PC infections multiples ?

Résolu
Bonjour,
avis aux professionnels : j'ai récupéré un PC (IE 7 / XP ) dont on m'a chargé de le sauver d'un formatage assuré ... En effet celui-ci est surinvesté de saltés ( spyware , trj et toute la bande ... ) , j'ai donc penser à vous ... ;)
Le prb majeur est le suivant : impossible de se connecté à internet ; ou ça plante carrément ou une fenêtre s'ouvre sur la 1ere page d'IE (une pâle immitation d'une fenêtre windows ) qui indique de que "mon système contient des spywares,pour un scan GRATUIT cliqué ici " ... mais bien sûr ...
Tout ça sans parler des trj Zlob que Avast a "contrés" au démarage du PC , la quantité de prb que Spybot a mit au placards ...
Ce PC est passé par plusieurs anti vir.( mais sûrement mal utilisés ) et avait un par-feu windows assez mince ( trop de d'exptions de prg risqués validés ) .

je poste donc dans un premier temps un rapport Hijacthis (celui-ci instalé par une clé USB car pas d'internet...)
Si cela dit à quelqu'un de relever le défit (je pense entre autre à toi Papyber...ou à d'autre bien entendu! ).

---sKe---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:08:51, on 07/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe
C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\vsnpstd2.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Player Video TF1\tf1.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Lexmark 3100 Series\lxbrbmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\Hijacthis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 202.67.220.233 win.mail.ru
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
O4 - HKLM\..\Run: [LXBRKsk] C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [tf1] C:\Program Files\Player Video TF1\tf1.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusHeat 3.9] "C:\Program Files\VirusHeat 3.9\VirusHeat 3.9.exe" /h
O4 - HKLM\..\Run: [302af984] rundll32.exe "C:\WINDOWS\system32\xwweaaxi.dll",b
O4 - HKLM\..\Run: [BM3319ca18] Rundll32.exe "C:\WINDOWS\system32\nxdgexgp.dll",s
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://mm.tf1.fr/superdistribution/installer2.cab
O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://11731.kit.carpediem.fr/FanBrigitte.exe
O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{409B6718-9F9C-4AF3-ABC8-AE78D1F9B6D2}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{582FE5DB-BAA2-4CDD-B853-A89611945A07}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F5AA804-0CC1-4E58-9E3B-69926B7D6519}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{684A3E8E-C800-41D9-AA57-E4DDA1A0E49F}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B2BCA9C-B9B9-46A2-AAD8-E754DF44BA00}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{9CB1DE31-7017-42E1-865A-49A545E44CAB}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4039785-BCFB-43E1-A826-FF9063F67734}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O21 - SSODL: bxlrvps - {DF7C5A04-637E-47A5-B282-0DFD09806113} - C:\WINDOWS\bxlrvps.dll (file missing)
O21 - SSODL: alofkmn - {273C56DD-B66C-4DD1-8EFD-DA1F3D09CBF0} - C:\WINDOWS\alofkmn.dll
O22 - SharedTaskScheduler: USB Ware - {E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D} - (no file)
O22 - SharedTaskScheduler: didact - {747e1fbe-b70f-441d-bbca-6e536c04924a} - C:\WINDOWS\system32\wuuawkz.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

--
End of file - 11025 bytes
Configuration: Windows Vista
Internet Explorer 7.0

96 réponses

Résumé de la discussion

Le problème central est un PC sous Windows XP et Internet Explorer 7 infecté par des spywares et trojans, provoquant l'impossibilité de se connecter à Internet et des fenêtres promotionnelles ambiguës. Un rapport HijackThis est fourni et montre des processus et modules suspectés, avec des outils comme Avast, Spyware Doctor et Spybot, soulignant la complexité du nettoyage. Des éléments de configuration, tels que des pages par défaut modifiées et des barres d'outils installées, illustrent l'étendue des modifications malveillantes et corroboraient la nécessité d'un nettoyage en profondeur. En cas de suite, les recommandations pourraient privilégier une approche par étapes: diagnostic hors ligne, suppression des éléments persistants et réinstallation sélective des composants critiques pour restaurer une configuration fiable.

Bobot (l’IA à votre service)
  1. Contributeur sécurité
    rapport en examen
    1. AAAAHHHH!!!!!! je savais que je pouvais compter sur toi !!! Tu es un homme de tous les défis ... ;) Et quel rapidité !
  2. Contributeur sécurité
    c'est parti
    Télécharge SmitfraudFix de S!Ri, balltrap34 et moe31
    http://siri.urz.free.fr/Fix
    Installe le à la racine de C\ : double clique sur l'exe pour le décompresser et lancer le fix.
    Utilisation ----- option 1 - Recherche :
    Double clique sur smitfraudfix.cmd Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.
    Poste le rapport
    Attention : process.exe est détecté par certains antivirus comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.
    1. petite info : ce fameux PC est en multi-séssions ( toda la belle-familia en administrateur ) ... c'est une configuration un peu étrangère pour moi .
  3. voici le rap. SmitfraudFix :

    SmitFraudFix v2.300

    Rapport fait à 16:54:50,00, 07/03/2008
    Executé à partir de C:\SmitfraudFix
    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
    Le type du système de fichiers est NTFS
    Fix executé en mode normal

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\windows\system\hpsysdrv.exe
    C:\HP\KBD\KBD.EXE
    C:\WINDOWS\system32\keyhook.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe
    C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\WINDOWS\vsnpstd2.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\Player Video TF1\tf1.exe
    C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
    C:\Program Files\Lexmark 3100 Series\lxbrbmon.exe
    C:\WINDOWS\system32\cmd.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    Fichier hosts corrompu !

    127.0.0.1 www.legal-at-spybot.info
    127.0.0.1 legal-at-spybot.info

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    C:\WINDOWS\system32\ot.ico PRESENT !
    C:\WINDOWS\system32\1024\ PRESENT !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Compaq_Propri‚taire

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Compaq_Propri‚taire\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

    C:\DOCUME~1\ALLUSE~1\MENUDM~1\Online Security Guide.url PRESENT !
    C:\DOCUME~1\ALLUSE~1\MENUDM~1\Security Troubleshooting.url PRESENT !

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\COMPAQ~1\Favoris

    »»»»»»»»»»»»»»»»»»»»»»»» Bureau

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    C:\Program Files\VirusHeat 3.9\ PRESENT !

    »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

    »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Ma page d'accueil"

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    [!] Suspicious: alofkmn.dll
    SSODL: alofkmn - {273C56DD-B66C-4DD1-8EFD-DA1F3D09CBF0}

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"="USB Ware"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{747e1fbe-b70f-441d-bbca-6e536c04924a}"="didact"

    [HKEY_CLASSES_ROOT\CLSID\{747e1fbe-b70f-441d-bbca-6e536c04924a}\InProcServer32]
    @="C:\WINDOWS\system32\wuuawkz.dll"

    [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{747e1fbe-b70f-441d-bbca-6e536c04924a}\InProcServer32]
    @="C:\WINDOWS\system32\wuuawkz.dll"

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"="kdqyc.exe"

    kdqyc.exe détecté !

    »»»»»»»»»»»»»»»»»»»»»»»» Rustock

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{409B6718-9F9C-4AF3-ABC8-AE78D1F9B6D2}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{4A8F6892-852D-4445-B0AC-CBDD972B1F58}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{582FE5DB-BAA2-4CDD-B853-A89611945A07}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{582FE5DB-BAA2-4CDD-B853-A89611945A07}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{5F5AA804-0CC1-4E58-9E3B-69926B7D6519}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{5F5AA804-0CC1-4E58-9E3B-69926B7D6519}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{684A3E8E-C800-41D9-AA57-E4DDA1A0E49F}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{684A3E8E-C800-41D9-AA57-E4DDA1A0E49F}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{8B2BCA9C-B9B9-46A2-AAD8-E754DF44BA00}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{8B2BCA9C-B9B9-46A2-AAD8-E754DF44BA00}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{9CB1DE31-7017-42E1-865A-49A545E44CAB}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{9CB1DE31-7017-42E1-865A-49A545E44CAB}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{C4039785-BCFB-43E1-A826-FF9063F67734}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{C4039785-BCFB-43E1-A826-FF9063F67734}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{409B6718-9F9C-4AF3-ABC8-AE78D1F9B6D2}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{4A8F6892-852D-4445-B0AC-CBDD972B1F58}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{582FE5DB-BAA2-4CDD-B853-A89611945A07}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{582FE5DB-BAA2-4CDD-B853-A89611945A07}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{5F5AA804-0CC1-4E58-9E3B-69926B7D6519}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{5F5AA804-0CC1-4E58-9E3B-69926B7D6519}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{684A3E8E-C800-41D9-AA57-E4DDA1A0E49F}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{684A3E8E-C800-41D9-AA57-E4DDA1A0E49F}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{8B2BCA9C-B9B9-46A2-AAD8-E754DF44BA00}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{8B2BCA9C-B9B9-46A2-AAD8-E754DF44BA00}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{9CB1DE31-7017-42E1-865A-49A545E44CAB}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{9CB1DE31-7017-42E1-865A-49A545E44CAB}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{C4039785-BCFB-43E1-A826-FF9063F67734}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{C4039785-BCFB-43E1-A826-FF9063F67734}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{409B6718-9F9C-4AF3-ABC8-AE78D1F9B6D2}: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{409B6718-9F9C-4AF3-ABC8-AE78D1F9B6D2}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{4A8F6892-852D-4445-B0AC-CBDD972B1F58}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{582FE5DB-BAA2-4CDD-B853-A89611945A07}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{582FE5DB-BAA2-4CDD-B853-A89611945A07}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{5F5AA804-0CC1-4E58-9E3B-69926B7D6519}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{5F5AA804-0CC1-4E58-9E3B-69926B7D6519}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{684A3E8E-C800-41D9-AA57-E4DDA1A0E49F}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{684A3E8E-C800-41D9-AA57-E4DDA1A0E49F}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{8B2BCA9C-B9B9-46A2-AAD8-E754DF44BA00}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{8B2BCA9C-B9B9-46A2-AAD8-E754DF44BA00}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{9CB1DE31-7017-42E1-865A-49A545E44CAB}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{9CB1DE31-7017-42E1-865A-49A545E44CAB}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{C4039785-BCFB-43E1-A826-FF9063F67734}: DhcpNameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{C4039785-BCFB-43E1-A826-FF9063F67734}: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=208.67.220.220,208.67.222.222

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin
    1. Contributeur sécurité
      Redémarrer l'ordinateur en mode sans échec
      1) Redémarre ton ordi
      2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
      3) Tu verras un écran avec options de démarrage apparaître
      4) Choisi la première option : Sans Échec, et valide avec "Entrée"
      5) Choisi ton compte habituel, et non Administrateur

      · Double cliquer sur Smitfraudfix.exe.
      · Sélectionner 2 pour supprimer les fichiers responsables de l'infection.
      · A la question Voulez-vous nettoyer le registre ?], répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection. Le fix déterminera si le fichier wininet.dll est infecté.
      · A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.
      · Quitter le programme en appuyant sur Q.
      N.B.: Cette étape élimine les fichiers infectieux détectés à l'étape #1
      Attention que l'option 2 de l'outil supprime le fond d'écran !

      process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

      relance Smitfraudfix et choisis l'option 5 laisse le travailler

      Redémarrer normalement et coller sur le forum le rapport généré et un rapport hijack this
      1. " A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu." : cette étape ne m'est pas parvenue ... on ma demander de redémarrer le PC , ce que j'ai fait . j'ai un rapport qui est apparue . Je suis en mode sans echec ; que faire ? poster ce rapport , relancer Smitfraudfix ?
        1. Contributeur sécurité
          redémarre normalement
          Télécharge le FixWareout d'un de ces deux sites sur le bureau:
          http://download.bleepingcomputer.com/lonny/Fixwareout.exe
          http://downloads.subratam.org/Fixwareout.exe

          Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
          Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le.
          Ton système mettra un peu plus de temps au démarrage, c'est normal.

          Quand ton système aura redémarré, suis les invites des messages.

          A la fin du fix, tu auras peut-être encore besoin de redémarrer le PC.

          Au final, poste le contenu du fichier C:\fixwareout\report.txt avec un nouveau rapport HijackThis
          Si et seulement si il y a des difficultés de connexion après cette manip:
          Démarrer---->Paramètres---->Panneau de configuration---->Connexions réseau
          Faire un clic droit sur la connexion par défaut, nommée en général "Connexion au réseau local" ou "Accès à distance" si tu utilises un modem téléphonique, et choisir Propriétés.
          Faire un double clic sur l'élément Protocole Internet (TCP/IP) et choisir le bouton-radio Obtenir les adresses des serveurs DNS automatiquement.
          Clique deux fois sur OK, et redémarre l'ordinateur.
          1. voila le rapport ....

            SmitFraudFix v2.300

            Rapport fait à 18:29:34,93, 07/03/2008
            Executé à partir de C:\SmitfraudFix
            OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
            Le type du système de fichiers est NTFS
            Fix executé en mode sans echec

            »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
            !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

            SrchSTS.exe by S!Ri
            Search SharedTaskScheduler's .dll

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
            "{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"="USB Ware"

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
            "{747e1fbe-b70f-441d-bbca-6e536c04924a}"="didact"

            [HKEY_CLASSES_ROOT\CLSID\{747e1fbe-b70f-441d-bbca-6e536c04924a}\InProcServer32]
            @="C:\WINDOWS\system32\wuuawkz.dll"

            [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{747e1fbe-b70f-441d-bbca-6e536c04924a}\InProcServer32]
            @="C:\WINDOWS\system32\wuuawkz.dll"

            »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

            »»»»»»»»»»»»»»»»»»»»»»»» hosts

            127.0.0.1 localhost
            127.0.0.1 1ad2srvr-cpt-v1.com
            127.0.0.1 www.1ad2srvr-cpt-v1.com
            127.0.0.1 207-182-237-233.visionaire-us.com
            127.0.0.1 www.207-182-237-233.visionaire-us.com
            127.0.0.1 3721.com
            127.0.0.1 www.3721.com
            127.0.0.1 680180.net
            127.0.0.1 www.680180.net
            127.0.0.1 7search.com
            127.0.0.1 www.7search.com
            127.0.0.1 Ad.doubleclick.net
            127.0.0.1 www.Ad.doubleclick.net
            127.0.0.1 Adserv.internetfuel.com
            127.0.0.1 www.Adserv.internetfuel.com
            127.0.0.1 Akapp.whenu.com
            127.0.0.1 www.Akapp.whenu.com
            127.0.0.1 App.whenu.com
            127.0.0.1 www.App.whenu.com
            127.0.0.1 Banserv.internetfuel.com
            127.0.0.1 www.Banserv.internetfuel.com
            127.0.0.1 Bidtxt.whenu.com
            127.0.0.1 www.Bidtxt.whenu.com
            127.0.0.1 Corr.conscorr.com
            127.0.0.1 www.Corr.conscorr.com
            127.0.0.1 Dclcorp.rpts.net
            127.0.0.1 www.Dclcorp.rpts.net
            127.0.0.1 Drk.localnrd.com
            127.0.0.1 www.Drk.localnrd.com
            127.0.0.1 Homecgocable.net
            127.0.0.1 www.Homecgocable.net
            127.0.0.1 Netbroadcast.com
            127.0.0.1 www.Netbroadcast.com
            127.0.0.1 Smartpops.com
            127.0.0.1 www.Smartpops.com
            127.0.0.1 Spapp.whenu.com
            127.0.0.1 www.Spapp.whenu.com
            127.0.0.1 Xxxtoolbar.com
            127.0.0.1 www.Xxxtoolbar.com
            127.0.0.1 abetterinternet.com
            127.0.0.1 www.abetterinternet.com
            127.0.0.1 active-alert-server.com
            127.0.0.1 www.active-alert-server.com
            127.0.0.1 active-max.com
            127.0.0.1 www.active-max.com
            127.0.0.1 addictivetechnologies.net
            127.0.0.1 www.addictivetechnologies.net
            127.0.0.1 address.3721.com
            127.0.0.1 www.address.3721.com
            127.0.0.1 adopt.hotbar.com
            127.0.0.1 www.adopt.hotbar.com
            127.0.0.1 adpopper.outblaze.com
            127.0.0.1 www.adpopper.outblaze.com
            127.0.0.1 adroar.com
            127.0.0.1 www.adroar.com
            127.0.0.1 ads.adroar.com
            127.0.0.1 www.ads.adroar.com
            127.0.0.1 ads.adtomi.com
            127.0.0.1 www.ads.adtomi.com
            127.0.0.1 ads.centralmedia.ws
            127.0.0.1 www.ads.centralmedia.ws
            127.0.0.1 ads.hotbar.com
            127.0.0.1 www.ads.hotbar.com
            127.0.0.1 ads.internet-optimizer.com
            127.0.0.1 www.ads.internet-optimizer.com
            127.0.0.1 ads.offeroptimizer.com
            127.0.0.1 www.ads.offeroptimizer.com
            127.0.0.1 ads.vx2.cc
            127.0.0.1 www.ads.vx2.cc
            127.0.0.1 ads3.virtumundo.com
            127.0.0.1 www.ads3.virtumundo.com
            127.0.0.1 ads4.virtumundo.com
            127.0.0.1 www.ads4.virtumundo.com
            127.0.0.1 adserv1.ebates.com
            127.0.0.1 www.adserv1.ebates.com
            127.0.0.1 adtactics.com
            127.0.0.1 www.adtactics.com
            127.0.0.1 adtracker.411web.com
            127.0.0.1 www.adtracker.411web.com
            127.0.0.1 advertisingagent.com
            127.0.0.1 www.advertisingagent.com
            127.0.0.1 agent.3721.com
            127.0.0.1 www.agent.3721.com
            127.0.0.1 ajokeaday.com
            127.0.0.1 www.ajokeaday.com
            127.0.0.1 ak.imgfarm.com
            127.0.0.1 www.ak.imgfarm.com
            127.0.0.1 akapp.whenu.com
            127.0.0.1 www.akapp.whenu.com
            127.0.0.1 akweb.whenu.com
            127.0.0.1 www.akweb.whenu.com
            127.0.0.1 allaboutsearching.com
            127.0.0.1 www.allaboutsearching.com
            127.0.0.1 almightysearch.com
            127.0.0.1 www.almightysearch.com
            127.0.0.1 alpha.searchassistant.net
            127.0.0.1 www.alpha.searchassistant.net
            127.0.0.1 altnet.com
            127.0.0.1 www.altnet.com
            127.0.0.1 amazingautossearch.com
            127.0.0.1 www.amazingautossearch.com
            127.0.0.1 amnv.net
            127.0.0.1 www.amnv.net
            127.0.0.1 ao.lop.com
            127.0.0.1 www.ao.lop.com
            127.0.0.1 app.desktop.ak-networks.com
            127.0.0.1 www.app.desktop.ak-networks.com
            127.0.0.1 app.ezula.com
            127.0.0.1 www.app.ezula.com
            127.0.0.1 app.whenu.com
            127.0.0.1 www.app.whenu.com
            127.0.0.1 app.whenu.speedera.net
            127.0.0.1 www.app.whenu.speedera.net
            127.0.0.1 assistant.3721.com
            127.0.0.1 www.assistant.3721.com
            127.0.0.1 avenuemedia.com
            127.0.0.1 www.avenuemedia.com
            127.0.0.1 ayb.lop.com
            127.0.0.1 www.ayb.lop.com
            127.0.0.1 b3d.com
            127.0.0.1 www.b3d.com
            127.0.0.1 badsol.bianas.com
            127.0.0.1 www.badsol.bianas.com
            127.0.0.1 badurl.grandstreetinteractive.com
            127.0.0.1 www.badurl.grandstreetinteractive.com
            127.0.0.1 badurl.ieplugin.com
            127.0.0.1 www.badurl.ieplugin.com
            127.0.0.1 bannerserver.gator.com
            127.0.0.1 www.bannerserver.gator.com
            127.0.0.1 bannersxchange.com
            127.0.0.1 www.bannersxchange.com
            127.0.0.1 bannerx.adtactics.com
            127.0.0.1 www.bannerx.adtactics.com
            127.0.0.1 bar.mywebsearch.com
            127.0.0.1 www.bar.mywebsearch.com
            127.0.0.1 bc2.gator.com
            127.0.0.1 www.bc2.gator.com
            127.0.0.1 bde3d.com
            127.0.0.1 www.bde3d.com
            127.0.0.1 belt.abetterinternet.com
            127.0.0.1 www.belt.abetterinternet.com
            127.0.0.1 beta.searchassistant.net
            127.0.0.1 www.beta.searchassistant.net
            127.0.0.1 bg.gator.com
            127.0.0.1 www.bg.gator.com
            127.0.0.1 bg2.gator.com
            127.0.0.1 www.bg2.gator.com
            127.0.0.1 bi.gator.com
            127.0.0.1 www.bi.gator.com
            127.0.0.1 bidtxt.whenu.com
            127.0.0.1 www.bidtxt.whenu.com
            127.0.0.1 bigbrother.gigatechsoftware.com
            127.0.0.1 www.bigbrother.gigatechsoftware.com
            127.0.0.1 bins.lop.com
            127.0.0.1 www.bins.lop.com
            127.0.0.1 bis.180solutions.com
            127.0.0.1 www.bis.180solutions.com
            127.0.0.1 bluehavenmedia.com
            127.0.0.1 www.bluehavenmedia.com
            127.0.0.1 brilliantdigital.com
            127.0.0.1 www.brilliantdigital.com
            127.0.0.1 browserwise.com
            127.0.0.1 www.browserwise.com
            127.0.0.1 bundleware.com
            127.0.0.1 www.bundleware.com
            127.0.0.1 c.abetterinternet.com
            127.0.0.1 www.c.abetterinternet.com
            127.0.0.1 c.centralmedia.ws
            127.0.0.1 www.c.centralmedia.ws
            127.0.0.1 c.pornograph.com
            127.0.0.1 www.c.pornograph.com
            127.0.0.1 c4.iwon.com
            127.0.0.1 www.c4.iwon.com
            127.0.0.1 c4.maxserving.com
            127.0.0.1 www.c4.maxserving.com
            127.0.0.1 c4.mysearch.com
            127.0.0.1 www.c4.mysearch.com
            127.0.0.1 cadsol.bianas.com
            127.0.0.1 www.cadsol.bianas.com
            127.0.0.1 casinobuilder.i-lookup.com
            127.0.0.1 www.casinobuilder.i-lookup.com
            127.0.0.1 cassandra.searchassistant.net
            127.0.0.1 www.cassandra.searchassistant.net
            127.0.0.1 cc.iwon.com
            127.0.0.1 www.cc.iwon.com
            127.0.0.1 cdn.climaxbucks.com
            127.0.0.1 www.cdn.climaxbucks.com
            127.0.0.1 cdn.movies-etc.com
            127.0.0.1 www.cdn.movies-etc.com
            127.0.0.1 centralmedia.ws
            127.0.0.1 www.centralmedia.ws
            127.0.0.1 cfg.mysearch.com
            127.0.0.1 www.cfg.mysearch.com
            127.0.0.1 cfg.mywebsearch.com
            127.0.0.1 www.cfg.mywebsearch.com
            127.0.0.1 checkin.clickalchemy.com
            127.0.0.1 www.checkin.clickalchemy.com
            127.0.0.1 chromium.whenu.com
            127.0.0.1 www.chromium.whenu.com
            127.0.0.1 cjt1.net
            127.0.0.1 www.cjt1.net
            127.0.0.1 cleangetaway.biz
            127.0.0.1 www.cleangetaway.biz
            127.0.0.1 click2findnow.com
            127.0.0.1 www.click2findnow.com
            127.0.0.1 clickalchemy.com
            127.0.0.1 www.clickalchemy.com
            127.0.0.1 climaxbucks.com
            127.0.0.1 www.climaxbucks.com
            127.0.0.1 cns.3721.com
            127.0.0.1 www.cns.3721.com
            127.0.0.1 cnsmin.3721.com
            127.0.0.1 www.cnsmin.3721.com
            127.0.0.1 cocktailcash.com
            127.0.0.1 www.cocktailcash.com
            127.0.0.1 code.ignphrases.com
            127.0.0.1 www.code.ignphrases.com
            127.0.0.1 config.grandstreetinteractive.com
            127.0.0.1 www.config.grandstreetinteractive.com
            127.0.0.1 content.dashbar.com
            127.0.0.1 www.content.dashbar.com
            127.0.0.1 contexualsearch.com
            127.0.0.1 www.contexualsearch.com
            127.0.0.1 corp.3721.com
            127.0.0.1 www.corp.3721.com
            127.0.0.1 coupons.gator.com
            127.0.0.1 www.coupons.gator.com
            127.0.0.1 cr.stop-popup-ads-now.com
            127.0.0.1 www.cr.stop-popup-ads-now.com
            127.0.0.1 crap2.com
            127.0.0.1 www.crap2.com
            127.0.0.1 crossroad.trekdata.com
            127.0.0.1 www.crossroad.trekdata.com
            127.0.0.1 cs.hotbar.com
            127.0.0.1 www.cs.hotbar.com
            127.0.0.1 ct.cydoor.com
            127.0.0.1 www.ct.cydoor.com
            127.0.0.1 ctl.twain-tech.com
            127.0.0.1 www.ctl.twain-tech.com
            127.0.0.1 cust.bezeqint.net
            127.0.0.1 www.cust.bezeqint.net
            127.0.0.1 daptest.speedbit.com
            127.0.0.1 www.daptest.speedbit.com
            127.0.0.1 datastorm.biz
            127.0.0.1 www.datastorm.biz
            127.0.0.1 delta.adroar.com
            127.0.0.1 www.delta.adroar.com
            127.0.0.1 dir.3721.com
            127.0.0.1 www.dir.3721.com
            127.0.0.1 direct.simpletraffic.com
            127.0.0.1 www.direct.simpletraffic.com
            127.0.0.1 docs1.iwon.com
            127.0.0.1 www.docs1.iwon.com
            127.0.0.1 domain.i-lookup.com
            127.0.0.1 www.domain.i-lookup.com
            127.0.0.1 download.3721.com
            127.0.0.1 www.download.3721.com
            127.0.0.1 download.abetterinternet.com
            127.0.0.1 www.download.abetterinternet.com
            127.0.0.1 download.bonzi.com
            127.0.0.1 www.download.bonzi.com
            127.0.0.1 download.bulletproofsoft.com
            127.0.0.1 www.download.bulletproofsoft.com
            127.0.0.1 download.feiyang.com
            127.0.0.1 www.download.feiyang.com
            127.0.0.1 download.gigatechsoftware.com
            127.0.0.1 www.download.gigatechsoftware.com
            127.0.0.1 download.ipinsight.net
            127.0.0.1 www.download.ipinsight.net
            127.0.0.1 download.vx2.cc
            127.0.0.1 www.download.vx2.cc
            127.0.0.1 download.whenu.com
            127.0.0.1 www.download.whenu.com
            127.0.0.1 download2.abetterinternet.com
            127.0.0.1 www.download2.abetterinternet.com
            127.0.0.1 dyn.virtumundo.com
            127.0.0.1 www.dyn.virtumundo.com
            127.0.0.1 dynamic.hotbar.com
            127.0.0.1 www.dynamic.hotbar.com
            127.0.0.1 dynmenu.hotbar.com
            127.0.0.1 www.dynmenu.hotbar.com
            127.0.0.1 ecpm.com
            127.0.0.1 www.ecpm.com
            127.0.0.1 efc.iwon.com
            127.0.0.1 www.efc.iwon.com
            127.0.0.1 epsilon.searchassistant.net
            127.0.0.1 www.epsilon.searchassistant.net
            127.0.0.1 express.3721.com
            127.0.0.1 www.express.3721.com
            127.0.0.1 ez-searching.com
            127.0.0.1 www.ez-searching.com
            127.0.0.1 ezula.com
            127.0.0.1 www.ezula.com
            127.0.0.1 find-quick.com
            127.0.0.1 www.find-quick.com
            127.0.0.1 findology.mail.everyone.net
            127.0.0.1 www.findology.mail.everyone.net
            127.0.0.1 fstrack.7search.com
            127.0.0.1 www.fstrack.7search.com
            127.0.0.1 ftp.clicktracking.info
            127.0.0.1 www.ftp.clicktracking.info
            127.0.0.1 gator29.gator.com
            127.0.0.1 www.gator29.gator.com
            127.0.0.1 gatorcme.gator.com
            127.0.0.1 www.gatorcme.gator.com
            127.0.0.1 gbs.gator.com
            127.0.0.1 www.gbs.gator.com
            127.0.0.1 getweathercast.com
            127.0.0.1 www.getweathercast.com
            127.0.0.1 gi.gator.com
            127.0.0.1 www.gi.gator.com
            127.0.0.1 globaltoolbar.com
            127.0.0.1 www.globaltoolbar.com
            127.0.0.1 globalwebsearch.com
            127.0.0.1 www.globalwebsearch.com
            127.0.0.1 grandstreetinteractive.com
            127.0.0.1 www.grandstreetinteractive.com
            127.0.0.1 gs.gator.com
            127.0.0.1 www.gs.gator.com
            127.0.0.1 gt.gator.com
            127.0.0.1 www.gt.gator.com
            127.0.0.1 help.mysearch.com
            127.0.0.1 www.help.mysearch.com
            127.0.0.1 hits.411web.com
            127.0.0.1 www.hits.411web.com
            127.0.0.1 home.iwon.com
            127.0.0.1 www.home.iwon.com
            127.0.0.1 hotbar.com
            127.0.0.1 www.hotbar.com
            127.0.0.1 i-lookup.com
            127.0.0.1 www.i-lookup.com
            127.0.0.1 i1img.com
            127.0.0.1 www.i1img.com
            127.0.0.1 iads.adroar.com
            127.0.0.1 www.iads.adroar.com
            127.0.0.1 ieplugin.com
            127.0.0.1 www.ieplugin.com
            127.0.0.1 igetnet.com
            127.0.0.1 www.igetnet.com
            127.0.0.1 image.i1img.com
            127.0.0.1 www.image.i1img.com
            127.0.0.1 image.imgfarm.com
            127.0.0.1 www.image.imgfarm.com
            127.0.0.1 images.bonzi.com
            127.0.0.1 www.images.bonzi.com
            127.0.0.1 images.gator.com
            127.0.0.1 www.images.gator.com
            127.0.0.1 img.3721.com
            127.0.0.1 www.img.3721.com
            127.0.0.1 img.7meta.com
            127.0.0.1 www.img.7meta.com
            127.0.0.1 img.bannersxchange.com
            127.0.0.1 www.img.bannersxchange.com
            127.0.0.1 img.lop.com
            127.0.0.1 www.img.lop.com
            127.0.0.1 imgfarm.com
            127.0.0.1 www.imgfarm.com
            127.0.0.1 impression.7search.com
            127.0.0.1 www.impression.7search.com
            127.0.0.1 install.browsertoolbar.com
            127.0.0.1 www.install.browsertoolbar.com
            127.0.0.1 installdollars.com
            127.0.0.1 www.installdollars.com
            127.0.0.1 installs.hotbar.com
            127.0.0.1 www.installs.hotbar.com
            127.0.0.1 internal.vx2.cc
            127.0.0.1 www.internal.vx2.cc
            127.0.0.1 internet-optimizer.com
            127.0.0.1 www.internet-optimizer.com
            127.0.0.1 ipend.datastorm.biz
            127.0.0.1 www.ipend.datastorm.biz
            127.0.0.1 ipinsight.com
            127.0.0.1 www.ipinsight.com
            127.0.0.1 iron.whenu.com
            127.0.0.1 www.iron.whenu.com
            127.0.0.1 javatar.cjt1.net
            127.0.0.1 www.javatar.cjt1.net
            127.0.0.1 jbns2.cydoor.com
            127.0.0.1 www.jbns2.cydoor.com
            127.0.0.1 jcde-nms4.joltid.net
            127.0.0.1 www.jcde-nms4.joltid.net
            127.0.0.1 jcde-nms5.joltid.net
            127.0.0.1 www.jcde-nms5.joltid.net
            127.0.0.1 jcde-nms6.joltid.net
            127.0.0.1 www.jcde-nms6.joltid.net
            127.0.0.1 jcms.cydoor.com
            127.0.0.1 www.jcms.cydoor.com
            127.0.0.1 jcontent.bns1.net
            127.0.0.1 www.jcontent.bns1.net
            127.0.0.1 jdownloadacc.cjt1.net
            127.0.0.1 www.jdownloadacc.cjt1.net
            127.0.0.1 jedonkey.cjt1.net
            127.0.0.1 www.jedonkey.cjt1.net
            127.0.0.1 jicq.cjt1.net
            127.0.0.1 www.jicq.cjt1.net
            127.0.0.1 jmindset.cjt1.net
            127.0.0.1 www.jmindset.cjt1.net
            127.0.0.1 jpedownload.joltid.com
            127.0.0.1 www.jpedownload.joltid.com
            127.0.0.1 jpiolet.cjt1.net
            127.0.0.1 www.jpiolet.cjt1.net
            127.0.0.1 jwildmedia.cjt1.net
            127.0.0.1 www.jwildmedia.cjt1.net
            127.0.0.1 k17177.bins.lop.com
            127.0.0.1 www.k17177.bins.lop.com
            127.0.0.1 kazanon.com
            127.0.0.1 www.kazanon.com
            127.0.0.1 lead.whenu.com
            127.0.0.1 www.lead.whenu.com
            127.0.0.1 license.hotbar.com
            127.0.0.1 www.license.hotbar.com
            127.0.0.1 lists.adroar.com
            127.0.0.1 www.lists.adroar.com
            127.0.0.1 look-today.com
            127.0.0.1 www.look-today.com
            127.0.0.1 look2me.com
            127.0.0.1 www.look2me.com
            127.0.0.1 lop.com
            127.0.0.1 www.lop.com
            127.0.0.1 magic.3721.com
            127.0.0.1 www.magic.3721.com
            127.0.0.1 mail.vx2.cc
            127.0.0.1 www.mail.vx2.cc
            127.0.0.1 map.gator.com
            127.0.0.1 www.map.gator.com
            127.0.0.1 mark.3721.com
            127.0.0.1 www.mark.3721.com
            127.0.0.1 master.mx-targeting.com
            127.0.0.1 www.master.mx-targeting.com
            127.0.0.1 maxexp.com
            127.0.0.1 www.maxexp.com
            127.0.0.1 media.altnet.com
            127.0.0.1 www.media.altnet.com
            127.0.0.1 mediabuy-nic.cjt1.net
            127.0.0.1 www.mediabuy-nic.cjt1.net
            127.0.0.1 memorymeter.com
            127.0.0.1 www.memorymeter.com
            127.0.0.1 mercury.whenu.com
            127.0.0.1 www.mercury.whenu.com
            127.0.0.1 messagebroadcaster.net
            127.0.0.1 www.messagebroadcaster.net
            127.0.0.1 meta.3721.com
            127.0.0.1 www.meta.3721.com
            127.0.0.1 mindseti.com
            127.0.0.1 www.mindseti.com
            127.0.0.1 movies-etc.com
            127.0.0.1 www.movies-etc.com
            127.0.0.1 msearch.3721.com
            127.0.0.1 www.msearch.3721.com
            127.0.0.1 msview.cc
            127.0.0.1 www.msview.cc
            127.0.0.1 mt1.climaxbucks.com
            127.0.0.1 www.mt1.climaxbucks.com
            127.0.0.1 mt23.climaxbucks.com
            127.0.0.1 www.mt23.climaxbucks.com
            127.0.0.1 my.iwon.com
            127.0.0.1 www.my.iwon.com
            127.0.0.1 mypanicbutton.com
            127.0.0.1 www.mypanicbutton.com
            127.0.0.1 mysearchnow.com
            127.0.0.1 www.mysearchnow.com
            127.0.0.1 mywebsearch.com
            127.0.0.1 www.mywebsearch.com
            127.0.0.1 netpalnow.com
            127.0.0.1 www.netpalnow.com
            127.0.0.1 netpaloffers.net
            127.0.0.1 www.netpaloffers.net
            127.0.0.1 netsearchsoft.com
            127.0.0.1 www.netsearchsoft.com
            127.0.0.1 new.net
            127.0.0.1 www.new.net
            127.0.0.1 nictechnetworks.com
            127.0.0.1 www.nictechnetworks.com
            127.0.0.1 nopop.net
            127.0.0.1 www.nopop.net
            127.0.0.1 ns1.exportusa.com
            127.0.0.1 www.ns1.exportusa.com
            127.0.0.1 ns1.vx2.cc
            127.0.0.1 www.ns1.vx2.cc
            127.0.0.1 ns2.vx2.cc
            127.0.0.1 www.ns2.vx2.cc
            127.0.0.1 odysseusmarketing.com
            127.0.0.1 www.odysseusmarketing.com
            127.0.0.1 offeroptimizer.com
            127.0.0.1 www.offeroptimizer.com
            127.0.0.1 omegasearch.com
            127.0.0.1 www.omegasearch.com
            127.0.0.1 omi-update.net
            127.0.0.1 www.omi-update.net
            127.0.0.1 orbitexplorer.com
            127.0.0.1 www.orbitexplorer.com
            127.0.0.1 partners.hotbar.com
            127.0.0.1 www.partners.hotbar.com
            127.0.0.1 paypertext.com
            127.0.0.1 www.paypertext.com
            127.0.0.1 pchi-vtrk.virtumundo.com
            127.0.0.1 www.pchi-vtrk.virtumundo.com
            127.0.0.1 plugusin4cash.com
            127.0.0.1 www.plugusin4cash.com
            127.0.0.1 plus.iwon.com
            127.0.0.1 www.plus.iwon.com
            127.0.0.1 pm.altnet.com
            127.0.0.1 www.pm.altnet.com
            127.0.0.1 predictivesearch.com
            127.0.0.1 www.predictivesearch.com
            127.0.0.1 pricebandit.com
            127.0.0.1 www.pricebandit.com
            127.0.0.1 privacy.virtumundo.com
            127.0.0.1 www.privacy.virtumundo.com
            127.0.0.1 prizemachine.games.iwon.com
            127.0.0.1 www.prizemachine.games.iwon.com
            127.0.0.1 promos.hotbar.com
            127.0.0.1 www.promos.hotbar.com
            127.0.0.1 prosearching.com
            127.0.0.1 www.prosearching.com
            127.0.0.1 puv.hotbar.com
            127.0.0.1 www.puv.hotbar.com
            127.0.0.1 query.i-lookup.com
            127.0.0.1 www.query.i-lookup.com
            127.0.0.1 regserver.gator.com
            127.0.0.1 www.regserver.gator.com
            127.0.0.1 reports.hotbar.com
            127.0.0.1 www.reports.hotbar.com
            127.0.0.1 reports.offeroptimizer.com
            127.0.0.1 www.reports.offeroptimizer.com
            127.0.0.1 results.dashbar.com
            127.0.0.1 www.results.dashbar.com
            127.0.0.1 results.searchscout.com
            127.0.0.1 www.results.searchscout.com
            127.0.0.1 resultsmaster.com
            127.0.0.1 www.resultsmaster.com
            127.0.0.1 rs.gator.com
            127.0.0.1 www.rs.gator.com
            127.0.0.1 rspsearch.com
            127.0.0.1 www.rspsearch.com
            127.0.0.1 s.abetterinternet.com
            127.0.0.1 www.s.abetterinternet.com
            127.0.0.1 savenow-pop-ads.com
            127.0.0.1 www.savenow-pop-ads.com
            127.0.0.1 savenow-popup-ads.com
            127.0.0.1 www.savenow-popup-ads.com
            127.0.0.1 sbox.3721.com
            127.0.0.1 www.sbox.3721.com
            127.0.0.1 sbvr.com
            127.0.0.1 www.sbvr.com
            127.0.0.1 scriptserver.gator.com
            127.0.0.1 www.scriptserver.gator.com
            127.0.0.1 search.active-max.com
            127.0.0.1 www.search.active-max.com
            127.0.0.1 search.gator.com
            127.0.0.1 www.search.gator.com
            127.0.0.1 search.ieplugin.com
            127.0.0.1 www.search.ieplugin.com
            127.0.0.1 search.iwon.com
            127.0.0.1 www.search.iwon.com
            127.0.0.1 search.mysearchnow.com
            127.0.0.1 www.search.mysearchnow.com
            127.0.0.1 search.xrenoder.com
            127.0.0.1 www.search.xrenoder.com
            127.0.0.1 search2.i-lookup.com
            127.0.0.1 www.search2.i-lookup.com
            127.0.0.1 search200.com
            127.0.0.1 www.search200.com
            127.0.0.1 searchassistant.iwon.com
            127.0.0.1 www.searchassistant.iwon.com
            127.0.0.1 searchassistant.net
            127.0.0.1 www.searchassistant.net
            127.0.0.1 searchbus.com
            127.0.0.1 www.searchbus.com
            127.0.0.1 searchdisp.hotbar.com
            127.0.0.1 www.searchdisp.hotbar.com
            127.0.0.1 searchexe.com
            127.0.0.1 www.searchexe.com
            127.0.0.1 searchweb2.com
            127.0.0.1 www.searchweb2.com
            127.0.0.1 sentrymon.ipinsight.net
            127.0.0.1 www.sentrymon.ipinsight.net
            127.0.0.1 server.ipinsight.net
            127.0.0.1 www.server.ipinsight.net
            127.0.0.1 shanghai.3721.com
            127.0.0.1 www.shanghai.3721.com
            127.0.0.1 similarsingles.com
            127.0.0.1 www.similarsingles.com
            127.0.0.1 sina.3721.com
            127.0.0.1 www.sina.3721.com
            127.0.0.1 skins.hotbar.com
            127.0.0.1 www.skins.hotbar.com
            127.0.0.1 soap.alexa.com
            127.0.0.1 www.soap.alexa.com
            127.0.0.1 spapp.whenu.com
            127.0.0.1 www.spapp.whenu.com
            127.0.0.1 spawnet.com
            127.0.0.1 www.spawnet.com
            127.0.0.1 speedbar.myway.com
            127.0.0.1 www.speedbar.myway.com
            127.0.0.1 sputnik.vx2.cc
            127.0.0.1 www.sputnik.vx2.cc
            127.0.0.1 spweather.whenu.com
            127.0.0.1 www.spweather.whenu.com
            127.0.0.1 spweb.whenu.com
            127.0.0.1 www.spweb.whenu.com
            127.0.0.1 spywarehelp.net
            127.0.0.1 www.spywarehelp.net
            127.0.0.1 sqwire.com
            127.0.0.1 www.sqwire.com
            127.0.0.1 sqwire.i-lookup.com
            127.0.0.1 www.sqwire.i-lookup.com
            127.0.0.1 srch.lop.com
            127.0.0.1 www.srch.lop.com
            127.0.0.1 ss.gator.com
            127.0.0.1 www.ss.gator.com
            127.0.0.1 ssbackup.gator.com
            127.0.0.1 www.ssbackup.gator.com
            127.0.0.1 st.brilliantdigital.com
            127.0.0.1 www.st.brilliantdigital.com
            127.0.0.1 static.411web.com
            127.0.0.1 www.static.411web.com
            127.0.0.1 stop-popup-ads-now.com
            127.0.0.1 www.stop-popup-ads-now.com
            127.0.0.1 stubmon.ipinsight.net
            127.0.0.1 www.stubmon.ipinsight.net
            127.0.0.1 sue.lop.com
            127.0.0.1 www.sue.lop.com
            127.0.0.1 superwebsearch.com
            127.0.0.1 www.superwebsearch.com
            127.0.0.1 sysupdate.grandstreetinteractive.com
            127.0.0.1 www.sysupdate.grandstreetinteractive.com
            127.0.0.1 sysupdate.ieplugin.com
            127.0.0.1 www.sysupdate.ieplugin.com
            127.0.0.1 tdko.com
            127.0.0.1 www.tdko.com
            127.0.0.1 tdmy.com
            127.0.0.1 www.tdmy.com
            127.0.0.1 tefs.com
            127.0.0.1 www.tefs.com
            127.0.0.1 tfil.com
            127.0.0.1 www.tfil.com
            127.0.0.1 thinkingmedia.net
            127.0.0.1 www.thinkingmedia.net
            127.0.0.1 thinstall.abetterinternet.com
            127.0.0.1 www.thinstall.abetterinternet.com
            127.0.0.1 tin.whenu.com
            127.0.0.1 www.tin.whenu.com
            127.0.0.1 titanium.whenu.com
            127.0.0.1 www.titanium.whenu.com
            127.0.0.1 toolbar.i-lookup.com
            127.0.0.1 www.toolbar.i-lookup.com
            127.0.0.1 toolbar2.i-lookup.com
            127.0.0.1 www.toolbar2.i-lookup.com
            127.0.0.1 tooltips.hotbar.com
            127.0.0.1 www.tooltips.hotbar.com
            127.0.0.1 topicks.com
            127.0.0.1 www.topicks.com
            127.0.0.1 totalvelocity.com
            127.0.0.1 www.totalvelocity.com
            127.0.0.1 tpcms.topicks.com
            127.0.0.1 www.tpcms.topicks.com
            127.0.0.1 tpdownload.topicks.com
            127.0.0.1 www.tpdownload.topicks.com
            127.0.0.1 tpreport.topicks.com
            127.0.0.1 www.tpreport.topicks.com
            127.0.0.1 track.dlsearchbar.com
            127.0.0.1 www.track.dlsearchbar.com
            127.0.0.1 track.simpletraffic.com
            127.0.0.1 www.track.simpletraffic.com
            127.0.0.1 tracking.roispy.com
            127.0.0.1 www.tracking.roispy.com
            127.0.0.1 tracking.spiderbait.com
            127.0.0.1 www.tracking.spiderbait.com
            127.0.0.1 tracking.thunderdownloads.com
            127.0.0.1 www.tracking.thunderdownloads.com
            127.0.0.1 traffichog.com
            127.0.0.1 www.traffichog.com
            127.0.0.1 transctl-dev.vx2.cc
            127.0.0.1 www.transctl-dev.vx2.cc
            127.0.0.1 transctl.vx2.cc
            127.0.0.1 www.transctl.vx2.cc
            127.0.0.1 trickle.gator.com
            127.0.0.1 www.trickle.gator.com
            127.0.0.1 ts.altnet.com
            127.0.0.1 www.ts.altnet.com
            127.0.0.1 ts.gator.com
            127.0.0.1 www.ts.gator.com
            127.0.0.1 tss.altnet.com
            127.0.0.1 www.tss.altnet.com
            127.0.0.1 tv.180solutions.com
            127.0.0.1 www.tv.180solutions.com
            127.0.0.1 update.speedbit.com
            127.0.0.1 www.update.speedbit.com
            127.0.0.1 update.stop-popup-ads-now.com
            127.0.0.1 www.update.stop-popup-ads-now.com
            127.0.0.1 update.thunderdownloads.com
            127.0.0.1 www.update.thunderdownloads.com
            127.0.0.1 updates.desktop.ak-networks.com
            127.0.0.1 www.updates.desktop.ak-networks.com
            127.0.0.1 updates.desktop.virtumundo.com
            127.0.0.1 www.updates.desktop.virtumundo.com
            127.0.0.1 updates.hotbar.com
            127.0.0.1 www.updates.hotbar.com
            127.0.0.1 updateserver.gator.com
            127.0.0.1 www.updateserver.gator.com
            127.0.0.1 upgrades.hotbar.com
            127.0.0.1 www.upgrades.hotbar.com
            127.0.0.1 user.3721.com
            127.0.0.1 www.user.3721.com
            127.0.0.1 view.atdmt.com
            127.0.0.1 www.view.atdmt.com
            127.0.0.1 vip-farm1.hotbar.com
            127.0.0.1 www.vip-farm1.hotbar.com
            127.0.0.1 vip-farm1v.hotbar.com
            127.0.0.1 www.vip-farm1v.hotbar.com
            127.0.0.1 vip-farm2.hotbar.com
            127.0.0.1 www.vip-farm2.hotbar.com
            127.0.0.1 vip-farm2v.hotbar.com
            127.0.0.1 www.vip-farm2v.hotbar.com
            127.0.0.1 vip-farm31v.hotbar.com
            127.0.0.1 www.vip-farm31v.hotbar.com
            127.0.0.1 vip-farm5v.hotbar.com
            127.0.0.1 www.vip-farm5v.hotbar.com
            127.0.0.1 virtumundo.com
            127.0.0.1 www.virtumundo.com
            127.0.0.1 vlogic.ak-networks.com
            127.0.0.1 www.vlogic.ak-networks.com
            127.0.0.1 vmadmin.com
            127.0.0.1 www.vmadmin.com
            127.0.0.1 vrape.hardloved.com
            127.0.0.1 www.vrape.hardloved.com
            127.0.0.1 vtrack.virtumundo.com
            127.0.0.1 www.vtrack.virtumundo.com
            127.0.0.1 wap.3721.com
            127.0.0.1 www.wap.3721.com
            127.0.0.1 wb.gator.com
            127.0.0.1 www.wb.gator.com
            127.0.0.1 weather.gator.com
            127.0.0.1 www.weather.gator.com
            127.0.0.1 weather.whenu.com
            127.0.0.1 www.weather.whenu.com
            127.0.0.1 weather.whenu.speedera.net
            127.0.0.1 www.weather.whenu.speedera.net
            127.0.0.1 web.balance.gator.com
            127.0.0.1 www.web.balance.gator.com
            127.0.0.1 web.whenu.com
            127.0.0.1 www.web.whenu.com
            127.0.0.1 web.whenu.speedera.net
            127.0.0.1 www.web.whenu.speedera.net
            127.0.0.1 webpdp.gator.com
            127.0.0.1 www.webpdp.gator.com
            127.0.0.1 wfix.com
            127.0.0.1 www.wfix.com
            127.0.0.1 whenu-advertising-info.com
            127.0.0.1 www.whenu-advertising-info.com
            127.0.0.1 whenu-advertising.com
            127.0.0.1 www.whenu-advertising.com
            127.0.0.1 whenu-popup-ads.com
            127.0.0.1 www.whenu-popup-ads.com
            127.0.0.1 whenu.com
            127.0.0.1 www.whenu.com
            127.0.0.1 whenusearch.com
            127.0.0.1 www.whenusearch.com
            127.0.0.1 whenushop-advertising-central.com
            127.0.0.1 www.whenushop-advertising-central.com
            127.0.0.1 whenushop-pop-ads.com
            127.0.0.1 www.whenushop-pop-ads.com
            127.0.0.1 whenushop-space.com
            127.0.0.1 www.whenushop-space.com
            127.0.0.1 whenushop.whenu.com
            127.0.0.1 www.whenushop.whenu.com
            127.0.0.1 ww2.ieplugin.com
            127.0.0.1 www.ww2.ieplugin.com
            127.0.0.1 ww3.ieplugin.com
            127.0.0.1 www.ww3.ieplugin.com
            127.0.0.1 wwa.ieplugin.com
            127.0.0.1 www.wwa.ieplugin.com
            127.0.0.1 wwd.ieplugin.com
            127.0.0.1 www.wwd.ieplugin.com
            127.0.0.1 www.2004cms.com
            127.0.0.1 2004cms.com
            127.0.0.1 www.3721.com
            127.0.0.1 3721.com
            127.0.0.1 www.680180.net
            127.0.0.1 680180.net
            127.0.0.1 www.7metasearch.com
            127.0.0.1 7metasearch.com
            127.0.0.1 www.7search.com
            127.0.0.1 7search.com
            127.0.0.1 www.aadcom.com
            127.0.0.1 aadcom.com
            127.0.0.1 www.abetterinternet.com
            127.0.0.1 abetterinternet.com
            127.0.0.1 www.active-alert-server.com
            127.0.0.1 active-alert-server.com
            127.0.0.1 www.active-max.com
            127.0.0.1 active-max.com
            127.0.0.1 www.acustat.com
            127.0.0.1 acustat.com
            127.0.0.1 www.addictivetechnologies.net
            127.0.0.1 addictivetechnologies.net
            127.0.0.1 www.adroar.com
            127.0.0.1 adroar.com
            127.0.0.1 www.adtactics.com
            127.0.0.1 adtactics.com
            127.0.0.1 www.adtomi.com
            127.0.0.1 adtomi.com
            127.0.0.1 www.aimdolls.com
            127.0.0.1 aimdolls.com
            127.0.0.1 www.aimphuck.com
            127.0.0.1 aimphuck.com
            127.0.0.1 www.alexa.com
            127.0.0.1 alexa.com
            127.0.0.1 www.allaboutsearching.com
            127.0.0.1 allaboutsearching.com
            127.0.0.1 www.allhyperlinks.com
            127.0.0.1 allhyperlinks.com
            127.0.0.1 www.almightysearch.com
            127.0.0.1 almightysearch.com
            127.0.0.1 www.altnet.com
            127.0.0.1 altnet.com
            127.0.0.1 www.altnetp2p.com
            127.0.0.1 altnetp2p.com
            127.0.0.1 www.amazingautossearch.com
            127.0.0.1 amazingautossearch.com
            127.0.0.1 www.amnv.net
            127.0.0.1 amnv.net
            127.0.0.1 www.at-games.com
            127.0.0.1 at-games.com
            127.0.0.1 www.avenuemedia.com
            127.0.0.1 avenuemedia.com
            127.0.0.1 www.b3d.com
            127.0.0.1 b3d.com
            127.0.0.1 www.bc777.com
            127.0.0.1 bc777.com
            127.0.0.1 www.bluehavenmedia.com
            127.0.0.1 bluehavenmedia.com
            127.0.0.1 www.bns1.net
            127.0.0.1 bns1.net
            127.0.0.1 www.bns2.net
            127.0.0.1 bns2.net
            127.0.0.1 www.bonzi.com
            127.0.0.1 bonzi.com
            127.0.0.1 www.bonzibuddy.com
            127.0.0.1 bonzibuddy.com
            127.0.0.1 www.brilliantdigital.com
            127.0.0.1 brilliantdigital.com
            127.0.0.1 www.browsertoolbar.com
            127.0.0.1 browsertoolbar.com
            127.0.0.1 www.browserwise.com
            127.0.0.1 browserwise.com
            127.0.0.1 www.bulletproofsoft.com
            127.0.0.1 bulletproofsoft.com
            127.0.0.1 www.bundleware.com
            127.0.0.1 bundleware.com
            127.0.0.1 www.centralmedia.ws
            127.0.0.1 centralmedia.ws
            127.0.0.1 www.cleangetaway.biz
            127.0.0.1 cleangetaway.biz
            127.0.0.1 www.click2findnow.com
            127.0.0.1 click2findnow.com
            127.0.0.1 www.clickalchemy.com
            127.0.0.1 clickalchemy.com
            127.0.0.1 www.clicktracking.info
            127.0.0.1 clicktracking.info
            127.0.0.1 www.climaxbucks.com
            127.0.0.1 climaxbucks.com
            127.0.0.1 www.clock-sync.com
            127.0.0.1 clock-sync.com
            127.0.0.1 www.cms1.net
            127.0.0.1 cms1.net
            127.0.0.1 www.cms2.net
            127.0.0.1 cms2.net
            127.0.0.1 www.cocktailcash.com
            127.0.0.1 cocktailcash.com
            127.0.0.1 www.contexualsearch.com
            127.0.0.1 contexualsearch.com
            127.0.0.1 www.crap2.com
            127.0.0.1 crap2.com
            127.0.0.1 www.cydoor.com
            127.0.0.1 cydoor.com
            127.0.0.1 www.dashbar.com
            127.0.0.1 dashbar.com
            127.0.0.1 www.datastorm.biz
            127.0.0.1 datastorm.biz
            127.0.0.1 www.date-manager.com
            127.0.0.1 date-manager.com
            127.0.0.1 www.dialup2.com
            127.0.0.1 dialup2.com
            127.0.0.1 www.domain.i-lookup.com
            127.0.0.1 domain.i-lookup.com
            127.0.0.1 www.ebates.com
            127.0.0.1 ebates.com
            127.0.0.1 www.ecpm.com
            127.0.0.1 ecpm.com
            127.0.0.1 www.ez-searching.com
            127.0.0.1 ez-searching.com
            127.0.0.1 www.find-quick.com
            127.0.0.1 find-quick.com
            127.0.0.1 www.findology.com
            127.0.0.1 findology.com
            127.0.0.1 www.funwebproducts.com
            127.0.0.1 funwebproducts.com
            127.0.0.1 www.gator.com
            127.0.0.1 gator.com
            127.0.0.1 www.gatoradvertisinginformationnetwork.com
            127.0.0.1 gatoradvertisinginformationnetwork.com
            127.0.0.1 www.gatorcorporation.com
            127.0.0.1 gatorcorporation.com
            127.0.0.1 www.getweathercast.com
            127.0.0.1 getweathercast.com
            127.0.0.1 www.gigatechsoftware.com
            127.0.0.1 gigatechsoftware.com
            127.0.0.1 www.gonnasearch.com
            127.0.0.1 gonnasearch.com
            127.0.0.1 www.grandstreetinteractive.com
            127.0.0.1 grandstreetinteractive.com
            127.0.0.1 www.greasycow.com
            127.0.0.1 greasycow.com
            127.0.0.1 www.hotbar.com
            127.0.0.1 hotbar.com
            127.0.0.1 www.i-lookup.com
            127.0.0.1 i-lookup.com
            127.0.0.1 www.ieplugin.com
            127.0.0.1 ieplugin.com
            127.0.0.1 www.igetnet.com
            127.0.0.1 igetnet.com
            127.0.0.1 www.ignkeywords.com
            127.0.0.1 ignkeywords.com
            127.0.0.1 www.ignphrases.com
            127.0.0.1 ignphrases.com
            127.0.0.1 www.imbum.com
            127.0.0.1 imbum.com
            127.0.0.1 www.internet-optimizer.com
            127.0.0.1 internet-optimizer.com
            127.0.0.1 www.ipinsight.com
            127.0.0.1 ipinsight.com
            127.0.0.1 www.ipinsight.net
            127.0.0.1 ipinsight.net
            127.0.0.1 www.iwon.com
            127.0.0.1 iwon.com
            127.0.0.1 www.kazanon.com
            127.0.0.1 kazanon.com
            127.0.0.1 www.linkstoyou.com
            127.0.0.1 linkstoyou.com
            127.0.0.1 www.look-today.com
            127.0.0.1 look-today.com
            127.0.0.1 www.look2me.com
            127.0.0.1 look2me.com
            127.0.0.1 www.look2me1.com
            127.0.0.1 look2me1.com
            127.0.0.1 www.look2me2.com
            127.0.0.1 look2me2.com
            127.0.0.1 www.look2me4.com
            127.0.0.1 look2me4.com
            127.0.0.1 www.lop.com
            127.0.0.1 lop.com
            127.0.0.1 www.lop2.com
            127.0.0.1 lop2.com
            127.0.0.1 www.lovetraffic.com
            127.0.0.1 lovetraffic.com
            127.0.0.1 www.lunasearch.com
            127.0.0.1 lunasearch.com
            127.0.0.1 www.memorymeter.com
            127.0.0.1 memorymeter.com
            127.0.0.1 www.messagebroadcaster.net
            127.0.0.1 messagebroadcaster.net
            127.0.0.1 www.mindseti.com
            127.0.0.1 mindseti.com
            127.0.0.1 www.mindsetinteractive.com
            127.0.0.1 mindsetinteractive.com
            127.0.0.1 www.movies-etc.com
            127.0.0.1 movies-etc.com
            127.0.0.1 www.mp3search.com
            127.0.0.1 mp3search.com
            127.0.0.1 www.msview.cc
            127.0.0.1 msview.cc
            127.0.0.1 www.mx-targeting.com
            127.0.0.1 mx-targeting.com
            127.0.0.1 www.mypanicbutton.com
            127.0.0.1 mypanicbutton.com
            127.0.0.1 www.mypctuneup.com
            127.0.0.1 mypctuneup.com
            127.0.0.1 www.mysearch.com
            127.0.0.1 mysearch.com
            127.0.0.1 www.mysearchnow.com
            127.0.0.1 mysearchnow.com
            127.0.0.1 www.mywebsearch.com
            127.0.0.1 mywebsearch.com
            127.0.0.1 www.netpalnow.com
            127.0.0.1 netpalnow.com
            127.0.0.1 www.netpaloffers.net
            127.0.0.1 netpaloffers.net
            127.0.0.1 www.netsearchsoft.com
            127.0.0.1 netsearchsoft.com
            127.0.0.1 www.newtonknows.com
            127.0.0.1 newtonknows.com
            127.0.0.1 www.nictechnetworks.com
            127.0.0.1 nictechnetworks.com
            127.0.0.1 www.no-pops.com
            127.0.0.1 no-pops.com
            127.0.0.1 www.nopop.net
            127.0.0.1 nopop.net
            127.0.0.1 www.nuker.com
            127.0.0.1 nuker.com
            127.0.0.1 www.odysseusmarketing.com
            127.0.0.1 odysseusmarketing.com
            127.0.0.1 www.offercompanion.com
            127.0.0.1 offercompanion.com
            127.0.0.1 www.offeroptimizer.com
            127.0.0.1 offeroptimizer.com
            127.0.0.1 www.omegasearch.com
            127.0.0.1 omegasearch.com
            127.0.0.1 www.omi-update.net
            127.0.0.1 omi-update.net
            127.0.0.1 www.pay-per-search.com
            127.0.0.1 pay-per-search.com
            127.0.0.1 www.payperranking.com
            127.0.0.1 payperranking.com
            127.0.0.1 www.plugusin4cash.com
            127.0.0.1 plugusin4cash.com
            127.0.0.1 www.precision-time.com
            127.0.0.1 precision-time.com
            127.0.0.1 www.pricebandit.com
            127.0.0.1 pricebandit.com
            127.0.0.1 www.prosearching.com
            127.0.0.1 prosearching.com
            127.0.0.1 www.qcksearch.com
            127.0.0.1 qcksearch.com
            127.0.0.1 www.resultsmaster.com
            127.0.0.1 resultsmaster.com
            127.0.0.1 www.rgs1.net
            127.0.0.1 rgs1.net
            127.0.0.1 www.rgs2.net
            127.0.0.1 rgs2.net
            127.0.0.1 www.roispy.com
            127.0.0.1 roispy.com
            127.0.0.1 www.rspsearch.com
            127.0.0.1 rspsearch.com
            127.0.0.1 www.rub.to
            127.0.0.1 rub.to
            127.0.0.1 www.sbvr.com
            127.0.0.1 sbvr.com
            127.0.0.1 www.search200.com
            127.0.0.1 search200.com
            127.0.0.1 www.searchassistant.net
            127.0.0.1 searchassistant.net
            127.0.0.1 www.searchexe.com
            127.0.0.1 searchexe.com
            127.0.0.1 www.searchscout.com
            127.0.0.1 searchscout.com
            127.0.0.1 www.searchweb2.com
            127.0.0.1 searchweb2.com
            127.0.0.1 www.similarsingles.com
            127.0.0.1 similarsingles.com
            127.0.0.1 www.spawnet.com
            127.0.0.1 spawnet.com
            127.0.0.1 www.spiderbait.com
            127.0.0.1 spiderbait.com
            127.0.0.1 www.spywarehelp.net
            127.0.0.1 spywarehelp.net
            127.0.0.1 www.spywarenuker.com
            127.0.0.1 spywarenuker.com
            127.0.0.1 www.srv2cpt.com
            127.0.0.1 srv2cpt.com
            127.0.0.1 www.stop-popup-ads-now.com
            127.0.0.1 stop-popup-ads-now.com
            127.0.0.1 www.tdko.com
            127.0.0.1 tdko.com
            127.0.0.1 www.tfil.com
            127.0.0.1 tfil.com
            127.0.0.1 www.tgcsearch.com
            127.0.0.1 tgcsearch.com
            127.0.0.1 www.thinkingmedia.net
            127.0.0.1 thinkingmedia.net
            127.0.0.1 www.topicks.com
            127.0.0.1 topicks.com
            127.0.0.1 www.totalvelocity.com
            127.0.0.1 totalvelocity.com
            127.0.0.1 www.tps108.org
            127.0.0.1 tps108.org
            127.0.0.1 www.trekblue.com
            127.0.0.1 trekblue.com
            127.0.0.1 www.twain-tech.com
            127.0.0.1 twain-tech.com
            127.0.0.1 www.unitedvending.net
            127.0.0.1 unitedvending.net
            127.0.0.1 www.virtumundo.com
            127.0.0.1 virtumundo.com
            127.0.0.1 www.vx2.cc
            127.0.0.1 vx2.cc
            127.0.0.1 www.weatherscope.com
            127.0.0.1 weatherscope.com
            127.0.0.1 www.websecurealert.com
            127.0.0.1 websecurealert.com
            127.0.0.1 www.whenu.com
            127.0.0.1 whenu.com
            127.0.0.1 www.whenu.com.edgesuite.net
            127.0.0.1 whenu.com.edgesuite.net
            127.0.0.1 www.whenusearch.com
            127.0.0.1 whenusearch.com
            127.0.0.1 www.whenushop.com
            127.0.0.1 whenushop.com
            127.0.0.1 www.world-portal.com
            127.0.0.1 world-portal.com
            127.0.0.1 www.yoogee.com
            127.0.0.1 yoogee.com
            127.0.0.1 www.zestyfind.com
            127.0.0.1 zestyfind.com
            127.0.0.1 www.zsearchtoolbar.com
            127.0.0.1 zsearchtoolbar.com
            127.0.0.1 www1.iwon.com
            127.0.0.1 www.www1.iwon.com
            127.0.0.1 www1.lop.com
            127.0.0.1 www.www1.lop.com
            127.0.0.1 www2.browsertoolbar.com
            127.0.0.1 www.www2.browsertoolbar.com
            127.0.0.1 www2.i-lookup.com
            127.0.0.1 www.www2.i-lookup.com
            127.0.0.1 xads.offeroptimizer.com
            127.0.0.1 www.xads.offeroptimizer.com
            127.0.0.1 xadso.offeroptimizer.com
            127.0.0.1 www.xadso.offeroptimizer.com
            127.0.0.1 xadsq.offeroptimizer.com
            127.0.0.1 www.xadsq.offeroptimizer.com
            127.0.0.1 xadx.offeroptimizer.com
            127.0.0.1 www.xadx.offeroptimizer.com
            127.0.0.1 xbs.climaxbucks.com
            127.0.0.1 www.xbs.climaxbucks.com
            127.0.0.1 xbs.cocktailcash.com
            127.0.0.1 www.xbs.cocktailcash.com
            127.0.0.1 ximages.offeroptimizer.com
            127.0.0.1 www.ximages.offeroptimizer.com
            127.0.0.1 xjupiter.com
            127.0.0.1 www.xjupiter.com
            127.0.0.1 xlime.offeroptimizer.com
            127.0.0.1 www.xlime.offeroptimizer.com
            127.0.0.1 xml.411web.com
            127.0.0.1 www.xml.411web.com
            127.0.0.1 xmlsearch.balance.gator.com
            127.0.0.1 www.xmlsearch.balance.gator.com
            127.0.0.1 xmlsearch.gator.com
            127.0.0.1 www.xmlsearch.gator.com
            127.0.0.1 yahoo.3721.com
            127.0.0.1 www.yahoo.3721.com
            127.0.0.1 yoogee.com
            127.0.0.1 www.yoogee.com
            127.0.0.1 z1.vx2.cc
            127.0.0.1 www.z1.vx2.cc
            127.0.0.1 zestyfind.com
            127.0.0.1 www.zestyfind.com
            127.0.0.1 zinc.whenu.com
            127.0.0.1 www.zinc.whenu.com
            127.0.0.1 zsearchtoolbar.com
            127.0.0.1 www.zsearchtoolbar.com
            202.67.220.233 win.mail.ru
            127.0.0.1 www.007guard.com
            127.0.0.1 007guard.com
            127.0.0.1 008i.com
            127.0.0.1 www.008k.com
            127.0.0.1 008k.com
            127.0.0.1 www.00hq.com
            127.0.0.1 00hq.com
            127.0.0.1 010402.com
            127.0.0.1 www.032439.com
            127.0.0.1 032439.com
            127.0.0.1 www.1001-search.info
            127.0.0.1 1001-search.info
            127.0.0.1 www.100888290cs.com
            127.0.0.1 100888290cs.com
            127.0.0.1 www.100sexlinks.com
            127.0.0.1 100sexlinks.com
            127.0.0.1 www.10sek.com
            127.0.0.1 10sek.com
            127.0.0.1 www.123topsearch.com
            127.0.0.1 123topsearch.com
            127.0.0.1 www.132.com
            127.0.0.1 132.com
            127.0.0.1 www.136136.net
            127.0.0.1 136136.net
            127.0.0.1 www.139mm.com
            127.0.0.1 139mm.com
            127.0.0.1 www.163ns.com
            127.0.0.1 163ns.com
            127.0.0.1 171203.com
            127.0.0.1 17-plus.com
            127.0.0.1 www.1800searchonline.com
            127.0.0.1 1800searchonline.com
            127.0.0.1 www.180searchassistant.com
            127.0.0.1 180searchassistant.com
            127.0.0.1 www.180solutions.com
            127.0.0.1 180solutions.com
            127.0.0.1 www.181.365soft.info
            127.0.0.1 181.365soft.info
            127.0.0.1 www.1987324.com
            127.0.0.1 1987324.com
            127.0.0.1 www.1-domains-registrations.com
            127.0.0.1 1-domains-registrations.com
            127.0.0.1 www.1-extreme.biz
            127.0.0.1 1-extreme.biz
            127.0.0.1 www.1sexparty.com
            127.0.0.1 1sexparty.com
            127.0.0.1 www.1stantivirus.com
            127.0.0.1 1stantivirus.com
            127.0.0.1 www.1stpagehere.com
            127.0.0.1 1stpagehere.com
            127.0.0.1 www.1stsearchportal.com
            127.0.0.1 1stsearchportal.com
            127.0.0.1 2.82211.net
            127.0.0.1 www.2006ooo.com
            127.0.0.1 www.2007-download.com
            127.0.0.1 2007-download.com
            127.0.0.1 www.2020search.com
            127.0.0.1 2020search.com
            127.0.0.1 20x2p.com
            127.0.0.1 www.24.365soft.info
            127.0.0.1 24.365soft.info
            127.0.0.1 www.24-7pharmacy.info
            127.0.0.1 24-7pharmacy.info
            127.0.0.1 www.24-7searching-and-more.com
            127.0.0.1 24-7searching-and-more.com
            127.0.0.1 www.24teen.com
            127.0.0.1 24teen.com
            127.0.0.1 www.2every.net
            127.0.0.1 2every.net
            127.0.0.1 2ndpower.com
            127.0.0.1 www.2search.com
            127.0.0.1 2search.com
            127.0.0.1 www.2search.org
            127.0.0.1 2search.org
            127.0.0.1 www.2squared.com
            127.0.0.1 2squared.com
            127.0.0.1 www.3322.org
            127.0.0.1 3322.org
            127.0.0.1 365soft.info
            127.0.0.1 www.36site.com
            127.0.0.1 36site.com
            127.0.0.1 39-93.com
            127.0.0.1 www.3abetterinternet.com
            127.0.0.1 3abetterinternet.com
            127.0.0.1 www.3bay.it
            127.0.0.1 3bay.it
            127.0.0.1 www.3ebay.it
            127.0.0.1 3ebay.it
            127.0.0.1 www.3xclipsonline.com
            127.0.0.1 3xclipsonline.com
            127.0.0.1 www.3xcurves.com
            127.0.0.1 3xcurves.com
            127.0.0.1 www.3xfestival.com
            127.0.0.1 3xfestival.com
            127.0.0.1 www.3x-festival.com
            127.0.0.1 3x-festival.com
            127.0.0.1 www.3x-galls.com
            127.0.0.1 3x-galls.com
            127.0.0.1 www.3xmiracle.com
            127.0.0.1 3xmiracle.com
            127.0.0.1 www.3xmoviesblog.com
            127.0.0.1 3xmoviesblog.com
            127.0.0.1 www.404dns.com
            127.0.0.1 404dns.com
            127.0.0.1 www.4199.com
            127.0.0.1 4199.com
            127.0.0.1 www.4corn.net
            127.0.0.1 4corn.net
            127.0.0.1 www.4ebay.it
            127.0.0.1 4ebay.it
            127.0.0.1 4klm.com
            127.0.0.1 www.4mpg.com
            127.0.0.1 4mpg.com
            127.0.0.1 www.4repubblica.it
            127.0.0.1 4repubblica.it
            127.0.0.1 www.4softget.com
            127.0.0.1 4softget.com
            127.0.0.1 www.5iscali.it
            127.0.0.1 5iscali.it
            127.0.0.1 www.5repubblica.it
            127.0.0.1 5repubblica.it
            127.0.0.1 www.5starvideos.com
            127.0.0.1 5starvideos.com
            127.0.0.1 www.5tiscali.it
            127.0.0.1 5tiscali.it
            127.0.0.1 www.5zgmu7o20kt5d8yq.com
            127.0.0.1 5zgmu7o20kt5d8yq.com
            127.0.0.1 www.6iscali.it
            127.0.0.1 6iscali.it
            127.0.0.1 www.6njaga.com
            127.0.0.1 6njaga.com
            127.0.0.1 www.6sek.com
            127.0.0.1 6sek.com
            127.0.0.1 www.6tiscali.it
            127.0.0.1 6tiscali.it
            127.0.0.1 www.70-music.com
            127.0.0.1 70-music.com
            127.0.0.1 www.7322.com
            127.0.0.1 7322.com
            127.0.0.1 75tz.com
            127.0.0.1 www.777search.com
            127.0.0.1 777search.com
            127.0.0.1 www.777top.com
            127.0.0.1 777top.com
            127.0.0.1 www.7939.com
            127.0.0.1 7939.com
            127.0.0.1 80gw6ry3i3x3qbrkwhxhw.032439.com
            127.0.0.1 www.80-music.com
            127.0.0.1 80-music.com
            127.0.0.1 82211.net
            127.0.0.1 8866.org
            127.0.0.1 www.888.com
            127.0.0.1 888.com
            127.0.0.1 www.8ad.com
            127.0.0.1 8ad.com
            127.0.0.1 www.90-music.com
            127.0.0.1 90-music.com
            127.0.0.1 www.9505.com
            127.0.0.1 9505.com
            127.0.0.1 www.971searchbox.com
            127.0.0.1 971searchbox.com
            127.0.0.1 a.bestmanage.org
            127.0.0.1 www.aaabesthomepage.com
            127.0.0.1 aaabesthomepage.com
            127.0.0.1 aaasexypics.com
            127.0.0.1 www.aaawebfinder.com
            127.0.0.1 aaawebfinder.com
            127.0.0.1 www.aaqadarsztriv.com
            127.0.0.1 aaqadarsztriv.com
            127.0.0.1 www.aaqada-rsztriv.com
            127.0.0.1 aaqada-rsztriv.com
            127.0.0.1 www.aaqadaueorn.com
            127.0.0.1 aaqadaueorn.com
            127.0.0.1 www.aaqada-ueorn.com
            127.0.0.1 aaqada-ueorn.com
            127.0.0.1 www.aaqada-ygco.com
            127.0.0.1 aaqada-ygco.com
            127.0.0.1 www.aaqada-ymct.com
            127.0.0.1 aaqada-ymct.com
            127.0.0.1 aavc.com
            127.0.0.1 www.abcdperformance.com
            127.0.0.1 abcdperformance.com
            127.0.0.1 www.abc-find.info
            127.0.0.1 abc-find.info
            127.0.0.1 www.abcsearch.com
            127.0.0.1 abcsearch.com
            127.0.0.1 www.abnetsoft.info
            127.0.0.1 abnetsoft.info
            127.0.0.1 www.aboutclicker.com
            127.0.0.1 aboutclicker.com
            127.0.0.1 www.abrp.net
            127.0.0.1 abrp.net
            127.0.0.1 www.absolutee.com
            127.0.0.1 absolutee.com
            127.0.0.1 www.abyssmedia.com
            127.0.0.1 abyssmedia.com
            127.0.0.1 www.ac66.cn
            127.0.0.1 ac66.cn
            127.0.0.1 access.Navinetwork.com
            127.0.0.1 access.rapid-pass.net
            127.0.0.1 www.accessactivexvideo.com
            127.0.0.1 accessactivexvideo.com
            127.0.0.1 www.accessclips.com
            127.0.0.1 accessclips.com
            127.0.0.1 www.access-dvd.com
            127.0.0.1 access-dvd.com
            127.0.0.1 www.accesskeygenerator.com
            127.0.0.1 accesskeygenerator.com
            127.0.0.1 www.accessorygeeks.com
            127.0.0.1 accessorygeeks.com
            127.0.0.1 www.accessthefuture.net
            127.0.0.1 accessthefuture.net
            127.0.0.1 www.accessvid.net
            127.0.0.1 accessvid.net
            127.0.0.1 www.acemedic.com
            127.0.0.1 acemedic.com
            127.0.0.1 www.ace-webmaster.com
            127.0.0.1 ace-webmaster.com
            127.0.0.1 acjp.com
            127.0.0.1 www.acrobat-2007.com
            127.0.0.1 acrobat-2007.com
            127.0.0.1 www.acrobat-8.com
            127.0.0.1 acrobat-8.com
            127.0.0.1 www.acrobat-center.com
            127.0.0.1 acrobat-center.com
            127.0.0.1 www.acrobat-hq.com
            127.0.0.1 acrobat-hq.com
            127.0.0.1 www.acrobatreader-8.com
            127.0.0.1 acrobatreader-8.com
            127.0.0.1 www.acrobat-reader-8.de
            127.0.0.1 acrobat-reader-8.de
            127.0.0.1 www.acrobat-stop.com
            127.0.0.1 acrobat-stop.com
            127.0.0.1 www.actionbreastcancer.org
            127.0.0.1 actionbreastcancer.org
            127.0.0.1 www.activesearcher.info
            127.0.0.1 activesearcher.info
            127.0.0.1 www.activexaccessobject.com
            127.0.0.1 activexaccessobject.com
            127.0.0.1 www.activexaccessvideo.com
            127.0.0.1 activexaccessvideo.com
            127.0.0.1 www.activexemedia.com
            127.0.0.1 activexemedia.com
            127.0.0.1 www.activexmediaobject.com
            127.0.0.1 activexmediaobject.com
            127.0.0.1 www.activexmediapro.com
            127.0.0.1 activexmediapro.com
            127.0.0.1 www.activexmediasite.com
            127.0.0.1 activexmediasite.com
            127.0.0.1 www.activexmediasoftware.com
            127.0.0.1 activexmediasoftware.com
            127.0.0.1 www.activexmediasource.com
            127.0.0.1 activexmediasource.com
            127.0.0.1 www.activexmediatool.com
            127.0.0.1 activexmediatool.com
            127.0.0.1 www.activexmediatour.com
            127.0.0.1 activexmediatour.com
            127.0.0.1 www.activexsoftwares.com
            127.0.0.1 activexsoftwares.com
            127.0.0.1 www.activexsource.com
            127.0.0.1 activexsource.com
            127.0.0.1 www.activexupdate.com
            127.0.0.1 activexupdate.com
            127.0.0.1 www.activexvideo.com
            127.0.0.1 activexvideo.com
            127.0.0.1 www.activexvideotool.com
            127.0.0.1 activexvideotool.com
            127.0.0.1 www.ad.marketingsector.com
            127.0.0.1 ad.marketingsector.com
            127.0.0.1 www.ad.mokead.com
            127.0.0.1 ad.mokead.com
            127.0.0.1 ad.oinadserver.com
            127.0.0.1 ad.outerinfoads.com
            127.0.0.1 www.ad.yieldmanager.com
            127.0.0.1 ad.yieldmanager.com
            127.0.0.1 ad25.com
            127.0.0.1 ad45.com
            127.0.0.1 ad77.com
            127.0.0.1 ad86.com
            127.0.0.1 www.adamsupportgroup.org
            127.0.0.1 adamsupportgroup.org
            127.0.0.1 www.adarmor.com
            127.0.0.1 adarmor.com
            127.0.0.1 www.adasearch.com
            127.0.0.1 adasearch.com
            127.0.0.1 adaware.cc
            127.0.0.1 www.adawarenow.com
            127.0.0.1 adawarenow.com
            127.0.0.1 adchannel.contextplus.net
            127.0.0.1 www.addetect.com
            127.0.0.1 addetect.com
            127.0.0.1 www.addictivetechnologies.com
            127.0.0.1 addictivetechnologies.com
            127.0.0.1 www.addioerrori.com
            127.0.0.1 addioerrori.com
            127.0.0.1 www.add-manager.com
            127.0.0.1 add-manager.com
            127.0.0.1 www.adgate.info
            127.0.0.1 adgate.info
            127.0.0.1 www.adioserrores.com
            127.0.0.1 adioserrores.com
            127.0.0.1 www.adipics.com
            127.0.0.1 adipics.com
            127.0.0.1 www.adlogix.com
            127.0.0.1 adlogix.com
            127.0.0.1 www.admin2cash.biz
            127.0.0.1 admin2cash.biz
            127.0.0.1 adnet-plus.com
            127.0.0.1 www.adnetserver.com
            127.0.0.1 adnetserver.com
            127.0.0.1 adobe-download-now.com
            127.0.0.1 www.adobe-downloads.com
            127.0.0.1 adobe-downloads.com
            127.0.0.1 www.adobe-reader-8.fr
            127.0.0.1 adobe-reader-8.fr
            127.0.0.1 www.adprotect.com
            127.0.0.1 adprotect.com
            127.0.0.1 ads.k8l.info
            127.0.0.1 ads.kmpads.com
            127.0.0.1 ads.kw.revenue.net
            127.0.0.1 ads.marketingsector.com
            127.0.0.1 ads.searchingbooth.com
            127.0.0.1 ads.z-quest.com
            127.0.0.1 ads1.revenue.net
            127.0.0.1 www.ads183.com
            127.0.0.1 ads183.com
            127.0.0.1 www.adscontex.com
            127.0.0.1 adscontex.com
            127.0.0.1 www.adservices1.enhance.com
            127.0.0.1 adservices1.enhance.com
            127.0.0.1 adservs.com
            127.0.0.1 www.adsextend.net
            127.0.0.1 adsextend.net
            127.0.0.1 www.adshttp.com
            127.0.0.1 adshttp.com
            127.0.0.1 www.adsniffer.com
            127.0.0.1 adsniffer.com
            127.0.0.1 www.adsonwww.com
            127.0.0.1 adsonwww.com
            127.0.0.1 www.adspics.com
            127.0.0.1 adspics.com
            127.0.0.1 www.adsrevenue.net
            127.0.0.1 adsrevenue.net
            127.0.0.1 www.adtrak.net
            127.0.0.1 adtrak.net
            127.0.0.1 adtrgt.com
            127.0.0.1 www.adult777search.info
            127.0.0.1 adult777search.info
            127.0.0.1 www.adultan.com
            127.0.0.1 adultan.com
            127.0.0.1 www.adult-engine-search.com
            127.0.0.1 adult-engine-search.com
            127.0.0.1 www.adult-erotic-guide.net
            127.0.0.1 adult-erotic-guide.net
            127.0.0.1 www.adultfilmsite.com
            127.0.0.1 adultfilmsite.com
            127.0.0.1 www.adult-friends-finder.net
            127.0.0.1 adult-friends-finder.net
            127.0.0.1 adultgambling.org
            127.0.0.1 adult-host.org
            127.0.0.1 www.adulthyperlinks.com
            127.0.0.1 adulthyperlinks.com
            127.0.0.1 www.adultmovieplus.com
            127.0.0.1 adultmovieplus.com
            127.0.0.1 www.adult-mpg.net
            127.0.0.1 adult-mpg.net
            127.0.0.1 adult-personal.us
            127.0.0.1 adultsgames.net
            127.0.0.1 www.adultsonlyvids.com
            127.0.0.1 adultsonlyvids.com
            127.0.0.1 www.adultsper.com
            127.0.0.1 adultsper.com
            127.0.0.1 www.adulttds.com
            127.0.0.1 adulttds.com
            127.0.0.1 www.adultzoneworld.com
            127.0.0.1 adultzoneworld.com
            127.0.0.1 www.advcash.biz
            127.0.0.1 advcash.biz
            127.0.0.1 advert.exaccess.ru
            127.0.0.1 www.advertisemoney.info
            127.0.0.1 advertisemoney.info
            127.0.0.1 advertising.paltalk.com
            127.0.0.1 www.advertising-money.info
            127.0.0.1 advertising-money.info
            127.0.0.1 ad-ware.cc
            127.0.0.1 www.ad-w-a-r-e.com
            127.0.0.1 ad-w-a-r-e.com
            127.0.0.1 www.a-d-w-a-r-e.com
            127.0.0.1 a-d-w-a-r-e.com
            127.0.0.1 www.adwarebazooka.com
            127.0.0.1 adwarebazooka.com
            127.0.0.1 www.adwarecommander.com
            127.0.0.1 adwarecommander.com
            127.0.0.1 www.adwarefinder.com
            127.0.0.1 adwarefinder.com
            127.0.0.1 www.adwaregold.com
            127.0.0.1 adwaregold.com
            127.0.0.1 www.adwarepatrol.com
            127.0.0.1 adwarepatrol.com
            127.0.0.1 www.adwareplatinum.com
            127.0.0.1 adwareplatinum.com
            127.0.0.1 www.adwareprotectionsite.com
            127.0.0.1 adwareprotectionsite.com
            127.0.0.1 www.adwarepunisher.com
            127.0.0.1 adwarepunisher.com
            127.0.0.1 www.adwareremover.ws
            127.0.0.1 adwareremover.ws
            127.0.0.1 www.adwaresafety.com
            127.0.0.1 adwaresafety.com
            127.0.0.1 www.adwarexp.com
            127.0.0.1 adwarexp.com
            127.0.0.1 affiliate.idownload.com
            127.0.0.1 www.aflgate.com
            127.0.0.1 aflgate.com
            127.0.0.1 africaspromise.org
            127.0.0.1 agava.com
            127.0.0.1 agava.ru
            127.0.0.1 agentstudio.com
            127.0.0.1 www.aginegialle.it
            127.0.0.1 aginegialle.it
            127.0.0.1 aifind.info
            127.0.0.1 www.aifind.info
            127.0.0.1 www.airtleworld.com
            127.0.0.1 airtleworld.com
            127.0.0.1 www.aitalia.it
            127.0.0.1 aitalia.it
            127.0.0.1 akamai.downloadv3.com
            127.0.0.1 www.aklitalia.it
            127.0.0.1 aklitalia.it
            127.0.0.1 akril.com
            127.0.0.1 alcatel.ws
            127.0.0.1 www.alertspy.com
            127.0.0.1 alertspy.com
            127.0.0.1 www.alfacleaner.com
            127.0.0.1 alfacleaner.com
            127.0.0.1 alfa-search.com
            127.0.0.1 www.alialia.it
            127.0.0.1 alialia.it
            127.0.0.1 www.aliotalia.it
            127.0.0.1 aliotalia.it
            127.0.0.1 www.alirtalia.it
            127.0.0.1 alirtalia.it
            127.0.0.1 www.alitaia.it
            127.0.0.1 alitaia.it
            127.0.0.1 www.alitaklia.it
            127.0.0.1 alitaklia.it
            127.0.0.1 www.alitala.it
            127.0.0.1 alitala.it
            127.0.0.1 www.alitali.it
            127.0.0.1 alitali.it
            127.0.0.1 www.alitaliaq.it
            127.0.0.1 alitaliaq.it
            127.0.0.1 www.alitalias.it
            127.0.0.1 alitalias.it
            127.0.0.1 www.alitaliaz.it
            127.0.0.1 alitaliaz.it
            127.0.0.1 www.alitalioa.it
            127.0.0.1 alitalioa.it
            127.0.0.1 www.alitalisa.it
            127.0.0.1 alitalisa.it
            127.0.0.1 www.alitaliua.it
            127.0.0.1 alitaliua.it
            127.0.0.1 www.alitalkia.it
            127.0.0.1 alitalkia.it
            127.0.0.1 www.alitaloia.it
            127.0.0.1 alitaloia.it
            127.0.0.1 www.alitaluia.it
            127.0.0.1 alitaluia.it
            127.0.0.1 www.alitaslia.it
            127.0.0.1 alitaslia.it
            127.0.0.1 www.alitlia.it
            127.0.0.1 alitlia.it
            127.0.0.1 www.alitralia.it
            127.0.0.1 alitralia.it
            127.0.0.1 www.alitsalia.it
            127.0.0.1 alitsalia.it
            127.0.0.1 www.aliutalia.it
            127.0.0.1 aliutalia.it
            127.0.0.1 www.ALL1COUNT.NET
            127.0.0.1 ALL1COUNT.NET
            127.0.0.1 www.all4internet.com
            127.0.0.1 all4internet.com
            127.0.0.1 allabtcars.com
            127.0.0.1 allabtjeeps.com
            127.0.0.1 www.all-bittorrent.com
            127.0.0.1 all-bittorrent.com
            127.0.0.1 allcybersearch.com
            127.0.0.1 www.allcybersearch.com
            127.0.0.1 www.alldnserrors.com
            127.0.0.1 alldnserrors.com
            127.0.0.1 www.all-downloads-now.com
            127.0.0.1 all-downloads-now.com
            127.0.0.1 www.all-edonkey.com
            127.0.0.1 all-edonkey.com
            127.0.0.1 www.allertaminacce.com
            127.0.0.1 allertaminacce.com
            127.0.0.1 allforadult.com
            127.0.0.1 www.alliesecurity.com
            127.0.0.1 alliesecurity.com
            127.0.0.1 all-inet.com
            127.0.0.1 allinternetbusiness.com
            127.0.0.1 www.all-limewire.com
            127.0.0.1 all-limewire.com
            127.0.0.1 www.allmegabucks.com
            127.0.0.1 allmegabucks.com
            127.0.0.1 www.allprotections.com
            127.0.0.1 allprotections.com
            127.0.0.1 www.allresultz.net
            127.0.0.1 allresultz.net
            127.0.0.1 www.allsearch.us
            127.0.0.1 allsearch.us
            127.0.0.1 www.allsecuritynotes.com
            127.0.0.1 allsecuritynotes.com
            127.0.0.1 www.allsecuritysite.com
            127.0.0.1 allsecuritysite.com
            127.0.0.1 www.allstarsvideos.net
            127.0.0.1 allstarsvideos.net
            127.0.0.1 www.alltiettantivirus.com
            127.0.0.1 alltiettantivirus.com
            127.0.0.1 www.alltruesoftware.com
            127.0.0.1 alltruesoftware.com
            127.0.0.1 www.allvideoactivex.com
            127.0.0.1 allvideoactivex.com
            127.0.0.1 www.almanah.biz
            127.0.0.1 almanah.biz
            127.0.0.1 almarvideos.com
            127.0.0.1 www.aloitalia.it
            127.0.0.1 aloitalia.it
            127.0.0.1 www.aluitalia.it
            127.0.0.1 aluitalia.it
            127.0.0.1 www.amaena.com
            127.0.0.1 amaena.com
            127.0.0.1 amandamountains.com
            127.0.0.1 www.amateurliveshow.com
            127.0.0.1 amateurliveshow.com
            127.0.0.1 www.amediasoftware.com
            127.0.0.1 amediasoftware.com
            127.0.0.1 www.amediasource.com
            127.0.0.1 amediasource.com
            127.0.0.1 www.americanautobargains.com
            127.0.0.1 americanautobargains.com
            127.0.0.1 www.americancarbargains.com
            127.0.0.1 americancarbargains.com
            127.0.0.1 american-teens.net
            127.0.0.1 amigeek.com
            127.0.0.1 www.amigobore.com
            127.0.0.1 amigobore.com
            127.0.0.1 amisbusiness.com
            127.0.0.1 www.ampmsearch.com
            127.0.0.1 ampmsearch.com
            127.0.0.1 www.analcord.com
            127.0.0.1 analcord.com
            127.0.0.1 analmovi.com
            127.0.0.1 www.anarchylolita.com
            127.0.0.1 anarchylolita.com
            127.0.0.1 anarchyporn.com
            127.0.0.1 www.andromedical.com
            127.0.0.1 andromedical.com
            127.0.0.1 www.animepornmag.com
            127.0.0.1 animepornmag.com
            127.0.0.1 anin.org
            127.0.0.1 www.anjpn-avxiz.biz
            127.0.0.1 anjpn-avxiz.biz
            127.0.0.1 www.anjpnzqav.biz
            127.0.0.1 anjpnzqav.biz
            127.0.0.1 www.anjpn-zqav.biz
            127.0.0.1 anjpn-zqav.biz
            127.0.0.1 annaromeo.com
            127.0.0.1 www.antiddos.us
            127.0.0.1 antiddos.us
            127.0.0.1 www.Antiespiadorado.com
            127.0.0.1 Antiespiadorado.com
            127.0.0.1 www.Antiespionspack.com
            127.0.0.1 Antiespionspack.com
            127.0.0.1 www.Antigusanos2008.com
            127.0.0.1 Antigusanos2008.com
            127.0.0.1 www.antispamassistant.com
            127.0.0.1 antispamassistant.com
            127.0.0.1 www.antispamdeluxe.com
            127.0.0.1 antispamdeluxe.com
            127.0.0.1 www.Antispionage.com
            127.0.0.1 Antispionage.com
            127.0.0.1 www.Antispionagepro.com
            127.0.0.1 Antispionagepro.com
            127.0.0.1 www.antispyadvanced.com
            127.0.0.1 antispyadvanced.com
            127.0.0.1 www.antispydns.biz
            127.0.0.1 antispydns.biz
            127.0.0.1 www.antispylab.com
            127.0.0.1 antispylab.com
            127.0.0.1 www.antispysolutions.com
            127.0.0.1 antispysolutions.com
            127.0.0.1 www.antispyware.com
            127.0.0.1 antispyware.com
            127.0.0.1 www.antispywareboot.com
            127.0.0.1 antispywareboot.com
            127.0.0.1 www.antispywarebot.com
            127.0.0.1 antispywarebot.com
            127.0.0.1 www.antispywarebox.com
            127.0.0.1 antispywarebox.com
            127.0.0.1 www.antispywaredownloads.com
            127.0.0.1 antispywaredownloads.com
            127.0.0.1 antispywaresuite.com
            127.0.0.1 www.antispywaresuite.com
            127.0.0.1 Antispywaresuite.com
            127.0.0.1 www.Antispywaresuite.com
            127.0.0.1 www.antispywarexp.com
            127.0.0.1 antispywarexp.com
            127.0.0.1 www.Antispyweb.net
            127.0.0.1 Antispyweb.net
            127.0.0.1 www.Antiver2008.com
            127.0.0.1 Antiver2008.com
            127.0.0.1 www.antivermins.com
            127.0.0.1 antivermins.com
            127.0.0.1 www.anti-vermins.com
            127.0.0.1 anti-vermins.com
            127.0.0.1 www.antivir2007.com
            127.0.0.1 antivir2007.com
            127.0.0.1 www.antivirgear.com
            127.0.0.1 antivirgear.com
            127.0.0.1 www.antivirus.fastfreedownload.com
            127.0.0.1 antivirus.fastfreedownload.com
            127.0.0.1 www.antivirusadvance.com
            127.0.0.1 antivirusadvance.com
            127.0.0.1 www.antivirusaskeladd.com
            127.0.0.1 antivirusaskeladd.com
            127.0.0.1 www.antivirusgereedschap.com
            127.0.0.1 antivirusgereedschap.com
            127.0.0.1 www.antivirusgolden.com
            127.0.0.1 antivirusgolden.com
            127.0.0.1 www.antivirus-hq.net
            127.0.0.1 antivirus-hq.net
            127.0.0.1 www.antiviruspcsuite.com
            127.0.0.1 antiviruspcsuite.com
            127.0.0.1 www.antiviruspremium.com
            127.0.0.1 antiviruspremium.com
            127.0.0.1 www.anti-virus-pro.com
            127.0.0.1 anti-virus-pro.com
            127.0.0.1 www.antivirusprotector.com
            127.0.0.1 antivirusprotector.com
            127.0.0.1 www.antivirussc
            1. Voici les rapports .
              je vais essayer de me connecter à internet ...

              Username "Compaq_Propri‚taire" - 07/03/2008 19:31:44 [Fixwareout edited 9/01/2007]

              ~~~~~ Prerun check

              System was rebooted successfully.

              ~~~~~ Postrun check
              HKLM\SOFTWARE\~\Winlogon\ "System"=""
              ....
              ....
              ~~~~~ Misc files.
              ....
              ~~~~~ Checking for older varients.
              ....

              ~~~~~ Current runs (hklm hkcu "run" Keys Only)
              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe"
              "KBD"="C:\\HP\\KBD\\KBD.EXE"
              "Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
              "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
              "nwiz"="nwiz.exe /installquiet /keeploaded /nodetect"
              "VTTimer"="VTTimer.exe"
              "SiS Windows KeyHook"="C:\\WINDOWS\\system32\\keyhook.exe"
              "AGRSMMSG"="AGRSMMSG.exe"
              "PS2"="C:\\WINDOWS\\system32\\ps2.exe"
              "AlcxMonitor"="ALCXMNTR.EXE"
              "Lexmark 3100 Series"="\"C:\\Program Files\\Lexmark 3100 Series\\lxbrbmgr.exe\""
              "LXBRKsk"="C:\\PROGRA~1\\LEXMAR~1\\LXBRKsk.exe"
              "NeroCheck"="C:\\WINDOWS\\system32\\\\NeroCheck.exe"
              "InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
              "SNPSTD2"="C:\\WINDOWS\\vsnpstd2.exe"
              "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
              "tf1"="C:\\Program Files\\Player Video TF1\\tf1.exe"
              "CloneCDTray"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s"
              "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
              "BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent"
              "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
              "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
              "302af984"="rundll32.exe \"C:\\WINDOWS\\system32\\xwweaaxi.dll\",b"
              "BM3319ca18"="Rundll32.exe \"C:\\WINDOWS\\system32\\nxdgexgp.dll\",s"

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
              "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
              "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
              "SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
              ....
              Hosts file was reset, If you use a custom hosts file please replace it...
              ~~~~~ End report ~~~~~

              *****************************************************************************************

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 19:43:46, on 07/03/2008
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16608)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\csrss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\WINDOWS\system32\LEXBCES.EXE
              C:\WINDOWS\system32\spoolsv.exe
              C:\WINDOWS\system32\LEXPPS.EXE
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\nvsvc32.exe
              C:\Program Files\Spyware Doctor\sdhelp.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\system32\wdfmgr.exe
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\WINDOWS\System32\alg.exe
              C:\WINDOWS\Explorer.EXE
              C:\windows\system\hpsysdrv.exe
              C:\HP\KBD\KBD.EXE
              C:\WINDOWS\system32\keyhook.exe
              C:\WINDOWS\AGRSMMSG.exe
              C:\WINDOWS\system32\rundll32.exe
              C:\WINDOWS\ALCXMNTR.EXE
              C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe
              C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
              C:\Program Files\Ahead\InCD\InCD.exe
              C:\Program Files\Lexmark 3100 Series\lxbrbmon.exe
              C:\WINDOWS\vsnpstd2.exe
              C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
              C:\Program Files\Player Video TF1\tf1.exe
              C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
              C:\Program Files\iTunes\iTunesHelper.exe
              C:\WINDOWS\system32\rundll32.exe
              C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              C:\Program Files\QuickTime\qttask.exe
              C:\WINDOWS\system32\rundll32.exe
              C:\WINDOWS\system32\Rundll32.exe
              C:\Program Files\MSN Messenger\msnmsgr.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              C:\Program Files\iPod\bin\iPodService.exe
              C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
              C:\Program Files\WinZip\WZQKPICK.EXE
              C:\Hijacthis\HijackThis.exe
              C:\WINDOWS\system32\wbem\wmiprvse.exe

              R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=compaq-desktop.msn.com&ocid=HPDHP&pc=CPDTDF
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
              O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
              O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
              O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
              O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
              O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
              O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
              O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
              O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
              O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
              O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
              O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
              O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
              O4 - HKLM\..\Run: [LXBRKsk] C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
              O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
              O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
              O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
              O4 - HKLM\..\Run: [tf1] C:\Program Files\Player Video TF1\tf1.exe
              O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
              O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
              O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
              O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
              O4 - HKLM\..\Run: [302af984] rundll32.exe "C:\WINDOWS\system32\xwweaaxi.dll",b
              O4 - HKLM\..\Run: [BM3319ca18] Rundll32.exe "C:\WINDOWS\system32\nxdgexgp.dll",s
              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
              O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
              O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM')
              O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user')
              O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
              O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
              O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
              O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
              O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
              O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
              O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://mm.tf1.fr/superdistribution/installer2.cab
              O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://11731.kit.carpediem.fr/FanBrigitte.exe
              O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{409B6718-9F9C-4AF3-ABC8-AE78D1F9B6D2}: NameServer = 208.67.220.220,208.67.222.222
              O17 - HKLM\System\CCS\Services\Tcpip\..\{582FE5DB-BAA2-4CDD-B853-A89611945A07}: NameServer = 208.67.220.220,208.67.222.222
              O17 - HKLM\System\CCS\Services\Tcpip\..\{5F5AA804-0CC1-4E58-9E3B-69926B7D6519}: NameServer = 208.67.220.220,208.67.222.222
              O17 - HKLM\System\CCS\Services\Tcpip\..\{684A3E8E-C800-41D9-AA57-E4DDA1A0E49F}: NameServer = 208.67.220.220,208.67.222.222
              O17 - HKLM\System\CCS\Services\Tcpip\..\{8B2BCA9C-B9B9-46A2-AAD8-E754DF44BA00}: NameServer = 208.67.220.220,208.67.222.222
              O17 - HKLM\System\CCS\Services\Tcpip\..\{9CB1DE31-7017-42E1-865A-49A545E44CAB}: NameServer = 208.67.220.220,208.67.222.222
              O17 - HKLM\System\CCS\Services\Tcpip\..\{C4039785-BCFB-43E1-A826-FF9063F67734}: NameServer = 208.67.220.220,208.67.222.222
              O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
              O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
              O21 - SSODL: bxlrvps - {DF7C5A04-637E-47A5-B282-0DFD09806113} - C:\WINDOWS\bxlrvps.dll (file missing)
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
              O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
              O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
              O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
              1. j'ai pu me connecter a internet ... parcontre j'ai pas mal de fenêtres qui m'ont sautées à la figure : on veut absolument me forcer à scaner mon pc en ligne !!! que faire?
                1. la connexion plante une foi sur deux ... :( De plus Spybot a toujours quelque chose à blocquer ( de différent à chaque fois) et enplus il disparait aussi 1 fois sur 2 de la barre des tâches ...
                  J'ai pourtant fait un nettoyage avec CCleaner mais rien de changer ...
                  1. Contributeur sécurité
                    on continue il en reste pas mal!
                    Télécharge combofix.exe (par sUBs) sur ton Bureau
                    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
                    désactive ton antivirus, antispyware, et Spybot (résident) durant l'utilisation de ComboFix . Merci. Tu réactives ensuite.
                    Double clique combofix.exe.
                    Tape sur la touche Y (Yes) pour démarrer le scan.
                    Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse
                    NOTE : Le rapport se trouve également ici : C:\Combofix.txt
                    1. OK ... mais une question : dois-je renomé combofix ?
                      De plus, je te rappel que ce PC est en multi-sessions (5 administrateurs ) : excuse mon ignorance mais est-ce que cela à une inscidence quelquonque ? peut importe sur quel administrateur je suis ?
                      1. Contributeur sécurité
                        pas utile, je ne pense pas à bagle dans ce cas
                        on vérifiera ensuite lorsque la désinfection sera terminée que les autres sessions sont bien propres mais logiquement je pense que cela sera le cas!
                        1. Contributeur sécurité
                          à demain, il est tard et la journée de travail fut longue!!
                          1. Ok a demain ...
                            en millieux de matinnée ,pas avant ... ;-)
                        2. bonjour,
                          ce matin j'ai essayé de me connecter avec le PC pour régler les prb en direct de celui-ci mais nous voilà revenue a la case dépard |0\ : connexion avec IE 7 soit qui plante,soit la même fenêtre que s'ouvre me demandant de scaner gratuitement en ligne mon PC ...
                          De plus, lors d'un plantage une fenêtre wind. m'a dit :"buffer overrun detected' - Program:C:\WINDOWS\Explorer.EXE"
                          puis après plus de Spybot ...
                          J'ai l'impression aussi que les mise a jours de Avast sont pas faites ( manuellement il me dit qu'il est à jour alors que sur les autres PC j'ai des mises à jour au moins 1 fois par jours ... ).
                          J'ai lancer tout de même un scan d'Avast et il a déjà trouver ce-ci: "WIN32:Tronjan-gen" .
                          Le défit s'anonce assez difficile ;) ...
                          1. Contributeur sécurité
                            as tu passé Combofix? il me faut son rapport
                            de retour cet après midi, là je dois m'absenter
                            1. Avast est entrain de dénicher une tonne de sal....ries !!!Une fois tous cela en quarantaine je te ferai parvenir la liste.Puis je lancerai le combofix et posterai le rapport ... A cet après midi ...
                          • 1
                          • 2
                          • 3
                          • 4
                          • 5