« previous next »
Pages: [1]

Author Topic: Problem with a worm or two?  (Read 5141 times)

Offline doxarap

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Problem with a worm or two?
« on: September 19, 2007, 05:52:11 AM »
Here's my hijackthis-log - would really appreciate if you could help me detect and destroy the possible worms:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:23, on 19.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\AvidSDMService.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Programfiler\CA\eTrust Antivirus\InoRpc.exe
C:\Programfiler\CA\eTrust Antivirus\InoRT.exe
C:\Programfiler\CA\eTrust Antivirus\InoTask.exe
C:\Programfiler\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programfiler\Home Cinema\PowerCinema\PCMService.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programfiler\Logitech\Video\LogiTray.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Programfiler\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Programfiler\Logitech\Video\FxSvr2.exe
C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.no/0SENBNO/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.no/0SENBNO/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.online.no/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.no/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.no/0SENBNO/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O1 - Hosts: 17.250.248.77 idisk0.mac.com idisk1.mac.com idisk2.mac.com idisk3.mac.com idisk4.mac.com idisk5.mac.com idisk6.mac.com idisk7.mac.com idisk8.mac.com idisk9.mac.com idisk10.mac.com idisk11.mac.com idisk12.mac.com idisk13.mac.com idisk14.mac.com idisk15.mac.com idisk16.mac.com idisk17.mac.com idisk18.mac.com idisk19.mac.com idisk20.mac.com idisk21.mac.com idisk22.mac.com idisk23.mac.com idisk24.mac.com idisk25.mac.com
O1 - Hosts: om
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Toolbar Suite\TB2.05.0000.1105\nb-no\msntb.dll
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Programfiler\ISTbar\istbarcm.dll (file missing)
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Toolbar Suite\TB2.05.0000.1105\nb-no\msntb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programfiler\Fellesfiler\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programfiler\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programfiler\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programfiler\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [StartFoxie] C:\Programfiler\Foxie Suite\StartFoxie.exe
O4 - HKLM\..\Run: [iHP-100] C:\Programfiler\iRiver\HSeries\iHPDetect.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\RunOnce: [AskTBar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -2
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programfiler\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programfiler\Fellesfiler\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Programfiler\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: PC-søk i Windows.lnk = C:\Programfiler\MSN Toolbar Suite\DS2.05.0001.1119\nb-no\bin\WindowsSearch.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: &MSN Search - res://C:\Programfiler\MSN Toolbar Suite\TB2.05.0000.1105\nb-no\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ã…pne i ny bakgrunnsflik - res://C:\Programfiler\MSN Toolbar Suite\TAB2.05.0000.1105\nb-no\msntabres.dll/229?d8bc0ce45e234ae4b495c511db33855f
O8 - Extra context menu item: Ã…pne i ny forgrunnsflik - res://C:\Programfiler\MSN Toolbar Suite\TAB2.05.0000.1105\nb-no\msntabres.dll/230?d8bc0ce45e234ae4b495c511db33855f
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.online.no/
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php...992be6d71d48cd1
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...up1.0.0.8-2.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {5C4EB11A-2078-432E-92FE-0CB2ACD6D071} (m2wFTPClient.M2WFTPControl) - http://webmail.nameplanet.com/mail/FTP/m2wFTPClient.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1137767127453
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_cracks.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe
O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Programfiler\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Programfiler\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programfiler\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programfiler\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programfiler\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Programfiler\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: NBService - Nero AG - C:\Programfiler\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 10491 bytes


Thanx alot!!!!!
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Problem with a worm or two?
« Reply #1 on: September 19, 2007, 07:42:44 AM »
Can I see the following please
supply an uninstall list from Hijackthis
Open Hijackthis>>Open MISC TOOLS SECTION>>Open UNINSTALL MANAGER
Click the SAVE LIST... button
Save the list to your desktop then copy>>Paste back here the Whole contents
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline doxarap

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Problem with a worm or two?
« Reply #2 on: September 19, 2007, 09:09:02 AM »
Hey and thanx: here's my uninstall-list:

Adobe Illustrator 10
Adobe Photoshop CS
Adobe Reader 7.0.7 - Norsk
Adobe SVG Viewer 3.0
ATI - Avinstalleringsverktøy for Programvaren
ATI Control Panel
ATI Display Driver
Avid Xpress Pro
AVS Disc Creator version 2.1
AVS Video Converter 3.6.3.249
AVS Video Tools 5.2
BitSpirit v2.7.0.112 Final Release
CA eTrust Antivirus
Canon MP Drivers 6.0
Canon MP Navigator 1.1
Canon ScanGear Starter
Canon ScanGear Toolbox CS 2.2
Canon Utilities Easy-PhotoPrint
C-Dilla Licence Management System
CD-LabelPrint
C-Media WDM Audio Driver
Creatix V.9X DSP Data Fax Modem
Drivrutiner for Logitech® Camera
DVD-lab Studio 1.25
eTrust Antivirus Registration
GPS Image Tracker
HighMAT-tillegg til CD-brenningsveiviser for Microsoft Windows XP
HijackThis 2.0.2
Home Cinema
Java 2 Runtime Environment Standard Edition v1.3.0_02
Logitech Desktop Messenger
Logitech QuickCam
Logitech VideoCall
Macromedia Extension Manager
Macromedia Flash Player 8
Macromedia Shockwave Player
Medion Flash XL 2.0
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 1.1 Norwegian Language Pack
Microsoft Data Access Components KB870669
Microsoft Office Professional Edition 2003
Microsoft Windows Journal Viewer
Microsoft Works 7.0
MSN Search Toolbar
MSXML 4.0 SP2 (KB936181)
Nero 7
neroxml
Netscape Browser (remove only)
Oppdatering for Windows XP (KB894391)
Oppdatering for Windows XP (KB896727)
Oppdatering for Windows XP (KB898461)
Oppdatering for Windows XP (KB900485)
Oppdatering for Windows XP (KB910437)
Oppdatering for Windows XP (KB911280)
Oppdatering for Windows XP (KB916595)
Oppdatering for Windows XP (KB920872)
Oppdatering for Windows XP (KB922582)
Oppdatering for Windows XP (KB927891)
Oppdatering for Windows XP (KB930916)
Oppdatering for Windows XP (KB931836)
Oppdatering for Windows XP (KB933360)
Oppdatering for Windows XP (KB938828)
Pen Tablet
Pinnacle Hollywood FX for Studio
PowerCinema 2.0
PowerDVD
PowerProducer
QuickTime
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
SEMC DSS-20 SyncStation Driver
Sentinel System Driver 5.42.1 (32-bit)
Sikkerhetsoppdatering for Windows Media Player (KB911564)
Sikkerhetsoppdatering for Windows Media Player 10 (KB911565)
Sikkerhetsoppdatering for Windows Media Player 10 (KB917734)
Sikkerhetsoppdatering for Windows Media Player 10 (KB936782)
Sikkerhetsoppdatering for Windows Media Player 6.4 (KB925398)
Sikkerhetsoppdatering for Windows XP (KB883939)
Sikkerhetsoppdatering for Windows XP (KB890046)
Sikkerhetsoppdatering for Windows XP (KB893756)
Sikkerhetsoppdatering for Windows XP (KB896358)
Sikkerhetsoppdatering for Windows XP (KB896422)
Sikkerhetsoppdatering for Windows XP (KB896423)
Sikkerhetsoppdatering for Windows XP (KB896424)
Sikkerhetsoppdatering for Windows XP (KB896428)
Sikkerhetsoppdatering for Windows XP (KB896688)
Sikkerhetsoppdatering for Windows XP (KB899587)
Sikkerhetsoppdatering for Windows XP (KB899588)
Sikkerhetsoppdatering for Windows XP (KB899591)
Sikkerhetsoppdatering for Windows XP (KB900725)
Sikkerhetsoppdatering for Windows XP (KB901017)
Sikkerhetsoppdatering for Windows XP (KB901190)
Sikkerhetsoppdatering for Windows XP (KB901214)
Sikkerhetsoppdatering for Windows XP (KB902400)
Sikkerhetsoppdatering for Windows XP (KB903235)
Sikkerhetsoppdatering for Windows XP (KB904706)
Sikkerhetsoppdatering for Windows XP (KB905414)
Sikkerhetsoppdatering for Windows XP (KB905749)
Sikkerhetsoppdatering for Windows XP (KB905915)
Sikkerhetsoppdatering for Windows XP (KB908519)
Sikkerhetsoppdatering for Windows XP (KB908531)
Sikkerhetsoppdatering for Windows XP (KB911562)
Sikkerhetsoppdatering for Windows XP (KB911567)
Sikkerhetsoppdatering for Windows XP (KB911927)
Sikkerhetsoppdatering for Windows XP (KB912812)
Sikkerhetsoppdatering for Windows XP (KB912919)
Sikkerhetsoppdatering for Windows XP (KB913446)
Sikkerhetsoppdatering for Windows XP (KB913580)
Sikkerhetsoppdatering for Windows XP (KB914388)
Sikkerhetsoppdatering for Windows XP (KB914389)
Sikkerhetsoppdatering for Windows XP (KB916281)
Sikkerhetsoppdatering for Windows XP (KB917159)
Sikkerhetsoppdatering for Windows XP (KB917344)
Sikkerhetsoppdatering for Windows XP (KB917422)
Sikkerhetsoppdatering for Windows XP (KB917953)
Sikkerhetsoppdatering for Windows XP (KB918118)
Sikkerhetsoppdatering for Windows XP (KB918439)
Sikkerhetsoppdatering for Windows XP (KB918899)
Sikkerhetsoppdatering for Windows XP (KB919007)
Sikkerhetsoppdatering for Windows XP (KB920213)
Sikkerhetsoppdatering for Windows XP (KB920214)
Sikkerhetsoppdatering for Windows XP (KB920670)
Sikkerhetsoppdatering for Windows XP (KB920683)
Sikkerhetsoppdatering for Windows XP (KB920685)
Sikkerhetsoppdatering for Windows XP (KB921398)
Sikkerhetsoppdatering for Windows XP (KB921503)
Sikkerhetsoppdatering for Windows XP (KB921883)
Sikkerhetsoppdatering for Windows XP (KB922616)
Sikkerhetsoppdatering for Windows XP (KB922819)
Sikkerhetsoppdatering for Windows XP (KB923191)
Sikkerhetsoppdatering for Windows XP (KB923414)
Sikkerhetsoppdatering for Windows XP (KB923689)
Sikkerhetsoppdatering for Windows XP (KB923980)
Sikkerhetsoppdatering for Windows XP (KB924270)
Sikkerhetsoppdatering for Windows XP (KB924496)
Sikkerhetsoppdatering for Windows XP (KB924667)
Sikkerhetsoppdatering for Windows XP (KB925902)
Sikkerhetsoppdatering for Windows XP (KB926255)
Sikkerhetsoppdatering for Windows XP (KB926436)
Sikkerhetsoppdatering for Windows XP (KB927779)
Sikkerhetsoppdatering for Windows XP (KB927802)
Sikkerhetsoppdatering for Windows XP (KB928255)
Sikkerhetsoppdatering for Windows XP (KB928843)
Sikkerhetsoppdatering for Windows XP (KB929123)
Sikkerhetsoppdatering for Windows XP (KB930178)
Sikkerhetsoppdatering for Windows XP (KB931261)
Sikkerhetsoppdatering for Windows XP (KB931784)
Sikkerhetsoppdatering for Windows XP (KB932168)
Sikkerhetsoppdatering for Windows XP (KB935839)
Sikkerhetsoppdatering for Windows XP (KB935840)
Sikkerhetsoppdatering for Windows XP (KB936021)
Sikkerhetsoppdatering for Windows XP (KB937143)
Sikkerhetsoppdatering for Windows XP (KB938127)
Sikkerhetsoppdatering for Windows XP (KB938829)
SlotchBar
SmartSound Quicktracks Plugin
Sonic UDF Reader
Sony Picture Utility
Sony USB Driver
Studio 9
USB Wireless Keyboard Driver
Windows Backup Utility
Windows Genuine Advantage Notifications
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format Runtime
Windows Media Player 10
Windows XP hurtigreparasjon - KB834707
Windows XP hurtigreparasjon - KB867282
Windows XP hurtigreparasjon - KB873333
Windows XP hurtigreparasjon - KB873339
Windows XP hurtigreparasjon - KB885250
Windows XP hurtigreparasjon - KB885835
Windows XP hurtigreparasjon - KB885836
Windows XP hurtigreparasjon - KB886185
Windows XP hurtigreparasjon - KB887472
Windows XP hurtigreparasjon - KB887742
Windows XP hurtigreparasjon - KB888113
Windows XP hurtigreparasjon - KB888302
Windows XP hurtigreparasjon - KB890047
Windows XP hurtigreparasjon - KB890175
Windows XP hurtigreparasjon - KB890859
Windows XP hurtigreparasjon - KB890923
Windows XP hurtigreparasjon - KB891781
Windows XP hurtigreparasjon - KB893066
Windows XP hurtigreparasjon - KB893086
Windows XP Service Pack 2
WinRAR archiver
WinZip
X10 Hardware(tm)



[quote name=\'guestolo\' post=\'389508\' date=\'Sep 19 2007, 12:42 PM\']Can I see the following please
supply an uninstall list from Hijackthis
Open Hijackthis>>Open MISC TOOLS SECTION>>Open UNINSTALL MANAGER
Click the SAVE LIST... button
Save the list to your desktop then copy>>Paste back here the Whole contents[/quote]
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Problem with a worm or two?
« Reply #3 on: September 19, 2007, 08:56:23 PM »
Close down all browser windows
Access your add/remove programs and remove the following

Java 2 Runtime Environment Standard Edition v1.3.0_02
It's outdated and very open for malware to infect you
Do not restart the computer if prompted

Remain in add/remove and remove the following if you can
SlotchBar

Reboot the computer after any of the following above are removed

Back in Windows
  • Download the latest version of  Java Runtime Environment (JRE) 6u2.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6u2, The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement[/i]".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation, Multi-language  and save it to your desktop (13.90 MB).
Install the latest version of Java from the installer on the desktop>>Allow internet connection

You don't have any Antispyware software on your computer
Can you do the following
Download and save to desktop Spybot Search and Destroy 1.5.1.15
from here
http://fileforum.betanews.com/detail/Spybo...oy/1043809773/1

Install>>
TAKE NOTE: When installing deselect to install TEA TIMER
ALLOW to search for updates and then
Check, and then download all updates (Or right click the results pane and SELECT ALL)
Ensure all updates are successful, a GREEN check will indicate this

Click the "Search & Destroy" button on the left
"Check for Problems"---When the Scan is complete
FIX all selected promblems in RED

RESTART the computer to finish any cleaning process

Back in Windows, come back here and post a fresh hijackthis log and let me know how things are running
Please
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline doxarap

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Problem with a worm or two?
« Reply #4 on: September 21, 2007, 08:49:31 AM »
Done it!! Thanx....
hijacklog:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:42:53, on 21.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\AvidSDMService.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Programfiler\CA\eTrust Antivirus\InoRpc.exe
C:\Programfiler\CA\eTrust Antivirus\InoRT.exe
C:\Programfiler\CA\eTrust Antivirus\InoTask.exe
C:\Programfiler\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programfiler\Home Cinema\PowerCinema\PCMService.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programfiler\Logitech\Video\LogiTray.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programfiler\MSN Messenger\msnmsgr.exe
C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Programfiler\Logitech\Video\FxSvr2.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.no/0SENBNO/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.no/0SENBNO/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.online.no/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.no/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.no/0SENBNO/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O1 - Hosts: 17.250.248.77 idisk0.mac.com idisk1.mac.com idisk2.mac.com idisk3.mac.com idisk4.mac.com idisk5.mac.com idisk6.mac.com idisk7.mac.com idisk8.mac.com idisk9.mac.com idisk10.mac.com idisk11.mac.com idisk12.mac.com idisk13.mac.com idisk14.mac.com idisk15.mac.com idisk16.mac.com idisk17.mac.com idisk18.mac.com idisk19.mac.com idisk20.mac.com idisk21.mac.com idisk22.mac.com idisk23.mac.com idisk24.mac.com idisk25.mac.com
O1 - Hosts: om
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Toolbar Suite\TB2.05.0000.1105\nb-no\msntb.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Toolbar Suite\TB2.05.0000.1105\nb-no\msntb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programfiler\Fellesfiler\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programfiler\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programfiler\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programfiler\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [StartFoxie] C:\Programfiler\Foxie Suite\StartFoxie.exe
O4 - HKLM\..\Run: [iHP-100] C:\Programfiler\iRiver\HSeries\iHPDetect.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programfiler\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programfiler\Fellesfiler\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Programfiler\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: PC-søk i Windows.lnk = C:\Programfiler\MSN Toolbar Suite\DS2.05.0001.1119\nb-no\bin\WindowsSearch.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: &MSN Search - res://C:\Programfiler\MSN Toolbar Suite\TB2.05.0000.1105\nb-no\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ã…pne i ny bakgrunnsflik - res://C:\Programfiler\MSN Toolbar Suite\TAB2.05.0000.1105\nb-no\msntabres.dll/229?d8bc0ce45e234ae4b495c511db33855f
O8 - Extra context menu item: Ã…pne i ny forgrunnsflik - res://C:\Programfiler\MSN Toolbar Suite\TAB2.05.0000.1105\nb-no\msntabres.dll/230?d8bc0ce45e234ae4b495c511db33855f
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.online.no/
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {5C4EB11A-2078-432E-92FE-0CB2ACD6D071} (m2wFTPClient.M2WFTPControl) - http://webmail.nameplanet.com/mail/FTP/m2wFTPClient.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1137767127453
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe
O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Programfiler\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Programfiler\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programfiler\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programfiler\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programfiler\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Programfiler\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: NBService - Nero AG - C:\Programfiler\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 10355 bytes


[quote name=\'guestolo\' post=\'389741\' date=\'Sep 20 2007, 01:56 AM\']Close down all browser windows
Access your add/remove programs and remove the following

Java 2 Runtime Environment Standard Edition v1.3.0_02
It's outdated and very open for malware to infect you
Do not restart the computer if prompted

Remain in add/remove and remove the following if you can
SlotchBar

Reboot the computer after any of the following above are removed

Back in Windows
  • Download the latest version of Java Runtime Environment (JRE) 6u2.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6u2, The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement[/i]".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation, Multi-language and save it to your desktop (13.90 MB).
Install the latest version of Java from the installer on the desktop>>Allow internet connection

You don't have any Antispyware software on your computer
Can you do the following
Download and save to desktop Spybot Search and Destroy 1.5.1.15
from here
http://fileforum.betanews.com/detail/Spybo...oy/1043809773/1

Install>>
TAKE NOTE: When installing deselect to install TEA TIMER
ALLOW to search for updates and then
Check, and then download all updates (Or right click the results pane and SELECT ALL)
Ensure all updates are successful, a GREEN check will indicate this

Click the "Search & Destroy" button on the left
"Check for Problems"---When the Scan is complete
FIX all selected promblems in RED

RESTART the computer to finish any cleaning process

Back in Windows, come back here and post a fresh hijackthis log and let me know how things are running
Please[/quote]
« Last Edit: September 21, 2007, 08:50:43 AM by doxarap »
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Problem with a worm or two?
« Reply #5 on: September 21, 2007, 09:14:50 AM »
I'm just on my way to work, in the meantime can you post one more log

Open Hijackthis>>Open Misc tools section>>Open Hosts file manager
Click the "Open in Notepad" button
A log will open in notepad, can you copy>>paste back here the whole contents please
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline doxarap

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Problem with a worm or two?
« Reply #6 on: September 21, 2007, 09:27:51 AM »
Great! I am heading off for the weekend, so I be back Monday. Thanks alot for all your help!!andreas:# Copyright © 1993-1999 Microsoft Corporation## Dette er en eksempel pÃ¥ en HOSTS-fil som brukes av Microsoft TCP/IP for Windows.## Denne filen inneholder tilordninger av IP-adresser til vertsnavn. Alle# oppføringer mÃ¥ være pÃ¥ hver sin linje. IP-adressen plasseres i den# første kolonnen, etterfulgt av det tilsvarende vertsnavnet. IP-adressen# og vertsnavnet mÃ¥ være adskilt av minst ett mellomrom.## I tillegg kan kommentarer (som denne) settes inn pÃ¥ egne linjer, eller# etter maskinnavnet, anført med et nummertegn ("#")## Eksempel:##      102.54.94.97     rhino.acme.com          # kildeserver#       38.25.63.10     x.acme.com              # x-klientvert127.0.0.1       localhost17.250.248.77 idisk0.mac.com idisk1.mac.com idisk2.mac.com idisk3.mac.com idisk4.mac.com idisk5.mac.com idisk6.mac.com idisk7.mac.com idisk8.mac.com idisk9.mac.com idisk10.mac.com idisk11.mac.com idisk12.mac.com idisk13.mac.com idisk14.mac.com idisk15.mac.com idisk16.mac.com idisk17.mac.com idisk18.mac.com idisk19.mac.com idisk20.mac.com idisk21.mac.com idisk22.mac.com idisk23.mac.com idisk24.mac.com idisk25.mac.comom# Start of entries inserted by Spybot - Search & Destroy127.0.0.1 babe.the-killer.bz127.0.0.1 www.babe.the-killer.bz127.0.0.1 babe.k-lined.com127.0.0.1 www.babe.k-lined.com127.0.0.1 did.i-used.cc127.0.0.1 www.did.i-used.cc127.0.0.1 coolwwwsearch.com127.0.0.1 www.coolwwwsearch.com127.0.0.1 coolwebsearch.com127.0.0.1 www.coolwebsearch.com127.0.0.1 hi.studioaperto.net127.0.0.1 www.hi.studioaperto.net127.0.0.1 wazzupnet.com127.0.0.1 www.wazzupnet.com127.0.0.1 gueb.com127.0.0.1 www.gueb.com127.0.0.1 kabex.com127.0.0.1 www.kabex.com127.0.0.1 hityou.com127.0.0.1 www.hityou.com127.0.0.1 miosearch.com127.0.0.1 www.miosearch.com127.0.0.1 blue-elefant.com127.0.0.1 www.blue-elefant.com127.0.0.1 babeweb.de127.0.0.1 www.babeweb.de127.0.0.1 start-seite.com127.0.0.1 www.start-seite.com127.0.0.1 sexolymp.com127.0.0.1 www.sexolymp.com127.0.0.1 toriii.cc127.0.0.1 www.toriii.cc127.0.0.1 xtipp.de127.0.0.1 www.xtipp.de127.0.0.1 urawa.cool.ne.jp127.0.0.1 777search.com127.0.0.1 www.777search.com127.0.0.1 ace-webmaster.com127.0.0.1 www.ace-webmaster.com127.0.0.1 aifind.info127.0.0.1 www.aifind.info127.0.0.1 amateurliveshow.com127.0.0.1 www.amateurliveshow.com127.0.0.1 anarchylolita.com127.0.0.1 www.anarchylolita.com127.0.0.1 anarchyporn.com127.0.0.1 approvedlinks.com127.0.0.1 www.approvedlinks.com127.0.0.1 cantfind.com127.0.0.1 www.cantfind.com127.0.0.1 castingsamateur.com127.0.0.1 www.castingsamateur.com127.0.0.1 cyberrape.com127.0.0.1 www.cyberrape.com127.0.0.1 dialerclub.com127.0.0.1 www.dialerclub.com127.0.0.1 megago.com127.0.0.1 exit.megago.com127.0.0.1 www.megago.com127.0.0.1 fastmetasearch.com127.0.0.1 www.fastmetasearch.com127.0.0.1 findwhatevernow.com127.0.0.1 www.findwhatevernow.com127.0.0.1 globesearch.com127.0.0.1 www.globesearch.com127.0.0.1 hotfreebies.com127.0.0.1 www.hotfreebies.com127.0.0.1 krankin.com127.0.0.1 www.krankin.com127.0.0.1 begin2search.com127.0.0.1 www.begin2search.com127.0.0.1 mainstreamdollars.com127.0.0.1 www.mainstreamdollars.com127.0.0.1 live.sex-explorer.com127.0.0.1 www.live.sex-explorer.com127.0.0.1 loveadot.com127.0.0.1 www.loveadot.com127.0.0.1 megaseek.net127.0.0.1 www.megaseek.net127.0.0.1 mixsearch.com127.0.0.1 www.mixsearch.com127.0.0.1 munky.com127.0.0.1 www.munky.com127.0.0.1 newtopsites.com127.0.0.1 www.newtopsites.com127.0.0.1 noblindlinks.com127.0.0.1 www.noblindlinks.com127.0.0.1 babenet.com127.0.0.1 r.babenet.com127.0.0.1 www.babenet.com127.0.0.1 searchresult.net127.0.0.1 www.searchresult.net127.0.0.1 sexarena.org127.0.0.1 www.sexarena.org127.0.0.1 skeech.com127.0.0.1 www.skeech.com127.0.0.1 superwp.by.ru127.0.0.1 sureseeker.com127.0.0.1 www.sureseeker.com127.0.0.1 wethere.com127.0.0.1 www.wethere.com127.0.0.1 wowsearch.org127.0.0.1 www.wowsearch.org127.0.0.1 xxx.com127.0.0.1 www.xxx.com127.0.0.1 art-xxx.com127.0.0.1 websearch.com127.0.0.1 www.websearch.com127.0.0.1 firehunt.com127.0.0.1 www.firehunt.com127.0.0.1 partner23.firehunt.com127.0.0.1 screensaver.it127.0.0.1 www.screensaver.it127.0.0.1 cliks.org127.0.0.1 www.cliks.org127.0.0.1 xads.cliks.org127.0.0.1 xwebsearch.biz127.0.0.1 www.xwebsearch.biz127.0.0.1 znext.com127.0.0.1 www.znext.com127.0.0.1 rawtocash.net127.0.0.1 www.rawtocash.net127.0.0.1 7search.com127.0.0.1 www.7search.com127.0.0.1 zestyfind.com127.0.0.1 www.zestyfind.com127.0.0.1 ntcor.com127.0.0.1 www.ntcor.com127.0.0.1 dev.ntcor.com127.0.0.1 xrenoder.com127.0.0.1 www.xrenoder.com127.0.0.1 search.xrenoder.com127.0.0.1 allcybersearch.com127.0.0.1 www.allcybersearch.com127.0.0.1 tinybar.com127.0.0.1 www.tinybar.com127.0.0.1 topsite.us127.0.0.1 www.topsite.us127.0.0.1 topsites.us127.0.0.1 www.topsites.us127.0.0.1 topsitez.us127.0.0.1 www.topsitez.us127.0.0.1 true-counter.com127.0.0.1 www.true-counter.com127.0.0.1 out.true-counter.com127.0.0.1 cnetadd.com127.0.0.1 www.cnetadd.com127.0.0.1 okmmm.com127.0.0.1 www.okmmm.com127.0.0.1 139mm.com127.0.0.1 www.139mm.com127.0.0.1 008k.com127.0.0.1 www.008k.com127.0.0.1 00hq.com127.0.0.1 www.00hq.com127.0.0.1 1-domains-registrations.com127.0.0.1 www.1-domains-registrations.com127.0.0.1 100sexlinks.com127.0.0.1 www.100sexlinks.com127.0.0.1 1sexparty.com127.0.0.1 www.1sexparty.com127.0.0.1 1stpagehere.com127.0.0.1 www.1stpagehere.com127.0.0.1 2020search.com127.0.0.1 www.2020search.com127.0.0.1 24teen.com127.0.0.1 www.24teen.com127.0.0.1 36site.com127.0.0.1 www.36site.com127.0.0.1 4corn.net127.0.0.1 www.4corn.net127.0.0.1 777top.com127.0.0.1 www.777top.com127.0.0.1 8ad.com127.0.0.1 www.8ad.com127.0.0.1 aboutclicker.com127.0.0.1 www.aboutclicker.com127.0.0.1 abrp.net127.0.0.1 www.abrp.net127.0.0.1 accessthefuture.net127.0.0.1 www.accessthefuture.net127.0.0.1 acemedic.com127.0.0.1 www.acemedic.com127.0.0.1 actionbreastcancer.org127.0.0.1 www.actionbreastcancer.org127.0.0.1 activexupdate.com127.0.0.1 www.activexupdate.com127.0.0.1 adamsupportgroup.org127.0.0.1 www.adamsupportgroup.org127.0.0.1 adasearch.com127.0.0.1 www.adasearch.com127.0.0.1 adipics.com127.0.0.1 www.adipics.com127.0.0.1 adspics.com127.0.0.1 www.adspics.com127.0.0.1 adult-engine-search.com127.0.0.1 www.adult-engine-search.com127.0.0.1 adult-erotic-guide.net127.0.0.1 www.adult-erotic-guide.net127.0.0.1 adult-friends-finder.net127.0.0.1 www.adult-friends-finder.net127.0.0.1 adulthyperlinks.com127.0.0.1 www.adulthyperlinks.com127.0.0.1 adulttds.com127.0.0.1 www.adulttds.com127.0.0.1 exaccess.ru127.0.0.1 www.exaccess.ru127.0.0.1 advert.exaccess.ru127.0.0.1 agentstudio.com127.0.0.1 africaspromise.org127.0.0.1 akril.com127.0.0.1 alcatel.ws127.0.0.1 alfa-search.com127.0.0.1 all-inet.com127.0.0.1 allabtcars.com127.0.0.1 allabtjeeps.com127.0.0.1 allhyperlinks.com127.0.0.1 allinternetbusiness.com127.0.0.1 almarvideos.com127.0.0.1 amandamountains.com127.0.0.1 amigeek.com127.0.0.1 amisbusiness.com127.0.0.1 analmovi.com127.0.0.1 anin.org127.0.0.1 annaromeo.com127.0.0.1 antrocity.com127.0.0.1 anything4health.com127.0.0.1 apsua.com127.0.0.1 aregay.com127.0.0.1 arheo.com127.0.0.1 arizonaweb.org127.0.0.1 armitageinn.com127.0.0.1 art-func.com127.0.0.1 artachnid.com127.0.0.1 asiankingkong.com127.0.0.1 ass-gals.com127.0.0.1 athenrye.com127.0.0.1 avian-ads.com127.0.0.1 ayakawamura.com127.0.0.1 ayumitaniguchi.com127.0.0.1 bannedhost.net127.0.0.1 barbudafarms.com127.0.0.1 barnandfence.com127.0.0.1 batsearch.com127.0.0.1 baygraphicsllc.com127.0.0.1 bb-search.com127.0.0.1 bbbsearch.com127.0.0.1 bedhome.com127.0.0.1 bediadance.com127.0.0.1 bellabasketsfl.com127.0.0.1 bernaolatwin.com127.0.0.1 best-counter.com127.0.0.1 best-hardpics.com127.0.0.1 best-winning-casino.com127.0.0.1 bestcrawler.com127.0.0.1 bestfor.ru127.0.0.1 bestporngate.com127.0.0.1 bestxporno.com127.0.0.1 blackjack-free.net127.0.0.1 blender.xu.pl127.0.0.1 bodaciousbabette.com127.0.0.1 boobdoll.com127.0.0.1 boobsandtits.com127.0.0.1 boobsclub.com127.0.0.1 boredlife.com127.0.0.1 bowlofogumbo.com127.0.0.1 bradcoem.org127.0.0.1 brandiyoung.com127.0.0.1 brookeburn.com127.0.0.1 bucps.com127.0.0.1 burgerkingbigscreen.com127.0.0.1 buscards.net127.0.0.1 bustyrussell.com127.0.0.1 buttejazz.org127.0.0.1 buyselldomain.net127.0.0.1 calcioturris.com127.0.0.1 canberracricketcoaching.com127.0.0.1 candycantaloupes.com127.0.0.1 careers.dulcineasystems.net127.0.0.1 carsands.com127.0.0.1 carsrentals.net127.0.0.1 casino-gambling-1.net127.0.0.1 casino-gambling-2.net127.0.0.1 casino-onlines.net127.0.0.1 casino.com.free.game.pogo.gratisdownloads.nl127.0.0.1 casino2win.net127.0.0.1 casinomidas.net127.0.0.1 casinonline.net127.0.0.1 catallogue.com127.0.0.1 catsss.da.ru127.0.0.1 caxa.ru127.0.0.1 cclebali.org127.0.0.1 ceewawires.org127.0.0.1 certumgroup.com127.0.0.1 chelancatering.com127.0.0.1 childrenvilla.com127.0.0.1 chips-4-free.com127.0.0.1 chrisswasey.com127.0.0.1 chriswallace.net127.0.0.1 ckick4thumbs.com127.0.0.1 clackamasliteraryreview.com127.0.0.1 clearsearch.cc127.0.0.1 clearsearch.net127.0.0.1 clickaire.com127.0.0.1 clickyestoenter.net127.0.0.1 clrsch.com127.0.0.1 cmtapestry.com127.0.0.1 cool-homepage.co127.0.0.1 cool-homepage.com127.0.0.1 cool-search.net127.0.0.1 cool-search.netfartpost.com127.0.0.1 cool-web-search.com127.0.0.1 coolfetishsite.com127.0.0.1 coolfreehost.com127.0.0.1 coolfreepage.com127.0.0.1 coolfreepages.com127.0.0.1 coolmoneysearch.com127.0.0.1 coolpornsearch.com127.0.0.1 coolsearcher.info127.0.0.1 coolwebsearsh.com127.0.0.1 copmtraine.com127.0.0.1 couldnotfind.com127.0.0.1 count-all.com127.0.0.1 cracks.me.uk127.0.0.1 creamedcutties.com127.0.0.1 creditsearchonline.com127.0.0.1 crestring.com127.0.0.1 crooder.com127.0.0.1 curvedspaces.com127.0.0.1 cvs.jps.ru127.0.0.1 cvsymphony.com127.0.0.1 cydom.com127.0.0.1 daily-gals.com127.0.0.1 dancingbabycd.com127.0.0.1 datanotary.com127.0.0.1 datareco.com127.0.0.1 davemarshall.org127.0.0.1 dcfitusa.com127.0.0.1 defaultsearch.net127.0.0.1 desarrollocreativo.com127.0.0.1 develip.com127.0.0.1 dewis.spb.ru127.0.0.1 dewis.us127.0.0.1 df809jow4wj2304lfd0sf9fsd0a2t4ldf809jow4wj2304lfd0sf9fsd0a2t4ld.biz127.0.0.1 dietpills4free.com127.0.0.1 dietpussy.com127.0.0.1 digistreamsa.com127.0.0.1 dionforvalleycouncil.org127.0.0.1 doctorwaldron.com127.0.0.1 document-not-found.pornpic.org127.0.0.1 doggyaction.com127.0.0.1 domain-your-registration.com127.0.0.1 domains-for-you-online.com127.0.0.1 domains2003.net127.0.0.1 domkrat.com127.0.0.1 dp-host.com127.0.0.1 dragqueen.gay-clan.com127.0.0.1 drug-sources-exposed.com127.0.0.1 drvvv.com127.0.0.1 dutch-sex.com127.0.0.1 dvdbank.org127.0.0.1 e-localad.com127.0.0.1 e-plus.cc127.0.0.1 e-websitesolutions.com127.0.0.1 eases.net127.0.0.1 easy-search.net127.0.0.1 easycategories.com127.0.0.1 ecosrioplatenses.org127.0.0.1 ecstasyporn.net127.0.0.1 eikokoike.com127.0.0.1 epornsex.com127.0.0.1 euuu.com127.0.0.1 evidence-detector.biz127.0.0.1 evilspidercomics.com127.0.0.1 ewebsearch.net127.0.0.1 findloss.com127.0.0.1 excellentsckin.com127.0.0.1 extremeseek.net127.0.0.1 faithstevens.com127.0.0.1 fantasiewelten.com127.0.0.1 farmsteadbandb.com127.0.0.1 fartpost.com127.0.0.1 fastwebfinder.com127.0.0.1 faxporn.com127.0.0.1 fickenisgeil.de127.0.0.1 finance-loans.com127.0.0.1 find-itnow.com127.0.0.1 find-uk-health.co.uk127.0.0.1 find4u.net127.0.0.1 findit-now.com127.0.0.1 findthesite.com127.0.0.1 findthewebsiteyouneed.com127.0.0.1 www.findthewebsiteyouneed.com127.0.0.1 fionasteel.com127.0.0.1 firstbookmark.net127.0.0.1 fitness-free.com127.0.0.1 foodvacations.net127.0.0.1 forex.jps.ru127.0.0.1 forexcredit.com127.0.0.1 forexcredit.ru127.0.0.1 formingfusions.com127.0.0.1 forsythfire.net127.0.0.1 forthline.com127.0.0.1 free-chipes.com127.0.0.1 free-hit.com127.0.0.1 free-pics-and-movies.com127.0.0.1 free-sex-movie-clips.net127.0.0.1 free4porno.net127.0.0.1 free64all.com127.0.0.1 freebookmark.net127.0.0.1 freebookmarks.net127.0.0.1 freecategories.com127.0.0.1 freecoolhost.com127.0.0.1 freerbhost.com127.0.0.1 freeshemalepics.net127.0.0.1 freeyaho.com127.0.0.1 freshseek.com127.0.0.1 freshteensite.com127.0.0.1 gabrielscott.com127.0.0.1 galpostgirls.com127.0.0.1 gals-for-free.com127.0.0.1 gambling-online4you.com127.0.0.1 gameterror.net127.0.0.1 gay50.com127.0.0.1 generalsmeltingofcanada.com127.0.0.1 geteens.com127.0.0.1 getpicshere.com127.0.0.1 gimmezamore.com127.0.0.1 gimnasiaer.com127.0.0.1 girls-porn-life.com127.0.0.1 glbdf.org127.0.0.1 global-finder.com127.0.0.1 globe-finder.cc127.0.0.1 globe-finder.com127.0.0.1 gocybersearch.com127.0.0.1 golftennis.net127.0.0.1 good-mortgages-calculator.com127.0.0.1 good-mortgages.net127.0.0.1 goodsexs.com127.0.0.1 googlebar.jps.ru127.0.0.1 googlf.com127.0.0.1 gradforum.org127.0.0.1 gratis-porn-movie.com127.0.0.1 gratis-pornopics.com127.0.0.1 guzzycats.com127.0.0.1 gzphoenix.com127.0.0.1 hallnetaccolade.com127.0.0.1 hand-book.com127.0.0.1 happyanal.com127.0.0.1 hard-gals.com127.0.0.1 hardbodytgp.com127.0.0.1 hardcoreover.com127.0.0.1 hardloved.com127.0.0.1 hardwareseek.net127.0.0.1 harukaigawa.com127.0.0.1 hccsolanonapa.org127.0.0.1 health-protein.com127.0.0.1 hentai4u.net127.0.0.1 here4search.com127.0.0.1 heyrichy.com127.0.0.1 hi-search.com127.0.0.1 hiddenguides.com127.0.0.1 hitlistlyrics.com127.0.0.1 holidayautostr.com127.0.0.1 homemortage.ws127.0.0.1 hostssp.com127.0.0.1 hot-cartoon-sex.anime.american-teens.net127.0.0.1 hotbookmark.com127.0.0.1 hotels-list.net127.0.0.1 hotelxxxcams.com127.0.0.1 hotpopup.com127.0.0.1 hotsearchbox.com127.0.0.1 hotsex-series.com127.0.0.1 hotstartpage.com127.0.0.1 hqsex.biz127.0.0.1 hugeporn4u.net127.0.0.1 hunacsa.com127.0.0.1 hupacasath.com127.0.0.1 hzsx.com127.0.0.1 icansearch.net127.0.0.1 idgsearch.com127.0.0.1 ie-search.com127.0.0.1 incestporngate.com127.0.0.1 infodigger.net127.0.0.1 infoglobus.com127.0.0.1 inherhole.com127.0.0.1 insertthiscock.com127.0.0.1 insurance-flood.net127.0.0.1 insuranceall.net127.0.0.1 internetsearch.ru127.0.0.1 ionichost.com127.0.0.1 ionomist.com127.0.0.1 ipsex.net127.0.0.1 itsanal.com127.0.0.1 itseasy.us127.0.0.1 iweb-commerce.com127.0.0.1 iwebland.com127.0.0.1 jeannineoldfield.com127.0.0.1 jethomepage.com127.0.0.1 jetseeker.com127.0.0.1 jmhgallery.org127.0.0.1 joannelatham.com127.0.0.1 judin.ru127.0.0.1 junkysex.com127.0.0.1 karleyt.narod.ru127.0.0.1 kathisomers.com127.0.0.1 kazaa-lite.ws127.0.0.1 keithgreenpro.com127.0.0.1 kenmccaul.com127.0.0.1 kilosex.com127.0.0.1 kimhines.com127.0.0.1 kinoru.com127.0.0.1 ksdspups.org127.0.0.1 landrape.com127.0.0.1 lauraroebuck.com127.0.0.1 leannalovelace.com127.0.0.1 lesobank.ru127.0.0.1 libertyonlinehosting.com127.0.0.1 lingerie-mania.com127.0.0.1 lisamatthew.com127.0.0.1 liveholio.com127.0.0.1 livenewspaper.com127.0.0.1 louiseleeds.com127.0.0.1 love-pix.com127.0.0.1 lovelas.com127.0.0.1 lovelysearch.com127.0.0.1 low-taxes.com127.0.0.1 luckysearch.net127.0.0.1 lunitaweb.net127.0.0.1 lustful-porno.com127.0.0.1 mackinnonsbrook.org127.0.0.1 madfinder.com127.0.0.1 madisonmoons.com127.0.0.1 madisonoilco.com127.0.0.1 madonalive.com127.0.0.1 majuozawa.com127.0.0.1 makin-do.com127.0.0.1 male4free.com127.0.0.1 map-quest.org127.0.0.1 marilynchamber.com127.0.0.1 martfinder.com127.0.0.1 massearch.com127.0.0.1 matetrava.com127.0.0.1 mature50.com127.0.0.1 matureporngate.com127.0.0.1 maxdzines.com127.0.0.1 mcgeeforlabor.com127.0.0.1 mdstunisie.org127.0.0.1 medicare-insurance.net127.0.0.1 medicare-supplemental.com127.0.0.1 mega-dating-tips.com127.0.0.1 megumikanzaki.com127.0.0.1 meshalynn.com127.0.0.1 meta-adult.com127.0.0.1 meta-casino.com127.0.0.1 meta-mobile.com127.0.0.1 meta-porn.com127.0.0.1 metafora.ru127.0.0.1 metapoisk.ru127.0.0.1 michiyonakajima.com127.0.0.1 miconsultamedica.com127.0.0.1 mikasakamoto.com127.0.0.1 mikoni.com127.0.0.1 militarygods.porn4porn.net127.0.0.1 millennialpeople.org127.0.0.1 mipham.org127.0.0.1 missingcommand.com127.0.0.1 mommykiss.com127.0.0.1 moneyhunters.com127.0.0.1 montgomeryhospitalanesthesia.com127.0.0.1 morflot.com127.0.0.1 mortgage-debt.net127.0.0.1 mortismaximus.com127.0.0.1 moscowwhores.com127.0.0.1 moviecategories.com127.0.0.1 mp3-pix.com127.0.0.1 mrtg.jps.ru127.0.0.1 msn-info.net127.0.0.1 multipussy.com127.0.0.1 mundopolar.com127.0.0.1 mustv.com127.0.0.1 mywebsearch.net127.0.0.1 nativehardcore.com127.0.0.1 naturalspy.com127.0.0.1 nbasportsbook.net127.0.0.1 nellyslyrics.com127.0.0.1 nepgyan.com127.0.0.1 nesrecords.com127.0.0.1 netshastra.net127.0.0.1 nettime.ru127.0.0.1 nettracker.jps.ru127.0.0.1 netyellowpages.info127.0.0.1 new-incest.com127.0.0.1 newcategories.com127.0.0.1 newcracks.com127.0.0.1 newcracks.net127.0.0.1 newlife-lajolla.com127.0.0.1 newsexgate.com127.0.0.1 newtonsracks.com127.0.0.1 newxpics.com127.0.0.1 nhlsportsbook.net127.0.0.1 niagaracapital.com127.0.0.1 niche-tv.com127.0.0.1 nmrba.com127.0.0.1 nocalories.net127.0.0.1 nocensor.com127.0.0.1 ormandcompany.com127.0.0.1 nsbabes.com127.0.0.1 nuclearwitness.org127.0.0.1 nursemania.com127.0.0.1 nvntour.com127.0.0.1 nvphall.org127.0.0.1 oborot.com127.0.0.1 ocalalivestockmarket.com127.0.0.1 ocsff.com127.0.0.1 oeatlanta.com127.0.0.1 oharrowsearch.com127.0.0.1 ok-search.com127.0.0.1 okulta.com127.0.0.1 omegabrains.net127.0.0.1 online-casino-1.net127.0.0.1 online-casino-bonus.info127.0.0.1 online-casinos-x.com127.0.0.1 online-winning.net127.0.0.1 onlineserverz.com127.0.0.1 onlinetradings.net127.0.0.1 onlycunt.com127.0.0.1 onlyinsured.com127.0.0.1 operanabuco.com127.0.0.1 opsex.com127.0.0.1 oregoncharters.org127.0.0.1 otrlives.com127.0.0.1 ozawamadoka.com127.0.0.1 paigesummer.com127.0.0.1 pamelacollections.com127.0.0.1 panamcup.com127.0.0.1 pantygirls4u.com127.0.0.1 pantyhoserealm.com127.0.0.1 pantyplace.com127.0.0.1 pastubes.com127.0.0.1 paulapage.com127.0.0.1 paulhoover.com127.0.0.1 payfortraffic.net127.0.0.1 pedo.ws127.0.0.1 people.1gb.ru127.0.0.1 pervertbot.com127.0.0.1 pharma-diet-pills.com127.0.0.1 pharmacy2003.com127.0.0.1 pharmalocator.com127.0.0.1 phendimetrazine-tenuate-adipex.com127.0.0.1 pics-videos.com127.0.0.1 picsdir.com127.0.0.1 picsforbucks.com127.0.0.1 picsofseductiveladies.com127.0.0.1 pills-birth-control.com127.0.0.1 pillsmall.com127.0.0.1 pilotronix.com127.0.0.1 pixpox.com127.0.0.1 planemusic.com127.0.0.1 poiska.net127.0.0.1 poker-casino-free.com127.0.0.1 poker-games-free.net127.0.0.1 polradiologia.com127.0.0.1 pooi.net127.0.0.1 porn-teacher.com127.0.0.1 porncamz.com127.0.0.1 pornfree.info127.0.0.1 pornnightdreams.com127.0.0.1 pornokopec.com127.0.0.1 porntetris.com127.0.0.1 porntwist.com127.0.0.1 powerwebsearch.com127.0.0.1 prblitz.com127.0.0.1 pretypics.com127.0.0.1 pribalt.com127.0.0.1 privacy-support.biz127.0.0.1 privateporn.net127.0.0.1 prostactive.com127.0.0.1 prostol.com127.0.0.1 protect-yourself.biz127.0.0.1 prsainlandempire.org127.0.0.1 put-your-link-here.com127.0.0.1 pyrocorp.com127.0.0.1 quick-search.ws127.0.0.1 quiksearchgenealogy.com127.0.0.1 radfrall.org127.0.0.1 ramgo.com127.0.0.1 ranafrog.ne127.0.0.1 rapegate.com127.0.0.1 redbudbmx.com127.0.0.1 refinance-help.com127.0.0.1 removeearthkeepers.org127.0.0.1 rightfinder.net127.0.0.1 robbsproshop.com127.0.0.1 robertferencz.com127.0.0.1 rotocasters.com127.0.0.1 royalsearch.net127.0.0.1 runsearch.com127.0.0.1 russiansponsor.com127.0.0.1 russogay.com127.0.0.1 s2.exocrew.com127.0.0.1 sacitylife.com127.0.0.1 samplegals.com127.0.0.1 sbssurvivor.com127.0.0.1 scarypix.com127.0.0.1 sccdnet.com127.0.0.1 schoolforest.com127.0.0.1 search-1.net127.0.0.1 search-2003.com127.0.0.1 search-about.net127.0.0.1 search-hawk.com127.0.0.1 search-log.com127.0.0.1 search-meta.com127.0.0.1 search-safe.com127.0.0.1 search.psn.cn127.0.0.1 searchadultweb.com127.0.0.1 searchbutler.com127.0.0.1 searchbuttler.com127.0.0.1 searchbutler.org127.0.0.1 searchcomplete.com127.0.0.1 searchdesire.com127.0.0.1 searchdot.net127.0.0.1 searchexpander.com127.0.0.1 searchfastnet.com127.0.0.1 searchforge.com127.0.0.1 searching-the-net.com127.0.0.1 searchmeta.md127.0.0.1 searchmeta.net127.0.0.1 searchmeta.ru127.0.0.1 searchmeta.webhost.ru127.0.0.1 searchnow.ws127.0.0.1 searchonfly.com127.0.0.1 searchv.com127.0.0.1 searchxl.com127.0.0.1 searchxp.com127.0.0.1 sebot.com127.0.0.1 securenp.org127.0.0.1 security-warning.biz127.0.0.1 seehardcore.com127.0.0.1 seekwell.net127.0.0.1 selfbookmark.com127.0.0.1 selfbookmark.info127.0.0.1 selfbookmark.net127.0.0.1 sex.free4porno.net127.0.0.1 sex-coach.com127.0.0.1 sex-festival.com127.0.0.1 sex-video-galleries.com127.0.0.1 sexgalleries4all.com127.0.0.1 sexmoviesnet.com127.0.0.1 sexpatriot.net127.0.0.1 sexy18.cc127.0.0.1 sexycat.adult-host.org127.0.0.1 sfbayfolkboats.com127.0.0.1 sgirls.net127.0.0.1 sharempeg.com127.0.0.1 shopcards.net127.0.0.1 shopknights.com127.0.0.1 sic02.com127.0.0.1 sintrader.com127.0.0.1 site1.ru127.0.0.1 sites-in-web.com127.0.0.1 sitevictoria.com127.0.0.1 sixroads.com127.0.0.1 skakalka.ru127.0.0.1 slawsearch.com127.0.0.1 slotch.com127.0.0.1 slotchbar.com127.0.0.1 smartsumo.com127.0.0.1 smutarchive.net127.0.0.1 solongas.com127.0.0.1 sonomaevents.com127.0.0.1 spermatrix.com127.0.0.1 sportbooks-free4you.com127.0.0.1 spros.com127.0.0.1 spyass.com127.0.0.1 spyorgy.net127.0.0.1 staceyowens.com127.0.0.1 stacistaxx.com127.0.0.1 stacystaxx.com127.0.0.1 start-space.com127.0.0.1 steamycock.com127.0.0.1 sterva.com127.0.0.1 stevecashdollar.com127.0.0.1 stop-tracking.biz127.0.0.1 stopvotefraud.com127.0.0.1 stopxxxpics.com127.0.0.1 strekoza.com127.0.0.1 stuffstore.com127.0.0.1 styleclickink.com127.0.0.1 summercollins.com127.0.0.1 summitcross.com127.0.0.1 super-spider.com127.0.0.1 super-websearch.com127.0.0.1 supersexmachine.com127.0.0.1 superwebsearch.com127.0.0.1 supret.com127.0.0.1 suzannebrecht.com127.0.0.1 sweeteenz.com127.0.0.1 tacil.org127.0.0.1 tangounion.com127.0.0.1 tastethemusic.com127.0.0.1 tax-refund4you.com127.0.0.1 tech-jobs.ws127.0.0.1 technology-related.com127.0.0.1 teen-biz.com127.0.0.1 teen-pic-post.com127.0.0.1 teenpornosex.com127.0.0.1 teens4free.net127.0.0.1 teensact.com127.0.0.1 teensgate.com127.0.0.1 teensguru.com127.0.0.1 teenswamp.com127.0.0.1 testosterone-birth-control.com127.0.0.1 the-exit.com127.0.0.1 the-huns-yellow-pages.com127.0.0.1 thefakejournal.com127.0.0.1 thehuy.net127.0.0.1 theproxy.org127.0.0.1 therealsearch.com127.0.0.1 thesten.com127.0.0.1 thornleygroup.com127.0.0.1 tings.org127.0.0.1 tit-x.com127.0.0.1 titanvision.com127.0.0.1 titsianna.com127.0.0.1 toddhayes.com127.0.0.1 toon-comics.com127.0.0.1 tooncomics.com127.0.0.1 topsearcher.com127.0.0.1 trafficback.com127.0.0.1 trafficswitcher.com127.0.0.1 travel.picture-posters.com127.0.0.1 true-portal.com127.0.0.1 trytechnical.com127.0.0.1 ufindall.click-now.net127.0.0.1 umaxsearch.com127.0.0.1 une-autre-france.com127.0.0.1 unigays.com127.0.0.1 unipages.cc127.0.0.1 up2you.ru127.0.0.1 urlstat.com127.0.0.1 urlstat.ru127.0.0.1 uralitel.ru127.0.0.1 ursie.net127.0.0.1 utahsweet.com127.0.0.1 utopicportal.com127.0.0.1 uusocialjustice.org127.0.0.1 v61.com127.0.0.1 vaginpics.com127.0.0.1 valmyers.com127.0.0.1 vegas-free.com127.0.0.1 vegbuy.com127.0.0.1 veloventures.com127.0.0.1 verzila.com127.0.0.1 victoriaadam.com127.0.0.1 videocategories.com127.0.0.1 vitamins-for-each.com127.0.0.1 votehowe.org127.0.0.1 vxebony.com127.0.0.1 wakeupdick.com127.0.0.1 warnomore.org127.0.0.1 watersport-specialties.com127.0.0.1 web-homepage.net127.0.0.1 web-search.tk127.0.0.1 webcoolsearch.com127.0.0.1 websearchdot.com127.0.0.1 weekend-movies.com127.0.0.1 wetpornostars.com127.0.0.1 whatsyoursearch.com127.0.0.1 white-pages.ws127.0.0.1 whittierblvd.com127.0.0.1 win-in-casino.com127.0.0.1 wiresearch.com127.0.0.1 wolfpacracing.com127.0.0.1 wordlist.jps.ru127.0.0.1 wpc2001.org127.0.0.1 wspzone.sexpornonline.com127.0.0.1 wwwbet.net127.0.0.1 wwwbetting.net127.0.0.1 wwwpokergames.com127.0.0.1 wwwpokerplayers.com127.0.0.1 wwwroulette.net127.0.0.1 x-library.com127.0.0.1 x-webdesign.com127.0.0.1 xcomics4u.com127.0.0.1 xic-bs.com127.0.0.1 xldr.com127.0.0.1 xp18.com127.0.0.1 xrenosearch.com127.0.0.1 xtragay.com127.0.0.1 xu.xu.pl127.0.0.1 xxxcategories.com127.0.0.1 xxxemailxxx.com127.0.0.1 y-e-l-l-o-w.com127.0.0.1 yellow500.com127.0.0.1 yezol.com127.0.0.1 you-search.com127.0.0.1 you-search.com.ru127.0.0.1 youfindall.com127.0.0.1 youfindall.net127.0.0.1 your-prescriptions.net127.0.0.1 yourbookmarks.info127.0.0.1 yourbookmarks.ws127.0.0.1 ypir.com127.0.0.1 ysa-info.net127.0.0.1 yukohamano.com127.0.0.1 ywebsearch.info127.0.0.1 zapros.com127.0.0.1 zesearch.com127.0.0.1 ziportal.com127.0.0.1 zipportal.com127.0.0.1 zoneoffreeporn.com127.0.0.1 zoomegasite.com127.0.0.1 zvimigdal.com127.0.0.1 zyban-zocor-levitra.com127.0.0.1 t.rack.cc127.0.0.1 omega-search.com127.0.0.1 cool-xxx.net127.0.0.1 revolto3.da.ru127.0.0.1 dating-search.net127.0.0.1 linksummary.com127.0.0.1 duolaimi.net127.0.0.1 ez-searching.com127.0.0.1 freehqmovies.com127.0.0.1 xzoomy.com127.0.0.1 freescratchandwin.com127.0.0.1 globalwebsearch.com127.0.0.1 www.gocybersearch.com127.0.0.1 mayancasino.com127.0.0.1 www.hastalavista.com127.0.0.1 www.free-popup-killer.com127.0.0.1 www.digitalfan.com127.0.0.1 google123.web1000.com127.0.0.1 search.ieplugin.com127.0.0.1 i-lookup.com127.0.0.1 spidersearch.com127.0.0.1 istarthere.com127.0.0.1 xxxtoolbar.com127.0.0.1 www.seekporn.org127.0.0.1 17-plus.com127.0.0.1 lolita4all1.xrensmagpost.com127.0.0.1 mafiapics.com127.0.0.1 www.teenmonster.com127.0.0.1 ie.marketdart.com127.0.0.1 masterbar.com127.0.0.1 search.netzany.com127.0.0.1 only-virgins.com127.0.0.1 passthison.com127.0.0.1 blondetgp.com127.0.0.1 prolivation.com127.0.0.1 server-au.imrworldwide.com127.0.0.1 rocketsearch.com127.0.0.1 roar.com127.0.0.1 searchaccurate.com127.0.0.1 searchalot.com127.0.0.1 searchandbrowse.com127.0.0.1 gtawarehouse.com127.0.0.1 startium.com127.0.0.1 searchandclick.com127.0.0.1 searchby.net127.0.0.1 searchdot.com127.0.0.1 search-exe.com127.0.0.1 secret-crush.com127.0.0.1 seekseek.com127.0.0.1 sexarena.com127.0.0.1 sexocean.play-lolita.com127.0.0.1 startsurfing.com127.0.0.1 srng.net127.0.0.1 apps.webservicehost.com127.0.0.1 search.shopnav.com127.0.0.1 wish7.com127.0.0.1 www.supersexpass.com127.0.0.1 surferbar.com127.0.0.1 xlola.underagehost.com127.0.0.1 hotlolitas.underagehost.com127.0.0.1 loading-lolita.com127.0.0.1 www.xupiter.com127.0.0.1 xjupiter.com127.0.0.1 www.xjupiter.com127.0.0.1 www.browserwise.com127.0.0.1 sqwire.com127.0.0.1 orbitexplorer.com127.0.0.1 searchcentrix.com127.0.0.1 categories.mygeek.com127.0.0.1 web-entrance.co127.0.0.1 whazit.com127.0.0.1 windowenhancer.com127.0.0.1 buz.ru127.0.0.1 iwon.com127.0.0.1 www.bonzi.com127.0.0.1 featured-results.com127.0.0.1 searchmadesafe.net127.0.0.1 quicklaunch.com127.0.0.1 www.cashsurfers.com127.0.0.1 lop.com127.0.0.1 tjdo.com127.0.0.1 ebav.com127.0.0.1 ebgo.com127.0.0.1 ebaw.com127.0.0.1 ebkb.com127.0.0.1 ebmu.com127.0.0.1 ecmp.com127.0.0.1 edhq.com127.0.0.1 edty.com127.0.0.1 sbee.com127.0.0.1 aavc.com127.0.0.1 acjp.com127.0.0.1 ecmh.com127.0.0.1 emch.com127.0.0.1 ecpm.com127.0.0.1 wabu.com127.0.0.1 wabq.com127.0.0.1 ebch.com127.0.0.1 ebdv.com127.0.0.1 ebdw.com127.0.0.1 ebjp.com127.0.0.1 ebkn.com127.0.0.1 ebky.com127.0.0.1 eblv.com127.0.0.1 wbkb.com127.0.0.1 ebvr.com127.0.0.1 ecwz.com127.0.0.1 ecyb.com127.0.0.1 eduy.com127.0.0.1 eeev.com127.0.0.1 farse.com127.0.0.1 ibmx.com127.0.0.1 icwb.com127.0.0.1 icwo.com127.0.0.1 icwp.com127.0.0.1 iddh.com127.0.0.1 idhh.com127.0.0.1 ifiz.com127.0.0.1 iguu.com127.0.0.1 samz.com127.0.0.1 saoe.com127.0.0.1 sbjr.com127.0.0.1 sbnl.com127.0.0.1 sbnt.com127.0.0.1 sbvr.com127.0.0.1 scbm.com127.0.0.1 sckr.com127.0.0.1 scrk.com127.0.0.1 sdry.com127.0.0.1 seld.com127.0.0.1 sfux.com127.0.0.1 sheat.com127.0.0.1 sipo.com127.0.0.1 smds.com127.0.0.1 srib.com127.0.0.1 srox.com127.0.0.1 srsf.com127.0.0.1 ssaw.com127.0.0.1 ssby.com127.0.0.1 surj.com127.0.0.1 tbvg.com127.0.0.1 tdak.com127.0.0.1 tdmy.com127.0.0.1 tefs.com127.0.0.1 tfil.com127.0.0.1 tjar.com127.0.0.1 tjaw.com127.0.0.1 tjgo.com127.0.0.1 tjem.com127.0.0.1 torc.com127.0.0.1 wfix.com127.0.0.1 wflu.com127.0.0.1 tdko.com127.0.0.1 thko.com127.0.0.1 H24413.tfil.com127.0.0.1 germany.rub.to127.0.0.1 search.rub.to127.0.0.1 unitedstates.rub.to127.0.0.1 www.commonname.com127.0.0.1 www.ezcybersearch.com127.0.0.1 www.jethomepage.com127.0.0.1 www.gohip.com127.0.0.1 hotbar.com127.0.0.1 www.huntbar.com127.0.0.1 search.imiserver.com127.0.0.1 searchenhancement.com127.0.0.1 newtonknows.com127.0.0.1 search-explorer.net127.0.0.1 searchsquire.com127.0.0.1 secondpower.com127.0.0.1 2ndpower.com127.0.0.1 searchgateway.net127.0.0.1 worldusa.com127.0.0.1 www.topsearcher.com127.0.0.1 smutserver.com127.0.0.1 searchmeup.com127.0.0.1 cameup.com127.0.0.1 kliksearch.com127.0.0.1 realphx.com127.0.0.1 blazefind.com127.0.0.1 zoofil.com127.0.0.1 terafinder.com127.0.0.1 008i.com127.0.0.1 171203.com127.0.0.1 39-93.com127.0.0.1 adult-personal.us127.0.0.1 cashsearch.biz127.0.0.1 cl55.biz127.0.0.1 dailyteenspic.com127.0.0.1 dialer2004.com127.0.0.1 digital-pornography.com127.0.0.1 eager-sex.com127.0.0.1 ergosites.com127.0.0.1 freecj.com127.0.0.1 greg-search.com127.0.0.1 incest-host.com127.0.0.1 ironcarteam.com127.0.0.1 is-best.com127.0.0.1 killerpornstars.com127.0.0.1 lollitop.com127.0.0.1 love-host.com127.0.0.1 myexexex.com127.0.0.1 my-finder.com127.0.0.1 onlineclick.net127.0.0.1 onlysex.ws127.0.0.1 regfreeze.com127.0.0.1 ruworld.com127.0.0.1 selltraffic.biz127.0.0.1 sexunique.net127.0.0.1 sinpussy.com127.0.0.1 teenhost.net127.0.0.1 ultraload.net127.0.0.1 vse-moe.biz127.0.0.1 xsex.ws127.0.0.1 75tz.com127.0.0.1 iefeadsl.com127.0.0.1 rf104.com127.0.0.1 www.v61.com127.0.0.1 ads.centralmedia.ws127.0.0.1 c.centralmedia.ws127.0.0.1 count.cc127.0.0.1 topx.cc127.0.0.1 sidefind.com127.0.0.1 thenewsearch.com127.0.0.1 new-search.net127.0.0.1 x-google.net127.0.0.1 adultgambling.org127.0.0.1 bitchesonline.net127.0.0.1 girls4rent.net127.0.0.1 usefullsoft.net127.0.0.1 livegambling.com127.0.0.1 adultsgames.net127.0.0.1 easyantispy.com127.0.0.1 spybotremover.net127.0.0.1 winprotect.net127.0.0.1 funny-girls.com127.0.0.1 winmsn.com127.0.0.1 oneclicksearches.com127.0.0.1 bestweblinks.com127.0.0.1 iqsearch.net127.0.0.1 dumpserv.com127.0.0.1 helpyoursearch.com127.0.0.1 sgrunt.biz127.0.0.1 yeak.net127.0.0.1 u45.cx127.0.0.1 u46.cx127.0.0.1 u47.cc127.0.0.1 u48.cc127.0.0.1 sfonditalia.biz127.0.0.1 realarea.biz127.0.0.1 archiviosex.net127.0.0.1 agava.com127.0.0.1 agava.ru127.0.0.1 hut1.ru127.0.0.1 hu15.ru127.0.0.1 winfixer.com127.0.0.1 3721.com127.0.0.1 easysearchingtips.com127.0.0.1 fine-search.net127.0.0.1 noproblemsurf.com127.0.0.1 pcspyremover.com127.0.0.1 search-motor.com127.0.0.1 searchwhatuwant.com127.0.0.1 ad25.com127.0.0.1 ad45.com127.0.0.1 ad77.com127.0.0.1 ad86.com127.0.0.1 full-search.net127.0.0.1 go2-search.com127.0.0.1 onemoresearch.net127.0.0.1 search-777.com127.0.0.1 search-to-find.com127.0.0.1 search-what.net127.0.0.1 winshow.biz127.0.0.1 lookfor.cc127.0.0.1 looking-for.cc127.0.0.1 tgp-4-you.com127.0.0.1 veryeasysearch.com127.0.0.1 010402.com127.0.0.1 20x2p.com127.0.0.1 db105.com127.0.0.1 ga31.com127.0.0.1 mpeg-look.com127.0.0.1 n-udd.com127.0.0.1 p-uud.com127.0.0.1 porn-screen.com127.0.0.1 rb37.com127.0.0.1 t058.com127.0.0.1 u-239.com127.0.0.1 v-224.com127.0.0.1 trackhits.cc127.0.0.1 tracktraff.cc127.0.0.1 power-cleaner.com127.0.0.1 yoursitebar.com127.0.0.1 ysbweb.com127.0.0.1 www.ysbweb.com127.0.0.1 installcash.com127.0.0.1 toolbarcash.com127.0.0.1 enjoywebsurf.com127.0.0.1 msnguard.cc127.0.0.1 searchclick.cc127.0.0.1 havy.biz127.0.0.1 ewizard.cc127.0.0.1 4klm.com127.0.0.1 camup.net127.0.0.1 bdsmlibrary.net127.0.0.1 n-glx.s-redirect.com127.0.0.1 aaasexypics.com127.0.0.1 allforadult.com127.0.0.1 autoescrowpay.com127.0.0.1 awmcash.biz127.0.0.1 awmdabest.com127.0.0.1 buldog-stats.com127.0.0.1 counter.sexmaniack.com127.0.0.1 fregat.drocherway.com127.0.0.1 greg-tut.com127.0.0.1 iframe.biz127.0.0.1 megapornix.com127.0.0.1 newiframe.biz127.0.0.1 nylonsexy.com127.0.0.1 pizdato.biz127.0.0.1 sexfiles.nu127.0.0.1 slutmania.biz127.0.0.1 sp2[censored]ed.biz127.0.0.1 toolbarpartner.com127.0.0.1 vesbiz.biz127.0.0.1 virgin-tgp.net127.0.0.1 vparivalka.com127.0.0.1 x.full-tgp.net127.0.0.1 toolbar.cc127.0.0.1 himen.biz127.0.0.1 msupdater.net127.0.0.1 www.msupdater.net127.0.0.1 1800searchonline.com127.0.0.1 www.1800searchonline.com127.0.0.1 1stsearchportal.com127.0.0.1 www.1stsearchportal.com127.0.0.1 24-7searching-and-more.com127.0.0.1 www.24-7searching-and-more.com127.0.0.1 971searchbox.com127.0.0.1 www.971searchbox.com127.0.0.1 aaawebfinder.com127.0.0.1 www.aaawebfinder.com127.0.0.1 ampmsearch.com127.0.0.1 www.ampmsearch.com127.0.0.1 clickhere4search.com127.0.0.1 www.clickhere4search.com127.0.0.1 clicktomakeasearch.com127.0.0.1 www.clicktomakeasearch.com127.0.0.1 directsearchzone.com127.0.0.1 www.directsearchzone.com127.0.0.1 easysearch4you.com127.0.0.1 www.easysearch4you.com127.0.0.1 enterthesearch.com127.0.0.1 www.enterthesearch.com127.0.0.1 esearch2005.com127.0.0.1 www.esearch2005.com127.0.0.1 eza1netsearch.com127.0.0.1 www.eza1netsearch.com127.0.0.1 ezwebsearching.com127.0.0.1 www.ezwebsearching.com127.0.0.1 globalefinder.com127.0.0.1 www.globalefinder.com127.0.0.1 go2realsearch.com127.0.0.1 www.go2realsearch.com127.0.0.1 myseachexplorer.com127.0.0.1 www.myseachexplorer.com127.0.0.1 quicksearch360.com127.0.0.1 www.quicksearch360.com127.0.0.1 s1s1s1search.com127.0.0.1 www.s1s1s1search.com127.0.0.1 search101online.com127.0.0.1 www.search101online.com127.0.0.1 search123forme.com127.0.0.1 www.search123forme.com127.0.0.1 search345quest.com127.0.0.1 www.search345quest.com127.0.0.1 searchmiracle.com127.0.0.1 www.searchmiracle.com127.0.0.1 searchtheworld4you.com127.0.0.1 www.searchtheworld4you.com127.0.0.1 searchwebzone.com127.0.0.1 www.searchwebzone.com127.0.0.1 seektheglobe.com127.0.0.1 www.seektheglobe.com127.0.0.1 sitesearchcentral.com127.0.0.1 www.sitesearchcentral.com127.0.0.1 the818search-co.com127.0.0.1 www.the818search-co.com127.0.0.1 type2find.com127.0.0.1 www.type2find.com127.0.0.1 xosearchox.com127.0.0.1 www.xosearchox.com127.0.0.1 yoursearchspace.com127.0.0.1 www.yoursearchspace.com127.0.0.1 httpwwwads.com127.0.0.1 www.httpwwwads.com127.0.0.1 adshttp.com127.0.0.1 www.adshttp.com127.0.0.1 adsonwww.com127.0.0.1 www.adsonwww.com127.0.0.1 dnaads.com127.0.0.1 www.dnaads.com127.0.0.1 marketengines.com127.0.0.1 www.marketengines.com127.0.0.1 ad-w-a-r-e.com127.0.0.1 www.ad-w-a-r-e.com127.0.0.1 a-d-w-a-r-e.com127.0.0.1 www.a-d-w-a-r-e.com127.0.0.1 securityindex.net127.0.0.1 www.securityindex.net127.0.0.1 sexpicsporn.com127.0.0.1 www.sexpicsporn.com127.0.0.1 free-spybot.com127.0.0.1 www.free-spybot.com127.0.0.1 cashengines.com127.0.0.1 www.cashengines.com127.0.0.1 microsoftantispyware.net127.0.0.1 www.microsoftantispyware.net127.0.0.1 mircosoftantispy.com127.0.0.1 www.mircosoftantispy.com127.0.0.1 msantispy.com127.0.0.1 www.msantispy.com127.0.0.1 netspyprotector.com127.0.0.1 www.netspyprotector.com127.0.0.1 avforce.com127.0.0.1 www.avforce.com127.0.0.1 savehits.com127.0.0.1 www.savehits.com127.0.0.1 saveli.com127.0.0.1 www.saveli.com127.0.0.1 metastop.com127.0.0.1 www.metastop.com127.0.0.1 perlink.biz127.0.0.1 www.perlink.biz127.0.0.1 highdialer.com127.0.0.1 www.highdialer.com127.0.0.1 online-more.com127.0.0.1 www.online-more.com127.0.0.1 www.syserrors.com127.0.0.1 www.vcodec.com127.0.0.1 toolbartraff.biz127.0.0.1 www.toolbartraff.biz127.0.0.1 pcadprotector.cc127.0.0.1 www.pcadprotector.cc127.0.0.1 airtleworld.com127.0.0.1 www.airtleworld.com127.0.0.1 domaincar.com127.0.0.1 www.domaincar.com127.0.0.1 worldray.com127.0.0.1 www.worldray.com127.0.0.1 www5.worldray.com127.0.0.1 www6.worldray.com127.0.0.1 www.spytrooper.com127.0.0.1 spytrooper.com127.0.0.1 dl.ad-ware.cc127.0.0.1 ad-ware.cc127.0.0.1 downloads.adaware.cc127.0.0.1 adaware.cc127.0.0.1 hitscount.net127.0.0.1 count.hitscount.net127.0.0.1 fined.biz127.0.0.1 de.ag127.0.0.1 games.de.ag127.0.0.1 www.games.de.ag127.0.0.1 little-download.net127.0.0.1 www.little-download.net127.0.0.1 little-help.com127.0.0.1 www.little-help.com127.0.0.1 www.spyaxe.net127.0.0.1 www.spyaxe.com127.0.0.1 www.spyaxe.biz127.0.0.1 www.malwarewipe.com127.0.0.1 dl.malwarewipe.com127.0.0.1 www.malwarewipeupdate.com127.0.0.1 unionseek.com127.0.0.1 www.unionseek.com127.0.0.1 sirh0t.blackhats.tc127.0.0.1 blackhats.tc127.0.0.1 www.blackhats.tc127.0.0.1 ritztours.com127.0.0.1 www.ritztours.com127.0.0.1 flashflashmx.3322.org127.0.0.1 3322.org127.0.0.1 www.3322.org127.0.0.1 jupitersatellites.biz127.0.0.1 www.jupitersatellites.biz127.0.0.1 yops.biz127.0.0.1 www.yops.biz127.0.0.1 goldengr.hypermart.net127.0.0.1 web-nexus.net127.0.0.1 safe-sales.biz127.0.0.1 www.safe-sales.biz127.0.0.1 jerrynews.com127.0.0.1 www.jerrynews.com127.0.0.1 Teslaplus.com127.0.0.1 www.Teslaplus.com127.0.0.1 WorldAntiSpy.com127.0.0.1 www.WorldAntiSpy.com127.0.0.1 www.securitycaution.com127.0.0.1 securitycaution.com127.0.0.1 adservs.com127.0.0.1 csx.adservs.com127.0.0.1 www.csx.adservs.com127.0.0.1 toolbarbest.biz127.0.0.1 www.toolbarbest.biz127.0.0.1 game4all.biz127.0.0.1 www.game4all.biz127.0.0.1 wm.kannylizaciya.info127.0.0.1 www.wm.kannylizaciya.info127.0.0.1 wm.buhartes.info127.0.0.1 www.wm.buhartes.info127.0.0.1 login.fric.cn127.0.0.1 www.login.fric.cn127.0.0.1 xsremover.com127.0.0.1 www.xsremover.com127.0.0.1 spydeface.com127.0.0.1 www.spydeface.com127.0.0.1 alfacleaner.com127.0.0.1 www.alfacleaner.com127.0.0.1 innovagest2000.com127.0.0.1 www.innovagest2000.com127.0.0.1 www.thespyguard.com127.0.0.1 thespyguard.com127.0.0.1 www.adwarepunisher.com127.0.0.1 adwarepunisher.com127.0.0.1 www.spyiblock.com127.0.0.1 spyiblock.com127.0.0.1 www.uvu-channel.com127.0.0.1 uvu-channel.com127.0.0.1 www.hachimitsu-lemon.com127.0.0.1 hachimitsu-lemon.com127.0.0.1 SEARCHTOFIND.NET127.0.0.1 www.SEARCHTOFIND.NET127.0.0.1 www.pestrap.com127.0.0.1 pestrap.com127.0.0.1 uptodatesecurity.com127.0.0.1 www.uptodatesecurity.com127.0.0.1 thinstall.abetterinternet.com127.0.0.1 www.3abetterinternet.com127.0.0.1 download.abetterinternet.com127.0.0.1 www.abetterinternet.com127.0.0.1 qmex.psyche-evolution.com127.0.0.1 www.qmex.psyche-evolution.com127.0.0.1 core.psyche-evolution.com127.0.0.1 www.core.psyche-evolution.com127.0.0.1 1stantivirus.com127.0.0.1 www.1stantivirus.com127.0.0.1 scanandrepair.com127.0.0.1 www.scanandrepair.com127.0.0.1 uydsiygeds.com127.0.0.1 www.uydsiygeds.com127.0.0.1 pesttrap.com127.0.0.1 www.pesttrap.com127.0.0.1 adwarebazooka.com127.0.0.1 get.adwarebazooka.com127.0.0.1 www.adwarebazooka.com127.0.0.1 kliksoftware.com127.0.0.1 www.kliksoftware.com127.0.0.1 hitvirus.com127.0.0.1 get.hitvirus.com127.0.0.1 www.hitvirus.com127.0.0.1 promo.dollarrevenue.com127.0.0.1 www.promo.dollarrevenue.com127.0.0.1 maxifile.com127.0.0.1 www.maxifile.com127.0.0.1 targetsaver.com127.0.0.1 www.targetsaver.com127.0.0.1 dl.targetsaver.com127.0.0.1 www.dl.targetsaver.com127.0.0.1 nonameforthisdomain.com127.0.0.1 www.nonameforthisdomain.com127.0.0.1 hypoteches.com127.0.0.1 www.hypoteches.com127.0.0.1 www.earthllnk.net127.0.0.1 earthllnk.net127.0.0.1 hostance.net127.0.0.1 www.hostance.net127.0.0.1 my-dedik-one.com127.0.0.1 www.my-dedik-one.com127.0.0.1 10sek.com127.0.0.1 www.10sek.com127.0.0.1 6sek.com127.0.0.1 www.6sek.com127.0.0.1 cashdeluxe.net127.0.0.1 www.cashdeluxe.net127.0.0.1 stats.cashdeluxe.net127.0.0.1 www.stats.cashdeluxe.net127.0.0.1 www.2006ooo.com127.0.0.1 www.spyware-stop.com127.0.0.1 spyware-stop.com127.0.0.1 www.SpyShield.org127.0.0.1 SpyShield.org127.0.0.1 utils.winfixer.com127.0.0.1 www.utils.winfixer.com127.0.0.1 toolbarbucks.biz127.0.0.1 www.toolbarbucks.biz127.0.0.1 derklaif.biz127.0.0.1 www.derklaif.biz127.0.0.1 www.v-codec.com127.0.0.1 v-codec.com127.0.0.1 www.emediacodec.com127.0.0.1 emediacodec.com127.0.0.1 www.popentertain.com127.0.0.1 popentertain.com127.0.0.1 softwareprofit.com127.0.0.1 www.softwareprofit.com127.0.0.1 de.winantivirus.com127.0.0.1 download.winantivirus.com127.0.0.1 winantivirus.com127.0.0.1 www.winantivirus.com127.0.0.1 offers.bullseye-network.com127.0.0.1 www.offers.bullseye-network.com127.0.0.1 bullseye-network.com127.0.0.1 www.bullseye-network.com127.0.0.1 sponsor2.ucmore.com127.0.0.1 www.sponsor2.ucmore.com127.0.0.1 hostthesky.com127.0.0.1 www.hostthesky.com127.0.0.1 dbdecicated.com127.0.0.1 www.dbdecicated.com127.0.0.1 readagreement.net127.0.0.1 www.readagreement.net127.0.0.1 gl.secdep.info127.0.0.1 www.gl.secdep.info127.0.0.1 spyfalcon.com127.0.0.1 www.spyfalcon.com127.0.0.1 spyfalconupdate.com127.0.0.1 www.spyfalconupdate.com127.0.0.1 spy-shield.com127.0.0.1 www.spy-shield.com127.0.0.1 winnanny.com127.0.0.1 www.winnanny.com127.0.0.1 winsoftware.com127.0.0.1 www.winsoftware.com127.0.0.1 winfirewall.com127.0.0.1 www.winfirewall.com127.0.0.1 winantispyware.com127.0.0.1 www.winantispyware.com127.0.0.1 udefender.com127.0.0.1 www.udefender.com127.0.0.1 bravesentry.com127.0.0.1 www.bravesentry.com127.0.0.1 content.dollarrevenue.com127.0.0.1 www.content.dollarrevenue.com127.0.0.1 toolbar.azebar.com127.0.0.1 www.toolbar.azebar.com127.0.0.1 traffsale1.biz127.0.0.1 www.traffsale1.biz127.0.0.1 spywaredisinfector.com127.0.0.1 www.spywaredisinfector.com127.0.0.1 SpyCut.com127.0.0.1 www.SpyCut.com127.0.0.1 almanah.biz127.0.0.1 www.almanah.biz127.0.0.1 antispydns.biz127.0.0.1 www.antispydns.biz127.0.0.1 spyaxeupdate.com127.0.0.1 www.spyaxeupdate.com127.0.0.1 malwarewipesupport.com127.0.0.1 www.malwarewipesupport.com127.0.0.1 remedyantispy.com127.0.0.1 www.remedyantispy.com127.0.0.1 systemstable.com127.0.0.1 www.systemstable.com127.0.0.1 whoisprivacyprotect.com127.0.0.1 www.whoisprivacyprotect.com127.0.0.1 prime.webhancer.com127.0.0.1 www.prime.webhancer.com127.0.0.1 webhancer.com127.0.0.1 www.webhancer.com127.0.0.1 dr.webhancer.com127.0.0.1 www.dr.webhancer.com127.0.0.1 dr2.webhancer.com127.0.0.1 www.dr2.webhancer.com127.0.0.1 www.onli-ne.com127.0.0.1 spycontra.com127.0.0.1 www.spycontra.com127.0.0.1 anti-virus-pro.com127.0.0.1 www.anti-virus-pro.com127.0.0.1 check.jupitersatellites.biz127.0.0.1 www.check.jupitersatellites.biz127.0.0.1 necessaryupdates.com127.0.0.1 www.necessaryupdates.com127.0.0.1 bestworldgirls-for-u.net127.0.0.1 www.bestworldgirls-for-u.net127.0.0.1 stejax.pl127.0.0.1 www.stejax.pl127.0.0.1 kitehosting.com127.0.0.1 www.kitehosting.com127.0.0.1 ware2006.com127.0.0.1 www.ware2006.com127.0.0.1 filestore.com127.0.0.1 www.filestore.com127.0.0.1 systemupdates.net127.0.0.1 www.systemupdates.net127.0.0.1 logs.vapochille.com127.0.0.1 www.logs.vapochille.com127.0.0.1 goldenfreehost.com127.0.0.1 www.goldenfreehost.com127.0.0.1 todaywarnings.com127.0.0.1 www.todaywarnings.com127.0.0.1 spywarequake.com127.0.0.1 spywarequake.info127.0.0.1 www.spywarequake.info127.0.0.1 www.spywarequake.com127.0.0.1 download2.spywarequake.com127.0.0.1 download3.spywarequake.com127.0.0.1 download4.spywarequake.com127.0.0.1 download5.spywarequake.com127.0.0.1 download7.spywarequake.com127.0.0.1 download8.spywarequake.com127.0.0.1 download9.spywarequake.com127.0.0.1 download10.spywarequake.com127.0.0.1 download11.spywarequake.com127.0.0.1 download12.spywarequake.com127.0.0.1 download13.spywarequake.com127.0.0.1 download15.spywarequake.com127.0.0.1 updates.spywarequake.com127.0.0.1 urgentsystemupdate.com127.0.0.1 www.urgentsystemupdate.com127.0.0.1 dl2.spywarestrike.com127.0.0.1 dl3.spywarestrike.com127.0.0.1 dl4.spywarestrike.com127.0.0.1 dl5.spywarestrike.com127.0.0.1 dl6.spywarestrike.com127.0.0.1 dl7.spywarestrike.com127.0.0.1 dl8.spywarestrike.com127.0.0.1 nospywaresoft.com127.0.0.1 spywarestrike.com127.0.0.1 www.nospywaresoft.com127.0.0.1 www.spywarestrike.com127.0.0.1 spyaxesupport.com127.0.0.1 www.spyaxesupport.com127.0.0.1 download3.spyaxe.com127.0.0.1 download4.spyaxe.com127.0.0.1 download5.spyaxe.com127.0.0.1 download6.spyaxe.com127.0.0.1 dl2.spyfalcon.com127.0.0.1 dl3.spyfalcon.com127.0.0.1 dl4.spyfalcon.com127.0.0.1 dl5.spyfalcon.com127.0.0.1 dl9.spyfalcon.com127.0.0.1 dl10.spyfalcon.com127.0.0.1 dl16.spyfalcon.com127.0.0.1 www.sgrunt.biz127.0.0.1 traffbest.biz127.0.0.1 www.traffbest.biz127.0.0.1 securityfeature.com127.0.0.1 www.securityfeature.com127.0.0.1 pimasoft.com127.0.0.1 www.pimasoft.com127.0.0.1 blackhawksoftware.com127.0.0.1 www.blackhawksoftware.com127.0.0.1 spy-sniper.com127.0.0.1 www.spy-sniper.com127.0.0.1 safetydefender.com127.0.0.1 www.safetydefender.com127.0.0.1 securitywarnings.net127.0.0.1 www.securitywarnings.net127.0.0.1 urgentsystemupdate.biz127.0.0.1 www.urgentsystemupdate.biz127.0.0.1 antispylab.com127.0.0.1 www.antispylab.com127.0.0.1 spywaresheriff.com127.0.0.1 www.spywaresheriff.com127.0.0.1 allmegabucks.com127.0.0.1 www.allmegabucks.com127.0.0.1 rizalof.com127.0.0.1 www.rizalof.com127.0.0.1 rc.rizalof.com127.0.0.1 media-codec.com127.0.0.1 www.media-codec.com127.0.0.1 SpywareScraper.com127.0.0.1 www.SpywareScraper.com127.0.0.1 crystalysmedia.com127.0.0.1 www.crystalysmedia.com127.0.0.1 180solutions.com127.0.0.1 cts.180solutions.com127.0.0.1 bis.180solutions.com127.0.0.1 downloads.180solutions.com127.0.0.1 uploads.180solutions.com127.0.0.1 installs.180solutions.com127.0.0.1 config.180solutions.com127.0.0.1 ping.180solutions.com127.0.0.1 tv.180solutions.com127.0.0.1 nowhere.180solutions.com127.0.0.1 www.180solutions.com127.0.0.1 180searchassistant.com127.0.0.1 www.180searchassistant.com127.0.0.1 theguardservices.com127.0.0.1 www.theguardservices.com127.0.0.1 securitybulletin.net127.0.0.1 www.securitybulletin.net127.0.0.1 www.supernet.speedserv.com127.0.0.1 spyonthis.net127.0.0.1 download.spyonthis.net127.0.0.1 www.spyonthis.net127.0.0.1 hijack-this.net127.0.0.1 www.hijack-this.net127.0.0.1 errorsafe.com127.0.0.1 de.errorsafe.com127.0.0.1 download.errorsafe.com127.0.0.1 www.error
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Problem with a worm or two?
« Reply #7 on: September 21, 2007, 07:22:24 PM »
Do a "System scan only" with Hijackthis and put a check next to these entries:

O1 - Hosts: om


If  the following is not your preferred home page, check it too
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/


After you have ticked the above entries, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Reboot the computer
Come back and post one last hijackthis log

Let me know how everything is running, I'm not a mind reader  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
« Last Edit: September 22, 2007, 12:02:22 AM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline doxarap

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Problem with a worm or two?
« Reply #8 on: September 24, 2007, 07:44:02 AM »
Thanx alot again - the computer seems to be running more smoothly now! You think we killed a worm or two? http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/rolleyes.gif\' class=\'bbc_emoticon\' alt=\':rolleyes:\' />

Andreas


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:43:01, on 24.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\AvidSDMService.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Programfiler\CA\eTrust Antivirus\InoRpc.exe
C:\Programfiler\CA\eTrust Antivirus\InoRT.exe
C:\Programfiler\CA\eTrust Antivirus\InoTask.exe
C:\Programfiler\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\PROGRA~1\CA\SHARED~1\SCANEN~1\InoDist.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programfiler\Home Cinema\PowerCinema\PCMService.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programfiler\Logitech\Video\LogiTray.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe
C:\Programfiler\MSN Messenger\msnmsgr.exe
C:\Programfiler\Fellesfiler\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
C:\Programfiler\Logitech\Video\FxSvr2.exe
C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexStoreSvr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.no/0SENBNO/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.no/0SENBNO/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.online.no/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.no/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.no/0SENBNO/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Toolbar Suite\TB2.05.0000.1105\nb-no\msntb.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Toolbar Suite\TB2.05.0000.1105\nb-no\msntb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programfiler\Fellesfiler\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programfiler\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programfiler\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programfiler\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [StartFoxie] C:\Programfiler\Foxie Suite\StartFoxie.exe
O4 - HKLM\..\Run: [iHP-100] C:\Programfiler\iRiver\HSeries\iHPDetect.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programfiler\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programfiler\Fellesfiler\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Programfiler\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: PC-søk i Windows.lnk = C:\Programfiler\MSN Toolbar Suite\DS2.05.0001.1119\nb-no\bin\WindowsSearch.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: &MSN Search - res://C:\Programfiler\MSN Toolbar Suite\TB2.05.0000.1105\nb-no\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ã…pne i ny bakgrunnsflik - res://C:\Programfiler\MSN Toolbar Suite\TAB2.05.0000.1105\nb-no\msntabres.dll/229?d8bc0ce45e234ae4b495c511db33855f
O8 - Extra context menu item: Ã…pne i ny forgrunnsflik - res://C:\Programfiler\MSN Toolbar Suite\TAB2.05.0000.1105\nb-no\msntabres.dll/230?d8bc0ce45e234ae4b495c511db33855f
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.online.no/
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {5C4EB11A-2078-432E-92FE-0CB2ACD6D071} (m2wFTPClient.M2WFTPControl) - http://webmail.nameplanet.com/mail/FTP/m2wFTPClient.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1137767127453
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe
O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Programfiler\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Programfiler\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programfiler\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programfiler\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programfiler\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Programfiler\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: NBService - Nero AG - C:\Programfiler\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 10133 bytes


[quote name=\'guestolo\' post=\'390317\' date=\'Sep 22 2007, 12:22 AM\']Do a "System scan only" with Hijackthis and put a check next to these entries:

O1 - Hosts: om


If the following is not your preferred home page, check it too
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/


After you have ticked the above entries, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Reboot the computer
Come back and post one last hijackthis log

Let me know how everything is running, I'm not a mind reader http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />[/quote]
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Problem with a worm or two?
« Reply #9 on: September 25, 2007, 07:51:52 AM »
Quote
You think we killed a worm or two
Looks like we cleared some spyware from your computer

Best to still do the following
If everything is running better
Go to START>>All Programs>>Accessories>>System Tools>>System Restore
Create a New restore point
Give it a name and click Create
Windows will prompt when it has been successful created
When that's done

Go to START>>RUN>>type the following
cleanmgr
Hit OK
Let if finish calculating

Select the More Options tab
and click Cleanup.. under 'System Restore'
This will clear all later restore points except for the one you just made

Ok the prompts, it may take a few seconds to remove old restore points
Ok again after it's ready and let it finish cleaning

You should give your computer a bit more protection
Install
SpywareBlaster 3.5.1 by JavaCool  
    *Will block bad ActiveX Controls
    *Block Malevolent cookies in Internet Explorer and Firefox
    *Restrict actions of potentially dangerous sites in Internet Explorer
After installation, Check for updates
After updating, select "Protection" on the Left
Then select "Enable all Protection"
"Check for updates every couple of weeks"
after every update just simply click the "enable protection on all unprotected items"

Hold onto Spybot 1.5
After every update ensure to reimmunize
Simply click the Immunize button>>OK the prompt
Click the top green cross to set the Immunization
« Last Edit: September 25, 2007, 07:52:38 AM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline doxarap

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Problem with a worm or two?
« Reply #10 on: September 28, 2007, 06:11:41 AM »
Great! Thanx - I've done everything you've said..

You've been of fantastic help - thanks alot!!

best
andreas/norway

[quote name=\'guestolo\' post=\'391300\' date=\'Sep 25 2007, 12:51 PM\']Looks like we cleared some spyware from your computer

Best to still do the following
If everything is running better
Go to START>>All Programs>>Accessories>>System Tools>>System Restore
Create a New restore point
Give it a name and click Create
Windows will prompt when it has been successful created
When that's done

Go to START>>RUN>>type the following
cleanmgr
Hit OK
Let if finish calculating

Select the More Options tab
and click Cleanup.. under 'System Restore'
This will clear all later restore points except for the one you just made

Ok the prompts, it may take a few seconds to remove old restore points
Ok again after it's ready and let it finish cleaning

You should give your computer a bit more protection
Install
SpywareBlaster 3.5.1 by JavaCool
    *Will block bad ActiveX Controls
    *Block Malevolent cookies in Internet Explorer and Firefox
    *Restrict actions of potentially dangerous sites in Internet Explorer
After installation, Check for updates
After updating, select "Protection" on the Left
Then select "Enable all Protection"
"Check for updates every couple of weeks"
after every update just simply click the "enable protection on all unprotected items"

Hold onto Spybot 1.5
After every update ensure to reimmunize
Simply click the Immunize button>>OK the prompt
Click the top green cross to set the Immunization[/quote]
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Problem with a worm or two?
« Reply #11 on: September 28, 2007, 08:37:19 PM »
I'll lock this topic as your problems are resolved
Take care doxarap  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Pages: [1]
« previous next »