreclicks.com
127.0.0.1 oglasi.domenca.com
127.0.0.1 ptrpub-g.ifrance.com
127.0.0.1 publishers.adscholar.com
127.0.0.1 reklamr.hitlist.ru
127.0.0.1 servedby.advertising.com
127.0.0.1 server.iad.liveperson.net
127.0.0.1 sfshareasale.com
127.0.0.1 ssstart.freeze.com
127.0.0.1 stat.livejournal.com
127.0.0.1 web3000.co.uk
127.0.0.1 window.nixnet.cz
127.0.0.1 http://www.alladvantage.com
127.0.0.1 http://www.bannerads.de
127.0.0.1 http://www.cash4banner.com
127.0.0.1 http://www.megacash.de
127.0.0.1 http://www.nedstat.nl
127.0.0.1 http://www.postmasterbannernet.com
127.0.0.1 http://www.www.x.mycity.com
127.0.0.1 xupiter.com
127.0.0.1 localhost
127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 http://www.drivecleaner.com ## added by CiD
127.0.0.1 http://www.errorprotector.com ## added by CiD
127.0.0.1 http://www.errorsafe.com ## added by CiD
127.0.0.1 http://www.systemdoctor.com ## added by CiD
127.0.0.1 http://www.win-anti-virus-pro.com ## added by CiD
127.0.0.1 http://www.win-virus-pro.com ## added by CiD
127.0.0.1 http://www.winantispam.com ## added by CiD
127.0.0.1 http://www.winantispy.com ## added by CiD
127.0.0.1 http://www.winantispyware.com ## added by CiD
127.0.0.1 http://www.winantivirus.com ## added by CiD
127.0.0.1 http://www.winantiviruspro.com ## added by CiD
127.0.0.1 http://www.windrivecleaner.com ## added by CiD
127.0.0.1 http://www.windrivesafe.com ## added by CiD
127.0.0.1 http://www.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 http://www.utils.winfixer.com ## added by CiD
127.0.0.1 http://www.winfixer2006.com ## added by CiD
127.0.0.1 http://www.winsoftware.com ## added by CiD


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\DOCUME~1\OEM\Desktop\Error Cleaner.url Deleted
C:\DOCUME~1\OEM\Desktop\Privacy Protector.url Deleted
C:\DOCUME~1\OEM\Desktop\Spyware?Malware Protection.url Deleted
C:\DOCUME~1\OEM\FAVORI~1\Error Cleaner.url Deleted
C:\DOCUME~1\OEM\FAVORI~1\Privacy Protector.url Deleted
C:\DOCUME~1\OEM\FAVORI~1\Spyware?Malware Protection.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{28F49DA5-9DD8-4E8A-B429-CF62919014B9}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS1\Services\Tcpip\..\{28F49DA5-9DD8-4E8A-B429-CF62919014B9}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS2\Services\Tcpip\..\{28F49DA5-9DD8-4E8A-B429-CF62919014B9}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

*******************************

And the Hijack This report

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:26:07 PM, on 11/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AdsGone\AdsGone.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {2D42D689-4B94-4734-92C2-606FC5F4C15D} - C:\WINDOWS\oprevtdp.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: The bonsws - {CBF19702-9D5B-44E7-8F8A-6750209B76F3} - C:\WINDOWS\bonsws.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: AdsGone.lnk = C:\Program Files\AdsGone\AdsGone.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?82b43d9504bd4ad69056bcd079f09299
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?82b43d9504bd4ad69056bcd079f09299
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6545566937
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O21 - SSODL: nopctrl - {3CB6E27C-4611-4C8A-86D4-067C0146FCBF} - C:\WINDOWS\nopctrl.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

--
End of file - 7352 bytes

Thanks heaps man
aussie
Active Member
 
Posts: 7
Joined: November 17th, 2007, 8:30 pm

Re: Help!!...... Pop-Ups

Unread postby random/random » November 19th, 2007, 2:51 pm

  • Some of out experts would like to examine the files you are infected with
  • Go to the upload page here
  • Click Browse
  • Find this file:
      C:\WINDOWS\oprevtdp.dll
  • Select the file, then click Open
  • Click Send File
  • Repeat for this file:
    C:\WINDOWS\bonsws.dll

Run HijackThis
Click on do a system scan only
Place a checkmark next to these lines(if still present)

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: MSVPS System - {2D42D689-4B94-4734-92C2-606FC5F4C15D} - C:\WINDOWS\oprevtdp.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: The bonsws - {CBF19702-9D5B-44E7-8F8A-6750209B76F3} - C:\WINDOWS\bonsws.dll
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)

Then close all windows except HijackThis and click Fix Checked

Go here to run an online scannner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic, along with anew HijackThis lgo and a description of any remaining problems
User avatar
random/random
Developer
Developer
 
Posts: 7733
Joined: December 18th, 2005, 3:30 pm

Re: Help!!...... Pop-Ups

Unread postby aussie » November 19th, 2007, 6:37 pm

Eset Log File

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=2670 (20071119)
# vers_arch_module=1.059 (20071108)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=9acff46fc0abbc4a82c3d648272815ff
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2007-11-19 09:10:49
# local_time=2007-11-20 07:10:49 (+1000, E. Australia Standard Time)
# country="Australia"
# osver=5.1.2600 NT Service Pack 2
# scanned=187274
# found=8
# scan_time=2811
# nod_component=NOD32MOD_WINNT_ENGLISH_BASE Build:0x11081627 (NOD32 For Windows NT/2000/XP/2003/Vista/x64 - Base)
# nod_component=NOD32MOD_WINNT_ENGLISH_INET Build:0x11081627 (NOD32 For Windows NT/2000/XP/2003/Vista/x64 - Internet support)
# nod_component=NOD32MOD_WINNT_ENGLISH_STANDARD Build:0x11081627 (NOD32 for Windows NT/2000/XP/2003/Vista/x64 - Standard component)
C:\Documents and Settings\OEM\Local Settings\Temp\ac8zt2.dat multiple infiltrations EE58B350A4158DF4A7F71DF486A45BFE
C:\Documents and Settings\OEM\Local Settings\Temp\ac8zt2.dat »ZIP »ac8zt2/install.bat Win32/Adware.Agent.NFX application 00000000000000000000000000000000
C:\Documents and Settings\OEM\Local Settings\Temp\ac8zt2.dat »ZIP »ac8zt2/install2.bat Win32/Adware.Agent.NFX application 00000000000000000000000000000000
C:\Documents and Settings\OEM\Local Settings\Temp\ac8zt2.dat »ZIP »ac8zt2/main_uninstaller.exe Win32/Adware.Agent.NFX application 00000000000000000000000000000000
C:\Documents and Settings\OEM\Local Settings\Temp\ac8zt2.dat »ZIP »ac8zt2/msmdev.dll Win32/Adware.Agent.NFK application 00000000000000000000000000000000
C:\Documents and Settings\OEM\Local Settings\Temp\ac8zt2.dat »ZIP »ac8zt2/msmhost.dll Win32/Adware.Agent.NFJ application 00000000000000000000000000000000
C:\Documents and Settings\OEM\Local Settings\Temp\ac8zt2.dat »ZIP »ac8zt2/nsduo.dll Win32/Adware.Agent.NFK application 00000000000000000000000000000000
C:\Documents and Settings\OEM\Local Settings\Temp\ac8zt2.dat »ZIP »ac8zt2/rmv.exe Win32/Adware.Agent.NFX application 00000000000000000000000000000000



Hijack This Log File
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:21:54 AM, on 11/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AdsGone\AdsGone.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: AdsGone.lnk = C:\Program Files\AdsGone\AdsGone.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?82b43d9504bd4ad69056bcd079f09299
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?82b43d9504bd4ad69056bcd079f09299
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6545566937
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O21 - SSODL: nopctrl - {3CB6E27C-4611-4C8A-86D4-067C0146FCBF} - C:\WINDOWS\nopctrl.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

--
End of file - 7103 bytes

Adsgone Spyware Blocker picks up the following
180 solutions - aspfile\persistenthan
180 solutions - software\microsoft\internetexplorer\urlsearchhooks
2nd Thought - software\microsoft\windows\currentversion\internetsettings
2nd Thought - software\microsoft\windows\currentversion\internetsettings
180 solutions - software\microsoft\windows\currentversion\moduleusage
180 solutions - software\microsoft\windows\currentversion\shareddlls\

When you remove the above with that program, they are there again the next time you run it

Spyware Doctor picks up the following wich returns the next time you run it
Rogueantispyware.systemdefender
which it deems to be an elevated threat

There dont appear to be any other issues



Spyware Doctor picks up
aussie
Active Member
 
Posts: 7
Joined: November 17th, 2007, 8:30 pm

Re: Help!!...... Pop-Ups

Unread postby random/random » November 20th, 2007, 1:31 pm

Run HijackThis
Click on do a system scan only
Place a checkmark next to these lines(if still present)

O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O21 - SSODL: nopctrl - {3CB6E27C-4611-4C8A-86D4-067C0146FCBF} - C:\WINDOWS\nopctrl.dll

Then close all windows except HijackThis and click Fix Checked

Restart

Use windows explorer to find and delete this file:

C:\WINDOWS\nopctrl.dll

As an example:
To delete C:\WINDOWS\system32\filetogo.bye
Double click the My Computer icon on your Desktop.
Double click on Local Disc (C:\)
Double click on the Windows folder,
Double click on the System 32 folder,
Right click on filetogo.bye and from the menu that appears, click on 'Delete'


Then post a new HijackThis log
User avatar
random/random
Developer
Developer
 
Posts: 7733
Joined: December 18th, 2005, 3:30 pm

Re: Help!!...... Pop-Ups

Unread postby aussie » November 20th, 2007, 3:38 pm

Latest Log File

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:35:19 AM, on 11/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AdsGone\AdsGone.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: AdsGone.lnk = C:\Program Files\AdsGone\AdsGone.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?82b43d9504bd4ad69056bcd079f09299
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?82b43d9504bd4ad69056bcd079f09299
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6545566937
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

--
End of file - 7041 bytes

I really appreciate your time with these issues.

Thanks
aussie
Active Member
 
Posts: 7
Joined: November 17th, 2007, 8:30 pm

Re: Help!!...... Pop-Ups

Unread postby random/random » November 20th, 2007, 5:09 pm

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.

Please download ResetProtocolDefaults by WinHelp2002 and save it to your desktop.
  • Locate ResetProtocolDefaults.reg which should be on your desktop.
  • Right-click and select: Merge.
  • OK the prompt.

Run HijackThis
Click on do a system scan only
Place a checkmark next to these lines(if still present)

R3 - Default URLSearchHook is missing

Then close all windows except HijackThis and click Fix Checked

Then post a new HijackThis log
User avatar
random/random
Developer
Developer
 
Posts: 7733
Joined: December 18th, 2005, 3:30 pm

Re: Help!!...... Pop-Ups

Unread postby aussie » November 21st, 2007, 4:40 am

I have to keep saying thanks guys and that you can expect a donation when this is all over


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:37:49 PM, on 11/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AdsGone\AdsGone.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: AdsGone.lnk = C:\Program Files\AdsGone\AdsGone.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?82b43d9504bd4ad69056bcd079f09299
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?82b43d9504bd4ad69056bcd079f09299
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6545566937
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

--
End of file - 6581 bytes
aussie
Active Member
 
Posts: 7
Joined: November 17th, 2007, 8:30 pm

Re: Help!!...... Pop-Ups

Unread postby random/random » November 21st, 2007, 12:17 pm

You can delete smitfraudfix and ResetProtocolDefaults.reg

You now appear to be clean. Congratulations!

Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints Malware Complaints, you need to be registered to post as unfortunately we were hit with too many spam posting to allow guest posting to continue just find your country room and register your complaint.

Below are some steps to follow in order to dramatically lower the chances of reinfection
You may have already implemented some of the steps below, however you should follow any steps that you have not already implemented
    • Turn System Restore off
    • On the Desktop, right click on the My Computer icon.
    • Click Properties.
    • Click the System Restore tab.
    • Check Turn off System Restore.
    • Click Apply, and then click OK.
    Restart
    • Turn System Restore on
    • On the Desktop, right click on the My Computer icon.
    • Click Properties.
    • Click the System Restore tab.
    • Uncheck *Turn off System Restore*.
    • Click Apply, and then click OK.
    Note: only do this once, and not on a regular basis
  1. Make sure that you keep your antivirus updated
    New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software
    Note: You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.
  2. Install and use a firewall with outbound protection
    While the firewall built into Windows XP is adequate to protect you from incoming attacks, it will not be much help in alerting you to programs already on your PC attempting to connect to remote servers
    I therefore strongly recommend that you install one of the following free firewalls: Comodo Firewallor Zonealarm
    See Bleepingcomputer's excellent tutorial to help using and understanding a firewall here
    Note: You should only have one firewall installed at a time. Having more than one firewall installed at once is likely to cause conflicts and may well decrease your overall protection as well as seriously impairing the performance of your PC.
  3. Make sure you install all the security updates for Windows, Internet explorer & Microsoft Office
    Whenever a security problem in its software is found, Microsoft will usually create a patch for it to that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC, so keeping up with these patches will help to prevent malicious software being installed on your PC
    Go here to check for & install updates to Microsoft applications
    Note: The update process uses activex, so you will need to use internet explorer for it, and allow the activex control that it wants to install
  4. Keep your non-Microsoft applications updated as well
    Microsoft isn't the only company whose products can contain security vulnerabilities, to check for other vulnerable programs running on your PC that are in need of an update, you can use the Secunia Software Inspector - I suggest that you run it at least once a month
  5. Make Internet Explorer more secure
    Click Start > Run
    Type Inetcpl.cpl & click OK
    Click on the Security tab
    Click Reset all zones to default level
    Make sure the Internet Zone is selected & Click Custom level
    In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  6. Install SpywareBlaster & make sure to update it regularly
    SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
    If you don't know what activex controls are, see here
    You can download SpywareBlaster from here
  7. Install and use Spybot Search & Destroy
    Instructions are located here
    Make sure you update, reimmunize & scan regularly
  8. Make use of the HOSTS file included with Spybot Search & Destroy
    Every version of windows includes a hosts file as part of them. A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
    Spybot Search & Destroy has a good HOSTS file built in, to enable the HOSTS file in Spybot Search & Destroy
    • Run Spybot Search & Destroy
    • Click on Mode, and then place a tick next to Advanced mode
    • Click Yes
    • In the left hand pane of Spybot Search & Destroy, click on Tools, and then on Hosts File
    • Click on Add Spybot-S&D hosts list
    Note: On some PCs, having a custom HOSTS file installed can cause a significant slowdown. Following these instructions should resolve the issue
    • Click Start > Run
    • Type services.msc & click OK
    • In the list, find the service called DNS Client & double click on it.
    • On the dropdown box, change the setting from automatic to manual.
    • Click OK & then close the Services window
    For a more detailed explanation of the HOSTS file, click here
  9. Install a-squared Free & update and scan with it regularly
    a-squared free is a product from Emsi Software provided free for private use that can detect and remove a variety of malicious software. You can get it here
    Note: If you have a dialup internet connection, you may also like to install a-squared Anti-Dialer which provides some real time protection against premium rate dialers
  10. Finally I am trying to make one point very clear. It is absolutely essential to keep all of your security programs up to date
User avatar
random/random
Developer
Developer
 
Posts: 7733
Joined: December 18th, 2005, 3:30 pm

Re: Help!!...... Pop-Ups

Unread postby 'KotaGuy » December 14th, 2007, 10:01 am

This topic is now closed. If you wish it to be reopened, please send an email to 'admin at malwareremoval.com' with a link to your thread.

If it has been 10 days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, this topic will not be reopened. If you still require help, please start a new topic and include a fresh HijackThis log and a link to this thread in your new topic.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
User avatar
'KotaGuy
Admin/Teacher Emeritus
 
Posts: 12472
Joined: April 7th, 2005, 7:06 pm
Location: Alberta, Canada
Advertisement
Register to Remove


Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 381 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware