I can't get rid of SpyLocked. any suggestions please. I have googled but this is the only site I trust. thanks cris

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified. Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop. Doubleclick on the HJTsetup.exe icon on your desktop. By default it will install to C:\Program Files\Hijack This. Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue. Put a check by "Create a desktop icon" then click "Next" again. Continue to follow the rest of the prompts from there. At the final dialogue box click "Finish" and it will launch Hijack This. Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread. Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly. Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop. !!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!! Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd" Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

hijack log file Logfile of HijackThis v1.99.1 Scan saved at 14:41:58, on 04/05/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Protection Tools\bpmon.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Acer\Notebook Manager\almxptray.exe C:\Program Files\Launch Manager\LaunchAp.exe C:\Program Files\Launch Manager\PowerKey.exe C:\Program Files\Launch Manager\HotkeyApp.exe C:\Program Files\Launch Manager\CtrlVol.exe C:\Program Files\Launch Manager\Wbutton.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ltmoh\Ltmoh.exe C:\Program Files\Protection Tools\bpmini.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\SlipStream Web Accelerator\slipaccel.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\WordWeb\wweb32.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.co.nz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://msaps.dll/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.co.nz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = res://msaps.dll/index.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;<local>;*windowsupdate.com;download.microsoft.com;*windowsupdate.microsoft.com;codecs.microsoft.com;activex.microsoft.com;liveupdate.symantecliveupdate.com;liveupdate.symantec.com;service1.symantec.com;*.nai.com;*.networkassociates.com;*.trademe.co.nz R3 - URLSearchHook: (no name) - {FDE3577A-6254-181C-4E11-339E4F746BD3} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {1FC80E00-41B0-4F74-BC16-2C83ED49CAC9} - C:\Program Files\Protection Tools\bpvol.dll O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\SlipStream Web Accelerator\PBHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Protection Bar - {F0993251-2512-4710-AF6E-0A13EA199D02} - C:\Program Files\Protection Tools\splug.dll O4 - HKLM\..\Run: [LaunchApp] LaunApp O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray.exe O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe" O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe" O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ChkMail] €<Œ O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0 O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: SlipStream Web Accelerator.lnk = C:\Program Files\SlipStream Web Accelerator\slipaccel.exe O4 - Global Startup: Picture Package VCD Maker.lnk = ? O4 - Global Startup: Picture Package Menu.lnk = ? O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\SlipStream Web Accelerator\slipaccel.exe/250 O8 - Extra context menu item: Show Original Image - res://C:\Program Files\SlipStream Web Accelerator\slipaccel.exe/227 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/... O17 - HKLM\System\CCS\Services\Tcpip\..\{C25442A6-B1C4-4B52-823B-28638962A665}: NameServer = 202.180.64.2 202.180.64.9 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

smitFraudFix response SmitFraudFix v2.174 Scan done at 14:53:37.43, 04/05/2007 Run from C:\Documents and Settings\cris\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Protection Tools\bpmon.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Acer\Notebook Manager\almxptray.exe C:\Program Files\Launch Manager\LaunchAp.exe C:\Program Files\Launch Manager\PowerKey.exe C:\Program Files\Launch Manager\HotkeyApp.exe C:\Program Files\Launch Manager\CtrlVol.exe C:\Program Files\Launch Manager\Wbutton.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ltmoh\Ltmoh.exe C:\Program Files\Protection Tools\bpmini.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\SlipStream Web Accelerator\slipaccel.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\WordWeb\wweb32.exe C:\WINDOWS\System32\cmd.exe C:\WINDOWS\System32\wbem\wmiprvse.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\lcsrsrv.dll FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\cris »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\cris\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND ! C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\cris\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{f38b1b2b-4976-46dd-9fe5-60fde72f0b4d}"="huet" [HKEY_CLASSES_ROOT\CLSID\{f38b1b2b-4976-46dd-9fe5-60fde72f0b4d}\InProcServer32] @="C:\WINDOWS\System32\lcsrsrv.dll" [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{f38b1b2b-4976-46dd-9fe5-60fde72f0b4d}\InProcServer32] @="C:\WINDOWS\System32\lcsrsrv.dll" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32 »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: WAN (PPP/SLIP) Interface DNS Server Search Order: 202.180.64.2 DNS Server Search Order: 202.180.64.9 HKLM\SYSTEM\CCS\Services\Tcpip\..\{C25442A6-B1C4-4B52-823B-28638962A665}: NameServer=202.180.64.2 202.180.64.9 HKLM\SYSTEM\CS1\Services\Tcpip\..\{C25442A6-B1C4-4B52-823B-28638962A665}: NameServer=202.180.64.2 202.180.64.9 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Once in Safe Mode, open the "SmitfraudFix" folder again and double-click "smitfraudfix.cmd" Select option #2 - Clean by typing 2 and press "Enter" to delete infected files. You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing " Y " and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if "wininet.dll " is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing "Y" and press "Enter". The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply. The report can also be found at the root of the system drive, usually at C:\rapport.txt and post a new Hijack This log please.

SmitFraudFix v2.174 Scan done at 16:08:44.90, 04/05/2007 Run from C:\Documents and Settings\cris\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 www.doubleclick.net 127.0.0.1 ad.preferances.com 127.0.0.1 ad.doubleclick.com 127.0.0.1 ads.web.aol.com 127.0.0.1 ad.doubleclick.net 127.0.0.1 ad.preferences.com 127.0.0.1 ad.washingtonpost.com 127.0.0.1 adpick.switchboard.com 127.0.0.1 ads.doubleclick.com 127.0.0.1 ads.infospace.com 127.0.0.1 ads.msn.com 127.0.0.1 ads.switchboard.com 127.0.0.1 ads.enliven.com 127.0.0.1 oz.valueclick.com 127.0.0.1 doubleclick.net 127.0.0.1 ads.doubleclick.net 127.0.0.1 ad2.doubleclick.net 127.0.0.1 ad3.doubleclick.net 127.0.0.1 ad4.doubleclick.net 127.0.0.1 ad5.doubleclick.net 127.0.0.1 ad6.doubleclick.net 127.0.0.1 ad7.doubleclick.net 127.0.0.1 ad8.doubleclick.net 127.0.0.1 ad9.doubleclick.net 127.0.0.1 ad10.doubleclick.net 127.0.0.1 ad11.doubleclick.net 127.0.0.1 ad12.doubleclick.net 127.0.0.1 ad13.doubleclick.net 127.0.0.1 ad14.doubleclick.net 127.0.0.1 ad15.doubleclick.net 127.0.0.1 ad16.doubleclick.net 127.0.0.1 ad17.doubleclick.net 127.0.0.1 ad18.doubleclick.net 127.0.0.1 ad19.doubleclick.net 127.0.0.1 ad20.doubleclick.net 127.0.0.1 ad.ch.doubleclick.net 127.0.0.1 ad.linkexchange.com 127.0.0.1 banner.linkexchange.com 127.0.0.1 ads*.focalink.com 127.0.0.1 ads.imdb.com 127.0.0.1 commonwealth.riddler.com 127.0.0.1 globaltrak.net 127.0.0.1 nrsite.com 127.0.0.1 www.nrsite.com 127.0.0.1 ad-up.com 127.0.0.1 ad.adsmart.net 127.0.0.1 ad.atlas.cz 127.0.0.1 ad.blm.net 127.0.0.1 ad.dogpile.com 127.0.0.1 ad.infoseek.com 127.0.0.1 ad.net-service.de 127.0.0.1 ad.preferences.com 127.0.0.1 ad.vol.at 127.0.0.1 adbot.com 127.0.0.1 adbureau.net 127.0.0.1 adcount.hollywood.com 127.0.0.1 add.yaho.com 127.0.0.1 adex3.flycast.com 127.0.0.1 adforce.adtech.de 127.0.0.1 adforce.imgis.com 127.0.0.1 adimage.blm.net 127.0.0.1 adlink.deh.de 127.0.0.1 ads.criticalmass.com 127.0.0.1 ads.csi.emcweb.com 127.0.0.1 ads.filez.com 127.0.0.1 ads.imagine-inc.com 127.0.0.1 ads.imdb.com 127.0.0.1 ads.infospace.com 127.0.0.1 ads.jwtt3.com 127.0.0.1 ads.mirrormedia.co.uk 127.0.0.1 ads.msn.com 127.0.0.1 ads.narrowline.com 127.0.0.1 ads.newcitynet.com 127.0.0.1 ads.realcities.com 127.0.0.1 ads.realmedia.com 127.0.0.1 ads.switchboard.com 127.0.0.1 ads.tripod.com 127.0.0.1 ads.usatoday.com 127.0.0.1 ads.washingtonpost.com 127.0.0.1 ads.web.de 127.0.0.1 ads.web21.com 127.0.0.1 adserv.newcentury.net 127.0.0.1 adservant.guj.de 127.0.0.1 adservant.mediapoint.de 127.0.0.1 adserver-espnet.sportszone.com 127.0.0.1 advert.heise.de 127.0.0.1 banners.internetextra.com 127.0.0.1 bannerswap.com 127.0.0.1 dino.mainz.ibm.de 127.0.0.1 ganges.imagine-inc.com 127.0.0.1 globaltrack.com 127.0.0.1 207-87-18-203.wsmg.digex.net 127.0.0.1 garden.ngadcenter.net 127.0.0.1 ogilvy.ngadcenter.net 127.0.0.1 responsemedia-ad.flycast.com 127.0.0.1 suissa-ad.flycast.com 127.0.0.1 ugo.eu-adcenter.net 127.0.0.1 vnu.eu-adcenter.net 127.0.0.1 ad-adex3.flycast.com 127.0.0.1 ad.adsmart.net 127.0.0.1 ad.ca.doubleclick.net 127.0.0.1 ad.de.doubleclick.net 127.0.0.1 ad.fr.doubleclick.net 127.0.0.1 ad.jp.doubleclick.net 127.0.0.1 ad.linkexchange.com 127.0.0.1 ad.linksynergy.com 127.0.0.1 ad.nl.doubleclick.net 127.0.0.1 ad.no.doubleclick.net 127.0.0.1 ad.sma.punto.net 127.0.0.1 ad.uk.doubleclick.net 127.0.0.1 ad.webprovider.com 127.0.0.1 ad08.focalink.com 127.0.0.1 adcontroller.unicast.com 127.0.0.1 adcreatives.imaginemedia.com 127.0.0.1 adforce.ads.imgis.com 127.0.0.1 adforce.imgis.com 127.0.0.1 adfu.blockstackers.com 127.0.0.1 adimages.earthweb.com 127.0.0.1 adimg.egroups.com 127.0.0.1 admedia.xoom.com 127.0.0.1 adremote.pathfinder.com 127.0.0.1 ads.admaximize.com 127.0.0.1 ads.bfast.com 127.0.0.1 ads.clickhouse.com 127.0.0.1 ads.fairfax.com.au 127.0.0.1 ads.fool.com 127.0.0.1 ads.freshmeat.net 127.0.0.1 ads.hollywood.com 127.0.0.1 ads.i33.com 127.0.0.1 ads.infi.net 127.0.0.1 ads.link4ads.com 127.0.0.1 ads.lycos.com 127.0.0.1 ads.madison.com 127.0.0.1 ads.mediaodyssey.com 127.0.0.1 ads.msn.com 127.0.0.1 ads.ninemsn.com.au 127.0.0.1 ads.seattletimes.com 127.0.0.1 ads.smartclicks.com 127.0.0.1 ads.smartclicks.net 127.0.0.1 ads.sptimes.com 127.0.0.1 ads.web.aol.com 127.0.0.1 ads.x10.com 127.0.0.1 ads.xtra.co.nz 127.0.0.1 ads.zdnet.com 127.0.0.1 ads01.focalink.com 127.0.0.1 ads02.focalink.com 127.0.0.1 ads03.focalink.com 127.0.0.1 ads04.focalink.com 127.0.0.1 ads05.focalink.com 127.0.0.1 ads06.focalink.com 127.0.0.1 ads08.focalink.com 127.0.0.1 ads09.focalink.com 127.0.0.1 ads1.activeagent.at 127.0.0.1 ads10.focalink.com 127.0.0.1 ads11.focalink.com 127.0.0.1 ads12.focalink.com 127.0.0.1 ads14.focalink.com 127.0.0.1 ads16.focalink.com 127.0.0.1 ads17.focalink.com 127.0.0.1 ads18.focalink.com 127.0.0.1 ads19.focalink.com 127.0.0.1 ads2.zdnet.com 127.0.0.1 ads20.focalink.com 127.0.0.1 ads21.focalink.com 127.0.0.1 ads22.focalink.com 127.0.0.1 ads23.focalink.com 127.0.0.1 ads24.focalink.com 127.0.0.1 ads25.focalink.com 127.0.0.1 ads3.zdnet.com 127.0.0.1 ads5.gamecity.net 127.0.0.1 adserv.iafrica.com 127.0.0.1 adserv.quality-channel.de 127.0.0.1 adserver.dbusiness.com 127.0.0.1 adserver.garden.com 127.0.0.1 adserver.janes.com 127.0.0.1 adserver.merc.com 127.0.0.1 adserver.monster.com 127.0.0.1 adserver.track-star.com 127.0.0.1 adserver1.ogilvy-interactive.de 127.0.0.1 adtegrity.spinbox.net 127.0.0.1 antfarm-ad.flycast.com 127.0.0.1 au.ads.link4ads.com 127.0.0.1 banner.media-system.de 127.0.0.1 banner.orb.net 127.0.0.1 banner.relcom.ru 127.0.0.1 banners.easydns.com 127.0.0.1 banners.looksmart.com 127.0.0.1 banners.wunderground.com 127.0.0.1 barnesandnoble.bfast.com 127.0.0.1 beseenad.looksmart.com 127.0.0.1 bizad.nikkeibp.co.jp 127.0.0.1 bn.bfast.com 127.0.0.1 c3.xxxcounter.com 127.0.0.1 califia.imaginemedia.com 127.0.0.1 cds.mediaplex.com 127.0.0.1 click.avenuea.com 127.0.0.1 click.go2net.com 127.0.0.1 click.linksynergy.com 127.0.0.1 cookies.cmpnet.com 127.0.0.1 cornflakes.pathfinder.com 127.0.0.1 counter.hitbox.com 127.0.0.1 crux.songline.com 127.0.0.1 erie.smartage.com 127.0.0.1 etad.telegraph.co.uk 127.0.0.1 fp.valueclick.com 127.0.0.1 gadgeteer.pdamart.com 127.0.0.1 gm.preferences.com 127.0.0.1 gp.dejanews.com 127.0.0.1 hg1.hitbox.com 127.0.0.1 image.click2net.com 127.0.0.1 image.eimg.com 127.0.0.1 images2.nytimes.com 127.0.0.1 jobkeys.ngadcenter.net 127.0.0.1 kansas.valueclick.com 127.0.0.1 leader.linkexchange.com 127.0.0.1 liquidad.narrowcastmedia.com 127.0.0.1 ln.doubleclick.net 127.0.0.1 m.doubleclick.net 127.0.0.1 macaddictads.snv.futurenet.com 127.0.0.1 maximumpcads.imaginemedia.com 127.0.0.1 media.preferences.com 127.0.0.1 mercury.rmuk.co.uk 127.0.0.1 mojofarm.sjc.mediaplex.com 127.0.0.1 nbc.adbureau.net 127.0.0.1 newads.cmpnet.com 127.0.0.1 ng3.ads.warnerbros.com 127.0.0.1 ngads.smartage.com 127.0.0.1 nsads.hotwired.com 127.0.0.1 ntbanner.digitalriver.com 127.0.0.1 ph-ad05.focalink.com 127.0.0.1 ph-ad07.focalink.com 127.0.0.1 ph-ad16.focalink.com 127.0.0.1 ph-ad17.focalink.com 127.0.0.1 ph-ad18.focalink.com 127.0.0.1 realads.realmedia.com 127.0.0.1 redherring.ngadcenter.net 127.0.0.1 redirect.click2net.com 127.0.0.1 retaildirect.realmedia.com 127.0.0.1 s2.focalink.com 127.0.0.1 sh4sure-images.adbureau.net 127.0.0.1 spin.spinbox.net 127.0.0.1 static.admaximize.com 127.0.0.1 stats.superstats.com 127.0.0.1 sview.avenuea.com 127.0.0.1 thinknyc.eu-adcenter.net 127.0.0.1 tracker.clicktrade.com 127.0.0.1 tsms-ad.tsms.com 127.0.0.1 v0.extreme-dm.com 127.0.0.1 v1.extreme-dm.com 127.0.0.1 van.ads.link4ads.com 127.0.0.1 view.accendo.com 127.0.0.1 view.avenuea.com 127.0.0.1 w113.hitbox.com 127.0.0.1 w25.hitbox.com 127.0.0.1 web2.deja.com 127.0.0.1 webads.bizservers.com 127.0.0.1 www.postmasterbannernet.com 127.0.0.1 www.ad-up.com 127.0.0.1 www.admex.com 127.0.0.1 www.alladvantage.com 127.0.0.1 www.burstnet.com 127.0.0.1 www.commission-junction.com 127.0.0.1 www.eads.com 127.0.0.1 www.freestats.com 127.0.0.1 www.imaginemedia.com 127.0.0.1 www.netdirect.nl 127.0.0.1 www.oneandonlynetwork.com 127.0.0.1 www.targetshop.com 127.0.0.1 www.teknosurf2.com 127.0.0.1 www.teknosurf3.com 127.0.0.1 www.valueclick.com 127.0.0.1 www.websitefinancing.com 127.0.0.1 www2.burstnet.com 127.0.0.1 www4.trix.net 127.0.0.1 www80.valueclick.com 127.0.0.1 z.extreme-dm.com 127.0.0.1 z0.extreme-dm.com 127.0.0.1 z1.extreme-dm.com 127.0.0.1 ads.forbes.net 127.0.0.1 ads.newcity.com 127.0.0.1 ads.ign.com 127.0.0.1 adserver.ign.com 127.0.0.1 ads.scifi.com 127.0.0.1 adengine.theglobe.com 127.0.0.1 ads.tucows.com 127.0.0.1 adcontent.gamespy.com 127.0.0.1 ads4.advance.net 127.0.0.1 ads1.advance.net 127.0.0.1 eur.yimg.com 127.0.0.1 us.a1.yimg.com 127.0.0.1 ad.harmony-central.com 127.0.0.1 sg.yimg.com 127.0.0.1 adverity.adverity.com 127.0.0.1 ads.bloomberg.com 127.0.0.1 mojofarm.mediaplex.com 127.0.0.1 ads.mysimon.com 127.0.0.1 ad.img.yahoo.co.kr 127.0.0.1 adimages.go.com 127.0.0.1 kr-adimage.lycos.co.kr 127.0.0.1 ad.kimo.com.tw 127.0.0.1 ads.paxnet.co.kr 127.0.0.1 ads.paxnet.com 127.0.0.1 ads.eu.msn.com 127.0.0.1 ads.admonitor.net 127.0.0.1 wwa.hitbox.com 127.0.0.1 ads.nytimes.com 127.0.0.1 ads.erotism.com 127.0.0.1 banner.rootsweb.com 127.0.0.1 ads.ole.com 127.0.0.1 adimg1.chosun.com 127.0.0.1 ss.mtree.com 127.0.0.1 adpulse.ads.targetnet.com 127.0.0.1 adserver.ugo.com 127.0.0.1 ad.sales.olympics.com 127.0.0.1 m2.doubleclick.net 127.0.0.1 ph-ad21.focalink.com 127.0.0.1 focusin.ads.targetnet.com 127.0.0.1 www.datais.com 127.0.0.1 oas.mmd.ch 127.0.0.1 pub-g.ifrance.com 127.0.0.1 ads.bianca.com 127.0.0.1 wap.adlink.de 127.0.0.1 click.adlink.de 127.0.0.1 banner.adlink.de 127.0.0.1 hurricane.adlink.de 127.0.0.1 west.adlink.de 127.0.0.1 scand.adlink.de 127.0.0.1 regio.adlink.de 127.0.0.1 direct.adlink.de 127.0.0.1 classic.adlink.de 127.0.0.1 adlui001.adlink.de 127.0.0.1 banner1.adlink.de 127.0.0.1 click.mp3.com 127.0.0.1 adcodes.bla-bla.com 127.0.0.1 icover.realmedia.com 127.0.0.1 ca.fp.sandpiper.net 127.0.0.1 adfarm.mediaplex.com 127.0.0.1 ads.tmcs.net 127.0.0.1 amedia.techies.com 127.0.0.1 www.exchange-it.com 127.0.0.1 www.ad.tomshardware.com 127.0.0.1 ad.tomshardware.com 127.0.0.1 ads.currantbun.com 127.0.0.1 phoenix-adrunner.mycomputer.com 127.0.0.1 ads15.focalink.com 127.0.0.1 ads13.focalink.com 127.0.0.1 adserver.colleges.com 127.0.0.1 ads.nwsource.com 127.0.0.1 ads.guardianunlimited.co.uk 127.0.0.1 ads.newsint.co.uk 127.0.0.1 ads.starnews.com 127.0.0.1 www.linksynergy.com 127.0.0.1 ieee-images.adbureau.net 127.0.0.1 connect.247media.ads.link4ads.com 127.0.0.1 ads.newsdigital.net 127.0.0.1 arc5.msn.com 127.0.0.1 arc4.msn.com 127.0.0.1 arc3.msn.com 127.0.0.1 arc2.msn.com 127.0.0.1 arc1.msn.com 127.0.0.1 ads.discovery.com 127.0.0.1 im.800.com 127.0.0.1 img.cmpnet.com 127.0.0.1 ad7.internetadserver.com 127.0.0.1 ads.dai.net 127.0.0.1 ads.cbc.ca 127.0.0.1 www75.valueclick.com 127.0.0.1 ads.clearbluemedia.com 127.0.0.1 ti.click2net.com 127.0.0.1 www.onresponse.com 127.0.0.1 ads.list-universe.com 127.0.0.1 advert.bayarea.com 127.0.0.1 www3.pagecount.com 127.0.0.1 www.netsponsors.com 127.0.0.1 adthru.com 127.0.0.1 ads.newtimes.com 127.0.0.1 ads.ugo.com 127.0.0.1 ads.belointeractive.com 127.0.0.1 wwb.hitbox.com 127.0.0.1 comtrack.comclick.com 127.0.0.1 www.24pm-affiliation.com 127.0.0.1 www.click-fr.com 127.0.0.1 www.cibleclick.com 127.0.0.1 reply.mediatris.net 127.0.0.1 cgi.declicnet.com 127.0.0.1 pubs.mgn.net 127.0.0.1 ads.mcafee.com 127.0.0.1 ads1.ad-flow.com 127.0.0.1 ad.be.doubleclick.net 127.0.0.1 ad.adtraq.com 127.0.0.1 ad.sg.doubleclick.net 127.0.0.1 adpop.theglobe.com 127.0.0.1 ads-03.tor.focusin.ads.targetnet.com 127.0.0.1 ads.adflight.com 127.0.0.1 ads.detelefoongids.nl 127.0.0.1 ads.ecircles.com 127.0.0.1 ads.god.co.uk 127.0.0.1 ads.hyperbanner.net 127.0.0.1 ads.jpost.com 127.0.0.1 ads.netmechanic.com 127.0.0.1 ads.webcash.nl 127.0.0.1 adserver.netcast.nl 127.0.0.1 adserver.webads.com 127.0.0.1 adserver.webads.nl 127.0.0.1 adserver1.realtracker.com 127.0.0.1 adserver2.realtracker.com 127.0.0.1 adserver3.realtracker.com 127.0.0.1 delivery1.ads.telegraaf.nl 127.0.0.1 holland.hyperbanner.net 127.0.0.1 images.webads.nl 127.0.0.1 sc.clicksupply.com 127.0.0.1 service.bfast.com 127.0.0.1 www.ad4ex.com 127.0.0.1 www.bannercampaign.com 127.0.0.1 www.cyberbounty.com 127.0.0.1 www.netvertising.be 127.0.0.1 www.speedyclick.com 127.0.0.1 www.webads.nl 127.0.0.1 ads.snowball.com 127.0.0.1 ads.amazingmedia.com 127.0.0.1 www10.valueclick.com 127.0.0.1 js1.hitbox.com 127.0.0.1 rd1.hitbox.com 127.0.0.1 mt37.mtree.com 127.0.0.1 ads.gameanswers.com 127.0.0.1 ads7.udc.advance.net 127.0.0.1 www23.valueclick.com 127.0.0.1 ads.fortunecity.com 127.0.0.1 banners.nextcard.com 127.0.0.1 ads.iwon.com 127.0.0.1 www.qksrv.net 127.0.0.1 clickserve.cc-dt.com 127.0.0.1 ads-b.focalink.com 127.0.0.1 ad2.peel.com 127.0.0.1 ads.floridatoday.com 127.0.0.1 stats.adultrevenueservice.com 127.0.0.1 ads18.bpath.com 127.0.0.1 ph-ad06.focalink.com 127.0.0.1 global.msads.net 127.0.0.1 pluto1.iserver.net 127.0.0.1 ads1.intelliads.com 127.0.0.1 primetime.ad.asap-asp.net 127.0.0.1 ads.stileproject.com 127.0.0.1 di.image.eshop.msn.com 127.0.0.1 www.blissnet.net 127.0.0.1 www.consumerinfo.com 127.0.0.1 ads.rottentomatoes.com 127.0.0.1 k5ads.osdn.com 127.0.0.1 actionsplash.com 127.0.0.1 campaigns.f2.com.au 127.0.0.1 adserver.news.com.au 127.0.0.1 servedby.advertising.com 127.0.0.1 java.yahoo.com 127.0.0.1 ad.howstuffworks.com 127.0.0.1 ads.1for1.com 127.0.0.1 images.ads.fairfax.com.au 127.0.0.1 ads.devx.com 127.0.0.1 utils.mediageneral.com 127.0.0.1 banners.friendfinder.com 127.0.0.1 adserver.matchcraft.com 127.0.0.1 www.dnps.com 127.0.0.1 creative.whi.co.nz 127.0.0.1 rmedia.boston.com 127.0.0.1 webaffiliate.covad.com 127.0.0.1 ad.iwin.com 127.0.0.1 www.nailitonline2.com 127.0.0.1 mds.centrport.net 127.0.0.1 oas.dispatch.com 127.0.0.1 adserver.ads360.com 127.0.0.1 banners.adultfriendfinder.com 127.0.0.1 ads.as4x.tmcs.net 127.0.0.1 ads.clickagents.com 127.0.0.1 banners.chek.com 127.0.0.1 zi.r.tv.com 127.0.0.1 ph-ad19.focalink.com 127.0.0.1 ads.greensboro.com 127.0.0.1 ad2.adcept.net 127.0.0.1 ads.colo.kiva.net 127.0.0.1 adsrv.iol.co.za 127.0.0.1 mjxads.internet.com 127.0.0.1 adimage.asiaone.com.sg 127.0.0.1 ads.vnuemedia.com 127.0.0.1 affiliate.doteasy.com 127.0.0.1 m.tribalfusion.com 127.0.0.1 oas.lee.net 127.0.0.1 www.banneroverdrive.com 127.0.0.1 ad3.peel.com 127.0.0.1 ad1.peel.comwww.xbn.ru 127.0.0.1 adserver.snowball.com 127.0.0.1 media15.fastclick.net 127.0.0.1 ads5.advance.net 127.0.0.1 ads3.advance.net 127.0.0.1 ads2.advance.net 127.0.0.1 ads.advance.net 127.0.0.1 usbytecom.orbitcycle.com 127.0.0.1 adbanner.sweepsclub.com 127.0.0.1 oas.villagevoice.com 127.0.0.1 www.ad-flow.com 127.0.0.1 ads.guardian.co.uk 127.0.0.1 ads.hitcents.com 127.0.0.1 media19.fastclick.net 127.0.0.1 a.tribalfusion.com 127.0.0.1 ads.nypost.com 127.0.0.1 ads.premiumnetwork.com 127.0.0.1 ads.ad-flow.com 127.0.0.1 adserver.hispavista.com 127.0.0.1 ads.musiccity.com 127.0.0.1 banners.revenuelink.com 127.0.0.1 ads1.sptimes.com 127.0.0.1 adserver.bizland-inc.net 127.0.0.1 ads.adtegrity.net 127.0.0.1 media13.fastclick.net 127.0.0.1 adserver.ukplus.co.uk 127.0.0.1 ads.live365.com 127.0.0.1 ads.fredericksburg.com 127.0.0.1 banners.affiliatefuel.com 127.0.0.1 ar.atwola.com 127.0.0.1 ads.bigcitytools.com 127.0.0.1 netshelter.adtrix.com 127.0.0.1 y.ibsys.com 127.0.0.1 adserver.nydailynews.com 127.0.0.1 s0b.bluestreak.com 127.0.0.1 images.scripps.com 127.0.0.1 images.cybereps.com 127.0.0.1 altfarm.mediaplex.com 127.0.0.1 krd.realcities.com 127.0.0.1 www3.bannerspace.com 127.0.0.1 view.atdmt.com 127.0.0.1 ads7.advance.net 127.0.0.1 ad.abcnews.com 127.0.0.1 ads.newsquest.co.uk 127.0.0.1 secure.webconnect.net 127.0.0.1 ads.nandomedia.com 127.0.0.1 banners.babylon-x.com 127.0.0.1 media17.fastclick.net 127.0.0.1 techreview-images.adbureau.net 127.0.0.1 ads.exhedra.com 127.0.0.1 ad.trafficmp.com 127.0.0.1 realmedia-a800.d4p.net 127.0.0.1 banner.northsky.com 127.0.0.1 ftp.nacorp.com 127.0.0.1 www.digitalbettingcasinos.com 127.0.0.1 c1.zedo.com 127.0.0.1 ads4.condenet.com 127.0.0.1 www.brilliantdigital.com 127.0.0.1 desktop.kazaa.com 127.0.0.1 shop.kazaa.com 127.0.0.1 www.bonzi.com 127.0.0.1 www.b3d.com 127.0.0.1 neighborhood.standard.net 127.0.0.1 ads.telegraph.co.uk 127.0.0.1 spinbox.techtracker.com 127.0.0.1 toads.osdn.com 127.0.0.1 ads.themes.org 127.0.0.1 adserver.trb.com 127.0.0.1 media.fastclick.net 127.0.0.1 banner.easyspace.com 127.0.0.1 www.banner2u.com 127.0.0.1 ads.thestar.com 127.0.0.1 ads.digitalmedianet.com 127.0.0.1 www.fineclicks.com 127.0.0.1 ads.mdchoice.com 127.0.0.1 ad.horvitznewspapers.net 127.0.0.1 adtegrity.thruport.com 127.0.0.1 a.mktw.net 127.0.0.1 ads.pennyweb.com 127.0.0.1 www3.ad.tomshardware.com 127.0.0.1 www4.ad.tomshardware.com 127.0.0.1 www6.ad.tomshardware.com 127.0.0.1 www8.ad.tomshardware.com 127.0.0.1 www15.ad.tomshardware.com 127.0.0.1 ads.forbes.com 127.0.0.1 ads.desmoinesregister.com 127.0.0.1 adserver.tribuneinteractive.com 127.0.0.1 bannerads.anytimenews.com 127.0.0.1 ads1.condenet.com 127.0.0.1 adserver.anm.co.uk 127.0.0.1 zrap.zdnet.com.com 127.0.0.1 bidclix.net 127.0.0.1 media.popuptraffic.com 127.0.0.1 coreg.flashtrack.net 127.0.0.1 rmads.msn.com 127.0.0.1 ads.icq.com 127.0.0.1 cb.icq.com 127.0.0.1 cf.icq.com 127.0.0.1 www2.newtopsites.com 127.0.0.1 adserv.internetfuel.com 127.0.0.1 images.fastclick.net 127.0.0.1 adserver.securityfocus.com 127.0.0.1 www.avsads.com 127.0.0.1 banners.moviegoods.com 127.0.0.1 ads.bitsonthewire.com 127.0.0.1 ads.iambic.com 127.0.0.1 sfads.osdn.com 127.0.0.1 fl01.ct2.comclick.com 127.0.0.1 adserver.phillyburbs.com 127.0.0.1 marketing.nyi.net 127.0.0.1 www.netflip.com 127.0.0.1 image.imgfarm.com 127.0.0.1 ads.viaarena.com 127.0.0.1 phpads2.cnpapers.com 127.0.0.1 ads.astalavista.us 127.0.0.1 banner.coza.com 127.0.0.1 adcreative.tribuneinteractive.com 127.0.0.1 ads.democratandchronicle.com 127.0.0.1 adlog.com.com 127.0.0.1 adimg.com.com 127.0.0.1 adimage.bankrate.com 127.0.0.1 ads.mediadevil.com 127.0.0.1 imageserv.adtech.de 127.0.0.1 ad.se.doubleclick.net 127.0.0.1 ads.cashsurfers.com 127.0.0.1 ads.specificpop.com 127.0.0.1 z1.adserver.com 127.0.0.1 images.bizrate.com 127.0.0.1 q.pni.com 127.0.0.1 ad01.mediacorpsingapore.com 127.0.0.1 adimage.asia1.com.sg 127.0.0.1 images.newsx.cc 127.0.0.1 www.adireland.com 127.0.0.1 ads.iafrica.com 127.0.0.1 ads.nyi.net 127.0.0.1 geoads.osdn.com 127.0.0.1 www.crisscross.com 127.0.0.1 netcomm.spinbox.net 127.0.0.1 i.i.com.com 127.0.0.1 ads.videoaxs.com 127.0.0.1 mediamgr.ugo.com 127.0.0.1 adserver.pollstar.com 127.0.0.1 information.gopher.com 127.0.0.1 ads.adviva.net 127.0.0.1 adsrv.bankrate.com 127.0.0.1 a207.p.f.qz3.net 127.0.0.1 ehg-bestbuy.hitbox.com 127.0.0.1 ehg-intel.hitbox.com 127.0.0.1 ehg-espn.hitbox.com 127.0.0.1 ehg-macromedia.hitbox.com 127.0.0.1 ehg-dig.hitbox.com 127.0.0.1 speed.pointroll.com 127.0.0.1 amch.questionmarket.com 127.0.0.1 ads.gamespy.com 127.0.0.1 spd.atdmt.com 127.0.0.1 ads.columbian.com 127.0.0.1 clickit.go2net.com 127.0.0.1 vpdc.ru4.com 127.0.0.1 ads.developershed.com 127.0.0.1 ads.globeandmail.com 127.0.0.1 ads.nerve.com 127.0.0.1 iv.doubleclick.net 127.0.0.1 ads2.condenet.com 127.0.0.1 www.burstnet.com 127.0.0.1 ads5.canoe.ca 127.0.0.1 askmen.thruport.com 127.0.0.1 adsrv2.gainesvillesun.com 127.0.0.1 ads.theolympian.com 127.0.0.1 ads.courierpostonline.com 127.0.0.1 i.timeinc.net 127.0.0.1 oasads.whitepages.com 127.0.0.1 rad.msn.com 127.0.0.1 serve.thisbanner.com 127.0.0.1 images.trafficmp.com 127.0.0.1 www.kaplanindex.com 127.0.0.1 kaplanindex.com 127.0.0.1 1.httpdads.com 127.0.0.1 spinbox.maccentral.com 127.0.0.1 akaads-abc.starwave.com 127.0.0.1 webad.ajeeb.com 127.0.0.1 ads.granadamedia.com 127.0.0.1 oas.uniontrib.com 127.0.0.1 ads.wnd.com 127.0.0.1 a3.suntimes.com 127.0.0.1 tmsads.tribune.com 127.0.0.1 ads.peel.com 127.0.0.1 ads.mh5.com 127.0.0.1 ad.usatoday.com 127.0.0.1 adserver.digitalpartners.com 127.0.0.1 ads.mediaturf.net 127.0.0.1 ads4.clearchannel.com 127.0.0.1 ads.clearchannel.com 127.0.0.1 ads2.clearchannel.com 127.0.0.1 ads.jacksonsun.com 127.0.0.1 servads.aip.org 127.0.0.1 ad.au.doubleclick.net 127.0.0.1 adng.ascii24.com 127.0.0.1 engage.speedera.net 127.0.0.1 ads.msn-ppe.com 127.0.0.1 ad.openfind.com.tw 127.0.0.1 adi.mainichi.co.jp 127.0.0.1 ads.northjersey.com 127.0.0.1 ad.moscowtimes.ru 127.0.0.1 banners.valuead.com 127.0.0.1 ad1.aaddzz.com 127.0.0.1 ds.eyeblaster.com 127.0.0.1 adserver.digitalpartners.com 127.0.0.1 oas.uniontrib.com 127.0.0.1 ads.statesmanjournal.com 127.0.0.1 ads.centralohio.com »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Logfile of HijackThis v1.99.1 Scan saved at 16:16:44, on 04/05/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\alg.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Acer\Notebook Manager\almxptray.exe C:\Program Files\Launch Manager\LaunchAp.exe C:\Program Files\Launch Manager\PowerKey.exe C:\Program Files\Launch Manager\HotkeyApp.exe C:\Program Files\Launch Manager\CtrlVol.exe C:\Program Files\Launch Manager\Wbutton.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ltmoh\Ltmoh.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\SlipStream Web Accelerator\slipaccel.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe C:\Program Files\WordWeb\wweb32.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.co.nz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://msaps.dll/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.co.nz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = res://msaps.dll/index.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;<local>;*windowsupdate.com;download.microsoft.com;*windowsupdate.microsoft.com;codecs.microsoft.com;activex.microsoft.com;liveupdate.symantecliveupdate.com;liveupdate.symantec.com;service1.symantec.com;*.nai.com;*.networkassociates.com;*.trademe.co.nz R3 - URLSearchHook: (no name) - {FDE3577A-6254-181C-4E11-339E4F746BD3} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {1FC80E00-41B0-4F74-BC16-2C83ED49CAC9} - C:\Program Files\Protection Tools\bpvol.dll O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\SlipStream Web Accelerator\PBHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [LaunchApp] LaunApp O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray.exe O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe" O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe" O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ChkMail] €<Œ O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0 O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: SlipStream Web Accelerator.lnk = C:\Program Files\SlipStream Web Accelerator\slipaccel.exe O4 - Global Startup: Picture Package VCD Maker.lnk = ? O4 - Global Startup: Picture Package Menu.lnk = ? O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\SlipStream Web Accelerator\slipaccel.exe/250 O8 - Extra context menu item: Show Original Image - res://C:\Program Files\SlipStream Web Accelerator\slipaccel.exe/227 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/... O17 - HKLM\System\CCS\Services\Tcpip\..\{C25442A6-B1C4-4B52-823B-28638962A665}: NameServer = 202.180.64.2 202.180.64.9 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe