Olimpo Informatico

[SaraNana]

ho fatto la scansione con hjt ora cosa devo fare??? il mio computer è lento ho spesso popup spyware e virus....uso Spybot - Search & Destroy AntiVir PE Classic Ad-Aware 2007(quest'ultimo si blocca fisso)
questo è il risultato della scansione con hjt..aspetto run aiuto



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18.02.09, on 24/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ltmsg.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\RFA\rfagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Programmi\Windows Desktop Search\WindowsSearch.exe
C:\Programmi\Alice ti aiuta\bin\mpbtn.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Programmi\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.it/bb/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0410/bl8.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [rfagent] "C:\Programmi\RFA\rfagent.exe"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Programmi\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Policies\Explorer\Run: [7H28X9M91L] C:\WINDOWS\winlogon32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Lotus Organizer EasyClip.lnk = ?
O4 - Global Startup: Lotus QuickStart.lnk = ?
O4 - Global Startup: Lotus SmartCenter.lnk = C:\lotus\smartctr\smartctr.exe
O4 - Global Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Programmi\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://zokyjo.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EE79FFF7-5DD9-4C47-8812-261FBEFA8770}: NameServer = 85.37.17.45 85.38.28.99
O21 - SSODL: printers - {4E570B67-AE1D-4883-BFF2-799C52A110B5} - libcintle2.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmi\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LogNaa - Unknown owner - \\?\C:\Programmi\File comuni\System\lpt5.exe (file missing)
O23 - Service: NetFcz - Unknown owner - \\?\C:\Programmi\Windows NT\com3.exe (file missing)
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\Sptisrv.exe

--
End of file - 8544 bytes

[bdoriano]

Consiglio, disinstalla Ad-Aware 2007.

Fai queste pulizie generiche:

• Pulisci i files temporanei con ATF-Cleaner e/o CCleaner
  
• Fai una scansione cone Norman Malware Cleaner.
  
  • Scarica il programma
    
  • Avvia il pc in modalità provvisoria.
    
  • Avvia Norman Malware Cleaner e fagli fare la scansione completa.
    
  • Alla fine della scansione viene generato un log sul desktop chiamato NFix_2008-MM-gg_hh-mm-ss.log.
  
  
• Riavvia il computer in modalità normale
  
• Segui le istruzioni di questo topic per eseguire combofix.
  
• Riferisci con un nuovo messaggio in questa discussione dell'esito: se ci sono stati problemi particolari, ecc. ecc. E riporta:
  
  • Carica il log di Norman Malware Cleaner su FreeFileHosting come indicato qui e posta il link che ti viene assegnato
    
  • Il log di Combofix generalmente non è molto lungo, quindi postalo direttamente nel messaggio

Ricordati di usare il tasto per continuare la discussione.

[SaraNana]

Alla fine della scansione viene generato un log sul desktop chiamato NFix_2008-MM-gg_hh-mm-ss.log.

questo non è successo....ho fatto la scnasione ma non è apparso alcun log....finita a scansione risultava un unico link che dava problemi e ke è stato cancellato...il resto non l ho fatto aspetto prima che mi dica tu se èun problema ke non sia apparso il log

[chemicalbit]

Guarda sul tuo desktop (lo sfondo) se c'è una nuova icona con quel file.

Se c'è postalo e prosegui con Combofix.

Se non c'è, bisogna capire il perché. Nel frattempo procedi con Combofix.

[SaraNana]

ah eko cos era procedo con quel programma

Norman Malware Cleaner
Copyright © 1990 - 2008, Norman ASA. Built 2008/05/12 19:08:33

Norman Scanner Engine Version: 5.92.04
Nvcbin.def Version: 5.92.00, Date: 2008/05/12 19:08:33, Variants: 1631317

Running pre-scan cleanup routine:
Operating System: Microsoft Windows XP Home 5.1.2600(Safe mode) Service Pack 2
Logged on user: ENRICO\Casa

Removed registry value: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools = 0x00000000
Removed hosts entry: 127.0.0.1 www.test.com
Removed hosts entry: 127.0.0.1 www.ads.x10.com
Removed hosts entry: 127.0.0.1 www.600pics.com
Removed hosts entry: 127.0.0.1 www.doberman.befree.com
Removed hosts entry: 127.0.0.1 www.enews.bfast.com
Removed hosts entry: 127.0.0.1 www.etoys.bfast.com
Removed hosts entry: 127.0.0.1 www.falcon.bfast.com
Removed hosts entry: 127.0.0.1 www.ftp.befree.com
Removed hosts entry: 127.0.0.1 www.ftp.bfast.com
Removed hosts entry: 127.0.0.1 www.geocities.bfast.com
Removed hosts entry: 127.0.0.1 www.goshoppingonline.bfast.com
Removed hosts entry: 127.0.0.1 www.great-dane.befree.com
Removed hosts entry: 127.0.0.1 www.great-dane.bfast.com
Removed hosts entry: 127.0.0.1 www.greyhound.bfast.com
Removed hosts entry: 127.0.0.1 www.help.bfast.com
Removed hosts entry: 127.0.0.1 www.husky.bfast.com
Removed hosts entry: 127.0.0.1 www.images.bfast.com
Removed hosts entry: 127.0.0.1 www.imp.bfast.com
Removed hosts entry: 127.0.0.1 www.njmgt1.bfast.com
Removed hosts entry: 127.0.0.1 www.njmgt2.bfast.com
Removed hosts entry: 127.0.0.1 www.njrep0.bfast.com
Removed hosts entry: 127.0.0.1 www.njrep1.bfast.com
Removed hosts entry: 127.0.0.1 www.njrep2.bfast.com
Removed hosts entry: 127.0.0.1 www.njtxn1.bfast.com
Removed hosts entry: 127.0.0.1 www.otterhound.bfast.com
Removed hosts entry: 127.0.0.1 www.preprod-geocities.bfast.com
Removed hosts entry: 127.0.0.1 www.preprod.bfast.com
Removed hosts entry: 127.0.0.1 www.qwest.bfast.com
Removed hosts entry: 127.0.0.1 www.reporting.net
Removed hosts entry: 127.0.0.1 www.ridgeback.befree.com
Removed hosts entry: 127.0.0.1 www.ridgeback.bfast.com
Removed hosts entry: 127.0.0.1 www.samoyed.bfast.com
Removed hosts entry: 127.0.0.1 www.scrappy.befree.com
Removed hosts entry: 127.0.0.1 www.service.bfast.com
Removed hosts entry: 127.0.0.1 www.travelocity.bfast.com
Removed hosts entry: 127.0.0.1 www.travsoft.bfast.com
Removed hosts entry: 127.0.0.1 www.verisign.bfast.com
Removed hosts entry: 127.0.0.1 www.vulture.bfast.com
Removed hosts entry: 127.0.0.1 www.whippet.bfast.com
Removed hosts entry: 127.0.0.1 www.wolfhound.bfast.com
Removed hosts entry: 127.0.0.1 www.befree.com
Removed hosts entry: 127.0.0.1 www.s0.bluestreak.com
Removed hosts entry: 127.0.0.1 www.s1.bluestreak.com
Removed hosts entry: 127.0.0.1 www.s2.bluestreak.com
Removed hosts entry: 127.0.0.1 www.s3.bluestreak.com
Removed hosts entry: 127.0.0.1 www.s4.bluestreak.com
Removed hosts entry: 127.0.0.1 www.s5.bluestreak.com
Removed hosts entry: 127.0.0.1 www.s6.bluestreak.com
Removed hosts entry: 127.0.0.1 www.s7.bluestreak.com
Removed hosts entry: 127.0.0.1 www.s8.bluestreak.com
Removed hosts entry: 127.0.0.1 www.abc.bnex.com
Removed hosts entry: 127.0.0.1 www.alpha.bnex.com
Removed hosts entry: 127.0.0.1 www.bnex.com
Removed hosts entry: 127.0.0.1 www.customer.bnex.com
Removed hosts entry: 127.0.0.1 www.db.bnex.com
Removed hosts entry: 127.0.0.1 www.dev.bnex.com
Removed hosts entry: 127.0.0.1 www.do.you.uh.yahoo.at.bnex.com
Removed hosts entry: 127.0.0.1 www.ghost.in.the.shell.at.bnex.com
Removed hosts entry: 127.0.0.1 www.granite.bnex.com
Removed hosts entry: 127.0.0.1 www.intarsia.bnex.com
Removed hosts entry: 127.0.0.1 www.intranet.bnex.com
Removed hosts entry: 127.0.0.1 www.jade.bnex.com
Removed hosts entry: 127.0.0.1 www.malachite.bnex.com
Removed hosts entry: 127.0.0.1 www.marble.bnex.com
Removed hosts entry: 127.0.0.1 www.megastore.bnex.com
Removed hosts entry: 127.0.0.1 www.mosaic.bnex.com
Removed hosts entry: 127.0.0.1 www.ns1.bnex.com
Removed hosts entry: 127.0.0.1 www.ns2.bnex.com
Removed hosts entry: 127.0.0.1 www.onyx.bnex.com
Removed hosts entry: 127.0.0.1 www.orion.bnex.com
Removed hosts entry: 127.0.0.1 www.pebble.bnex.com
Removed hosts entry: 127.0.0.1 www.preview.bnex.com
Removed hosts entry: 127.0.0.1 www.quartz.bnex.com
Removed hosts entry: 127.0.0.1 www.terrazzo.bnex.com
Removed hosts entry: 127.0.0.1 www.vpos.bnex.com
Removed hosts entry: 127.0.0.1 www.www.bnex.com
Removed hosts entry: 127.0.0.1 www.ads.bpath.com
Removed hosts entry: 127.0.0.1 www.ads01.bpath.com
Removed hosts entry: 127.0.0.1 www.ads03.bpath.com
Removed hosts entry: 127.0.0.1 www.ads04.bpath.com
Removed hosts entry: 127.0.0.1 www.ads05.bpath.com
Removed hosts entry: 127.0.0.1 www.ads06.bpath.com
Removed hosts entry: 127.0.0.1 www.ads07.bpath.com
Removed hosts entry: 127.0.0.1 www.ads08.bpath.com
Removed hosts entry: 127.0.0.1 www.ads09.bpath.com
Removed hosts entry: 127.0.0.1 www.ads1.bpath.com
Removed hosts entry: 127.0.0.1 www.ads10.bpath.com
Removed hosts entry: 127.0.0.1 www.ads11.bpath.com
Removed hosts entry: 127.0.0.1 www.ads12.bpath.com
Removed hosts entry: 127.0.0.1 www.ads13.bpath.com
Removed hosts entry: 127.0.0.1 www.ads14.bpath.com
Removed hosts entry: 127.0.0.1 www.ads15.bpath.com
Removed hosts entry: 127.0.0.1 www.ads16.bpath.com
Removed hosts entry: 127.0.0.1 www.ads17.bpath.com
Removed hosts entry: 127.0.0.1 www.ads18.bpath.com
Removed hosts entry: 127.0.0.1 www.ads19.bpath.com
Removed hosts entry: 127.0.0.1 www.ads2.bpath.com
Removed hosts entry: 127.0.0.1 www.ads20.bpath.com
Removed hosts entry: 127.0.0.1 www.ads21.bpath.com
Removed hosts entry: 127.0.0.1 www.ads22.bpath.com
Removed hosts entry: 127.0.0.1 www.ads23.bpath.com
Removed hosts entry: 127.0.0.1 www.ads24.bpath.com
Removed hosts entry: 127.0.0.1 www.ads25.bpath.com
Removed hosts entry: 127.0.0.1 www.ads26.bpath.com
Removed hosts entry: 127.0.0.1 www.ads27.bpath.com
Removed hosts entry: 127.0.0.1 www.ads28.bpath.com
Removed hosts entry: 127.0.0.1 www.ads29.bpath.com
Removed hosts entry: 127.0.0.1 www.ads3.bpath.com
Removed hosts entry: 127.0.0.1 www.ads32.bpath.com
Removed hosts entry: 127.0.0.1 www.ads33.bpath.com
Removed hosts entry: 127.0.0.1 www.ads34.bpath.com
Removed hosts entry: 127.0.0.1 www.ads35.bpath.com
Removed hosts entry: 127.0.0.1 www.ads36.bpath.com
Removed hosts entry: 127.0.0.1 www.ads37.bpath.com
Removed hosts entry: 127.0.0.1 www.ads38.bpath.com
Removed hosts entry: 127.0.0.1 www.ads39.bpath.com
Removed hosts entry: 127.0.0.1 www.ads40.bpath.com
Removed hosts entry: 127.0.0.1 www.ads41.bpath.com
Removed hosts entry: 127.0.0.1 www.ads42.bpath.com
Removed hosts entry: 127.0.0.1 www.ads43.bpath.com
Removed hosts entry: 127.0.0.1 www.ads44.bpath.com
Removed hosts entry: 127.0.0.1 www.ads45.bpath.com
Removed hosts entry: 127.0.0.1 www.ads46.bpath.com
Removed hosts entry: 127.0.0.1 www.ads47.bpath.com
Removed hosts entry: 127.0.0.1 www.ads48.bpath.com
Removed hosts entry: 127.0.0.1 www.ads49.bpath.com
Removed hosts entry: 127.0.0.1 www.ads50.bpath.com
Removed hosts entry: 127.0.0.1 www.ads51.bpath.com
Removed hosts entry: 127.0.0.1 www.ads52.bpath.com
Removed hosts entry: 127.0.0.1 www.bpath.com
Removed hosts entry: 127.0.0.1 www.www.bpath.com
Removed hosts entry: 127.0.0.1 www.acim.com
Removed hosts entry: 127.0.0.1 www.commission-junction.com
Removed hosts entry: 127.0.0.1 www.e250a.track4.com
Removed hosts entry: 127.0.0.1 www.fingerhut.track4.com
Removed hosts entry: 127.0.0.1 www.foxy.acim.com
Removed hosts entry: 127.0.0.1 www.foxy.track4.com
Removed hosts entry: 127.0.0.1 www.ftp.acim.com
Removed hosts entry: 127.0.0.1 www.ftp.track4.com
Removed hosts entry: 127.0.0.1 www.gate.acim.com
Removed hosts entry: 127.0.0.1 www.gifttree.track4.com
Removed hosts entry: 127.0.0.1 www.maximizer.acim.com
Removed hosts entry: 127.0.0.1 www.ns1.acim.com
Removed hosts entry: 127.0.0.1 www.ns2.acim.com
Removed hosts entry: 127.0.0.1 www.plum.acim.com
Removed hosts entry: 127.0.0.1 www.sz.track4.com
Removed hosts entry: 127.0.0.1 www.toten.acim.com
Removed hosts entry: 127.0.0.1 www.towerrecords.track4.com
Removed hosts entry: 127.0.0.1 www.track4.com
Removed hosts entry: 127.0.0.1 www.translucent.acim.com
Removed hosts entry: 127.0.0.1 www.www.acim.com
Removed hosts entry: 127.0.0.1 www1.track4.com
Removed hosts entry: 127.0.0.1 www2.track4.com
Removed hosts entry: 127.0.0.1 www3.track4.com
Removed hosts entry: 127.0.0.1 www.3aad.doubleclick.net
Removed hosts entry: 127.0.0.1 www.aa.doubleclick.net
Removed hosts entry: 127.0.0.1 www.accord.netgravity.com
Removed hosts entry: 127.0.0.1 www.ad.au.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.br.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.ca.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.contentzone.com
Removed hosts entry: 127.0.0.1 www.ad.de.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.doubleclick.com
Removed hosts entry: 127.0.0.1 www.ad.es.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.fi.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.fr.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.it.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.jp.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.my.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.nl.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.no.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.pt.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.se.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.sg.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.sq.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.uk.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad.us.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad2.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ad3.doubleclick.net
Removed hosts entry: 127.0.0.1 www.adcenter1.netgravity.com
Removed hosts entry: 127.0.0.1 www.ads-secondary.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ads.double-click.com
Removed hosts entry: 127.0.0.1 www.bay-sw-10.netgravity.com
Removed hosts entry: 127.0.0.1 www.bbn-gw.nyc1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.caelum.netgravity.com
Removed hosts entry: 127.0.0.1 www.de1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.demo.netgravity.com
Removed hosts entry: 127.0.0.1 www.double-click.com
Removed hosts entry: 127.0.0.1 www.doubleclick.com
Removed hosts entry: 127.0.0.1 www.doubleclick.net
Removed hosts entry: 127.0.0.1 www.draco.netgravity.com
Removed hosts entry: 127.0.0.1 www.dyson.netgravity.com
Removed hosts entry: 127.0.0.1 www.ecommerce.netgravity.com
Removed hosts entry: 127.0.0.1 www.engpptp.netgravity.com
Removed hosts entry: 127.0.0.1 www.enterprise.netgravity.com
Removed hosts entry: 127.0.0.1 www.exnjadgda1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.exnjadgda2.doubleclick.net
Removed hosts entry: 127.0.0.1 www.exnjadgds1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.exnjmdgda1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.exnjmdgds1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.exodus-gw.ewr1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.fr1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ftp.netgravity.com
Removed hosts entry: 127.0.0.1 www.gatekeeper.netgravity.com
Removed hosts entry: 127.0.0.1 www.gd20.doubleclick.net
Removed hosts entry: 127.0.0.1 www.gd25.doubleclick.net
Removed hosts entry: 127.0.0.1 www.gd28.doubleclick.net
Removed hosts entry: 127.0.0.1 www.gd4.doubleclick.net
Removed hosts entry: 127.0.0.1 www.gravitychannel.netgravity.com
Removed hosts entry: 127.0.0.1 www.gravityhome.netgravity.com
Removed hosts entry: 127.0.0.1 www.home.netgravity.com
Removed hosts entry: 127.0.0.1 www.in.doubleclick.net
Removed hosts entry: 127.0.0.1 www.joinchannel.netgravity.com
Removed hosts entry: 127.0.0.1 www.jp.doubleclick.net
Removed hosts entry: 127.0.0.1 www.listserver.netgravity.com
Removed hosts entry: 127.0.0.1 www.ln.doubleclick.net
Removed hosts entry: 127.0.0.1 www.lon-router.netgravity.com
Removed hosts entry: 127.0.0.1 www.london.netgravity.com
Removed hosts entry: 127.0.0.1 www.lucian.netgravity.com
Removed hosts entry: 127.0.0.1 www.m.doubleclick.com
Removed hosts entry: 127.0.0.1 www.m.doubleclick.net
Removed hosts entry: 127.0.0.1 www.m2.doubleclick.net
Removed hosts entry: 127.0.0.1 www.mailexodus.doubleclick.net
Removed hosts entry: 127.0.0.1 www.mdist.doubleclick.net
Removed hosts entry: 127.0.0.1 www.mplex-dfa.doubleclick.net
Removed hosts entry: 127.0.0.1 www.myhome.netgravity.com
Removed hosts entry: 127.0.0.1 www.nda.netgravity.com
Removed hosts entry: 127.0.0.1 www.netgravity.com
Removed hosts entry: 127.0.0.1 www.network-199-95-207-10.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-138.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-148.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-2.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-3.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-4.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-5.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-6.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-7.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-8.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-207-9.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-208-10.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-208-2.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-208-3.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-208-4.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-208-5.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-208-6.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-208-7.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-199-95-208-8.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-209-67-38-10.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-209-67-38-2.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-209-67-38-3.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-209-67-38-4.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-209-67-38-5.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-209-67-38-6.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-209-67-38-7.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-209-67-38-8.doubleclick.net
Removed hosts entry: 127.0.0.1 www.network-209-67-38-9.doubleclick.net
Removed hosts entry: 127.0.0.1 www.news.netgravity.com
Removed hosts entry: 127.0.0.1 www.ng-webserver.netgravity.com
Removed hosts entry: 127.0.0.1 www.nl.doubleclick.net
Removed hosts entry: 127.0.0.1 www.no.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ns.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ns1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ns2.doubleclick.net
Removed hosts entry: 127.0.0.1 www.ny-router.netgravity.com
Removed hosts entry: 127.0.0.1 www.ny.netgravity.com
Removed hosts entry: 127.0.0.1 www.phase2media.doubleclick.net
Removed hosts entry: 127.0.0.1 www.pptp-server.netgravity.com
Removed hosts entry: 127.0.0.1 www.pptp.netgravity.com
Removed hosts entry: 127.0.0.1 www.proxy.netgravity.com
Removed hosts entry: 127.0.0.1 www.rdbox.doubleclick.net
Removed hosts entry: 127.0.0.1 www.resolver.doubleclick.net
Removed hosts entry: 127.0.0.1 www.sanders.netgravity.com
Removed hosts entry: 127.0.0.1 www.se.doubleclick.net
Removed hosts entry: 127.0.0.1 www.se1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.sitepages.doubleclick.net
Removed hosts entry: 127.0.0.1 www.smhq-fe1-0.netgravity.com
Removed hosts entry: 127.0.0.1 www.sold.netgravity.com
Removed hosts entry: 127.0.0.1 www.suitespot.netgravity.com
Removed hosts entry: 127.0.0.1 www.support.netgravity.com
Removed hosts entry: 127.0.0.1 www.uk.doubleclick.net
Removed hosts entry: 127.0.0.1 www.uk1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.us.doubleclick.net
Removed hosts entry: 127.0.0.1 www.uunet-gw.nyc1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.uunyadgda1.doubleclick.net
Removed hosts entry: 127.0.0.1 www.uunyadgds1.doubleclick.net
Removed hosts entry: 127.0.0.1 www3.netgravity.com
Removed hosts entry: 127.0.0.1 www4.netgravity.com
Removed hosts entry: 127.0.0.1 www.zac.netgravity.com
Removed hosts entry: 127.0.0.1 www.ads1.speedbit.com
Removed hosts entry: 127.0.0.1 www.ads2.speedbit.com
Removed hosts entry: 127.0.0.1 www.ads3.speedbit.com
Removed hosts entry: 127.0.0.1 www3.speedbit.com
Removed hosts entry: 127.0.0.1 www.speedbit.com
Removed hosts entry: 127.0.0.1 www.54.conducent.com
Removed hosts entry: 127.0.0.1 www.addbtest.conducent.com
Removed hosts entry: 127.0.0.1 www.addbtest.timesink.com
Removed hosts entry: 127.0.0.1 www.addltest.conducent.com
Removed hosts entry: 127.0.0.1 www.addltest.timesink.com
Removed hosts entry: 127.0.0.1 www.addltestmaster.conducent.com
Removed hosts entry: 127.0.0.1 www.adqa.conducent.com
Removed hosts entry: 127.0.0.1 www.contentalpha.conducent.com
Removed hosts entry: 127.0.0.1 www.contentqa.conducent.com
Removed hosts entry: 127.0.0.1 www.contents.conducent.com
Removed hosts entry: 127.0.0.1 www.contents1.conducent.com
Removed hosts entry: 127.0.0.1 www.contenttest.conducent.com
Removed hosts entry: 127.0.0.1 www.digisle.conducent.com
Removed hosts entry: 127.0.0.1 www.dns1.conducent.com
Removed hosts entry: 127.0.0.1 www.download.timesink.com
Removed hosts entry: 127.0.0.1 www.eroom.conducent.com
Removed hosts entry: 127.0.0.1 www.firewall.conducent.com
Removed hosts entry: 127.0.0.1 www.firewall.timesink.com
Removed hosts entry: 127.0.0.1 www.ftp.conducent.com
Removed hosts entry: 127.0.0.1 www.hermes.conducent.com
Removed hosts entry: 127.0.0.1 www.ip134.conducent.com
Removed hosts entry: 127.0.0.1 www.ip134.timesink.com
Removed hosts entry: 127.0.0.1 www.jerry.conducent.com
Removed hosts entry: 127.0.0.1 www.mail.conducent.com
Removed hosts entry: 127.0.0.1 www.mail.timesink.com
Removed hosts entry: 127.0.0.1 www.nandbob.conducent.com
Removed hosts entry: 127.0.0.1 www.nid.conducent.com
Removed hosts entry: 127.0.0.1 www.nid.timesink.com
Removed hosts entry: 127.0.0.1 www.nidinternal.conducent.com
Removed hosts entry: 127.0.0.1 www.nidinternal.timesink.com
Removed hosts entry: 127.0.0.1 www.nidinternaltest.conducent.com
Removed hosts entry: 127.0.0.1 www.nidtest.conducent.com
Removed hosts entry: 127.0.0.1 www.nidtest.timesink.com
Removed hosts entry: 127.0.0.1 www.nt2.conducent.com
Removed hosts entry: 127.0.0.1 www.pop3.conducent.com
Removed hosts entry: 127.0.0.1 www.pop3.timesink.com
Removed hosts entry: 127.0.0.1 www.proxytest.conducent.com
Removed hosts entry: 127.0.0.1 www.pushv5.conducent.com
Removed hosts entry: 127.0.0.1 www.redirectqa.conducent.com
Removed hosts entry: 127.0.0.1 www.redirects.conducent.com
Removed hosts entry: 127.0.0.1 www.redirects.timesink.com
Removed hosts entry: 127.0.0.1 www.redirecttest.conducent.com
Removed hosts entry: 127.0.0.1 www.smtp.conducent.com
Removed hosts entry: 127.0.0.1 www.smtp.timesink.com
Removed hosts entry: 127.0.0.1 www.softwares.conducent.com
Removed hosts entry: 127.0.0.1 www.softwares.timesink.com
Removed hosts entry: 127.0.0.1 www.sterlinga.conducent.com
Removed hosts entry: 127.0.0.1 www.sterlingf.conducent.com
Removed hosts entry: 127.0.0.1 www.updates2.conducent.com
Removed hosts entry: 127.0.0.1 www.updatetest.conducent.com
Removed hosts entry: 127.0.0.1 www.warsport.timesink.com
Removed hosts entry: 127.0.0.1 www.conducent.com
Removed hosts entry: 127.0.0.1 www.test.conducent.com
Removed hosts entry: 127.0.0.1 www.test.timesink.com
Removed hosts entry: 127.0.0.1 www.zeus.conducent.com
Removed hosts entry: 127.0.0.1 www.zeus.timesink.com
Removed hosts entry: 127.0.0.1 www.bob.web3000.com
Removed hosts entry: 127.0.0.1 www.tasha.web3000.com
Removed hosts entry: 127.0.0.1 www1.web3000.com
Removed hosts entry: 127.0.0.1 www7.web3000.com
Removed hosts entry: 127.0.0.1 www.abbott.radiate.com
Removed hosts entry: 127.0.0.1 www.ad2-1.aureate.com
Removed hosts entry: 127.0.0.1 www.ad2-2.aureate.com
Removed hosts entry: 127.0.0.1 www.ad2-3.aureate.com
Removed hosts entry: 127.0.0.1 www.ad2-4.aureate.com
Removed hosts entry: 127.0.0.1 www.adam.radiate.com
Removed hosts entry: 127.0.0.1 www.adserv2-301-sjc2.radiate.com
Removed hosts entry: 127.0.0.1 www.adserv3-408-sjc2.radiate.com
Removed hosts entry: 127.0.0.1 www.adsoftware.com
Removed hosts entry: 127.0.0.1 www.aim.adsoftware.com
Removed hosts entry: 127.0.0.1 www.aim.aureate.com
Removed hosts entry: 127.0.0.1 www.aim1.adsoftware.com
Removed hosts entry: 127.0.0.1 www.aim1.aureate.com
Removed hosts entry: 127.0.0.1 www.aim2.adsoftware.com
Removed hosts entry: 127.0.0.1 www.aim2.aureate.com
Removed hosts entry: 127.0.0.1 www.aim3.adsoftware.com
Removed hosts entry: 127.0.0.1 www.aim3.aureate.com
Removed hosts entry: 127.0.0.1 www.aim4.adsoftware.com
Removed hosts entry: 127.0.0.1 www.aim4.aureate.com
Removed hosts entry: 127.0.0.1 www.aim5.adsoftware.com
Removed hosts entry: 127.0.0.1 www.aim5.aureate.com
Removed hosts entry: 127.0.0.1 www.aim6.adsoftware.com
Removed hosts entry: 127.0.0.1 www.alexander.aureate.com
Removed hosts entry: 127.0.0.1 www.ans-test.adsoftware.com
Removed hosts entry: 127.0.0.1 www.ans1.adsoftware.com
Removed hosts entry: 127.0.0.1 www.ans10.adsoftware.com
Removed hosts entry: 127.0.0.1 www.ans2.adsoftware.com
Removed hosts entry: 127.0.0.1 www.ans3.adsoftware.com
Removed hosts entry: 127.0.0.1 www.apc-pdu-1.aureate.com
Removed hosts entry: 127.0.0.1 www.apc-pdu-2.aureate.com
Removed hosts entry: 127.0.0.1 www.aristotle.aureate.com
Removed hosts entry: 127.0.0.1 www.ask-a-chick.com
Removed hosts entry: 127.0.0.1 www.aureate-colo-hp2424m.aureate.com
Removed hosts entry: 127.0.0.1 www.aureate-main-2611.aureate.com
Removed hosts entry: 127.0.0.1 www.aureate.com
Removed hosts entry: 127.0.0.1 www.aureatemedia.com
Removed hosts entry: 127.0.0.1 www.bach.aureate.com
Removed hosts entry: 127.0.0.1 www.bc-208-184-172-192.radiate.com
Removed hosts entry: 127.0.0.1 www.bigmama.radiate.com
Removed hosts entry: 127.0.0.1 www.binarybliss.com
Removed hosts entry: 127.0.0.1 www.bonnie2.radiate.com
Removed hosts entry: 127.0.0.1 www.brinks.radiate.com
Removed hosts entry: 127.0.0.1 www.brutus.radiate.com
Removed hosts entry: 127.0.0.1 www.caesar.aureate.com
Removed hosts entry: 127.0.0.1 www.confucius.aureate.com
Removed hosts entry: 127.0.0.1 www.constantine.aureate.com
Removed hosts entry: 127.0.0.1 www.cook.aureate.com
Removed hosts entry: 127.0.0.1 www.copernicus.aureate.com
Removed hosts entry: 127.0.0.1 www.corona.radiate.com
Removed hosts entry: 127.0.0.1 www.costello.radiate.com
Removed hosts entry: 127.0.0.1 www.curly.aureate.com
Removed hosts entry: 127.0.0.1 www.cyrus.aureate.com
Removed hosts entry: 127.0.0.1 www.deadmanwalking.radiate.com
Removed hosts entry: 127.0.0.1 www.dell.radiate.com
Removed hosts entry: 127.0.0.1 www.dillinger.aureate.com
Removed hosts entry: 127.0.0.1 www.dolphinsfootball.com
Removed hosts entry: 127.0.0.1 www.dosequis.radiate.com
Removed hosts entry: 127.0.0.1 www.download.binarybliss.com
Removed hosts entry: 127.0.0.1 www.foreigner.radiate.com
Removed hosts entry: 127.0.0.1 www.freud.aureate.com
Removed hosts entry: 127.0.0.1 www.ftp.gozilla.com
Removed hosts entry: 127.0.0.1 www.gameboy.aureate.com
Removed hosts entry: 127.0.0.1 www.gd1.radiate.com
Removed hosts entry: 127.0.0.1 www.gizmo.net
Removed hosts entry: 127.0.0.1 www.godzilla.radiate.com
Removed hosts entry: 127.0.0.1 www.gozilla.com
Removed hosts entry: 127.0.0.1 www.group-mail.com
Removed hosts entry: 127.0.0.1 www.gzs-6509.radiate.com
Removed hosts entry: 127.0.0.1 www.gzs-7206.radiate.com
Removed hosts entry: 127.0.0.1 www.gzs-ld.radiate.com
Removed hosts entry: 127.0.0.1 www.h-208-184-172-10.radiate.com
Removed hosts entry: 127.0.0.1 www.h-208-184-172-100.radiate.com
Removed hosts entry: 127.0.0.1 www.a-d-w-a-r-e.com
Removed hosts entry: 127.0.0.1 ad-w-a-r-e.com
Removed hosts entry: 127.0.0.1 ads.x10.com
Removed hosts entry: 127.0.0.1 600pics.com
Removed hosts entry: 127.0.0.1 doberman.befree.com
Removed hosts entry: 127.0.0.1 enews.bfast.com
Removed hosts entry: 127.0.0.1 etoys.bfast.com
Removed hosts entry: 127.0.0.1 falcon.bfast.com
Removed hosts entry: 127.0.0.1 ftp.befree.com
Removed hosts entry: 127.0.0.1 ftp.bfast.com
Removed hosts entry: 127.0.0.1 geocities.bfast.com
Removed hosts entry: 127.0.0.1 goshoppingonline.bfast.com
Removed hosts entry: 127.0.0.1 great-dane.befree.com
Removed hosts entry: 127.0.0.1 great-dane.bfast.com
Removed hosts entry: 127.0.0.1 greyhound.bfast.com
Removed hosts entry: 127.0.0.1 help.bfast.com
Removed hosts entry: 127.0.0.1 husky.bfast.com
Removed hosts entry: 127.0.0.1 images.bfast.com
Removed hosts entry: 127.0.0.1 imp.bfast.com
Removed hosts entry: 127.0.0.1 njmgt1.bfast.com
Removed hosts entry: 127.0.0.1 njmgt2.bfast.com
Removed hosts entry: 127.0.0.1 njrep0.bfast.com
Removed hosts entry: 127.0.0.1 njrep2.bfast.com
Removed hosts entry: 127.0.0.1 njrep1.bfast.com
Removed hosts entry: 127.0.0.1 njtxn1.bfast.com
Removed hosts entry: 127.0.0.1 otterhound.bfast.com
Removed hosts entry: 127.0.0.1 preprod-geocities.bfast.com
Removed hosts entry: 127.0.0.1 preprod.bfast.com
Removed hosts entry: 127.0.0.1 qwest.bfast.com
Removed hosts entry: 127.0.0.1 reporting.net
Removed hosts entry: 127.0.0.1 ridgeback.befree.com
Removed hosts entry: 127.0.0.1 ridgeback.bfast.com
Removed hosts entry: 127.0.0.1 samoyed.bfast.com
Removed hosts entry: 127.0.0.1 scrappy.befree.com
Removed hosts entry: 127.0.0.1 service.bfast.com
Removed hosts entry: 127.0.0.1 travelocity.bfast.com
Removed hosts entry: 127.0.0.1 travsoft.bfast.com
Removed hosts entry: 127.0.0.1 verisign.bfast.com
Removed hosts entry: 127.0.0.1 vulture.bfast.com
Removed hosts entry: 127.0.0.1 whippet.bfast.com
Removed hosts entry: 127.0.0.1 wolfhound.bfast.com
Removed hosts entry: 127.0.0.1 befree.com
Removed hosts entry: 127.0.0.1 s0.bluestreak.com
Removed hosts entry: 127.0.0.1 s1.bluestreak.com
Removed hosts entry: 127.0.0.1 s2.bluestreak.com
Removed hosts entry: 127.0.0.1 s3.bluestreak.com
Removed hosts entry: 127.0.0.1 s4.bluestreak.com
Removed hosts entry: 127.0.0.1 s5.bluestreak.com
Removed hosts entry: 127.0.0.1 s6.bluestreak.com
Removed hosts entry: 127.0.0.1 s7.bluestreak.com
Removed hosts entry: 127.0.0.1 s8.bluestreak.com
Removed hosts entry: 127.0.0.1 abc.bnex.com
Removed hosts entry: 127.0.0.1 alpha.bnex.com
Removed hosts entry: 127.0.0.1 bnex.com
Removed hosts entry: 127.0.0.1 customer.bnex.com
Removed hosts entry: 127.0.0.1 db.bnex.com
Removed hosts entry: 127.0.0.1 dev.bnex.com
Removed hosts entry: 127.0.0.1 do.you.uh.yahoo.at.bnex.com
Removed hosts entry: 127.0.0.1 ghost.in.the.shell.at.bnex.com
Removed hosts entry: 127.0.0.1 granite.bnex.com
Removed hosts entry: 127.0.0.1 intarsia.bnex.com
Removed hosts entry: 127.0.0.1 intranet.bnex.com
Removed hosts entry: 127.0.0.1 jade.bnex.com
Removed hosts entry: 127.0.0.1 malachite.bnex.com
Removed hosts entry: 127.0.0.1 marble.bnex.com
Removed hosts entry: 127.0.0.1 megastore.bnex.com
Removed hosts entry: 127.0.0.1 mosaic.bnex.com
Removed hosts entry: 127.0.0.1 ns1.bnex.com
Removed hosts entry: 127.0.0.1 ns2.bnex.com
Removed hosts entry: 127.0.0.1 onyx.bnex.com
Removed hosts entry: 127.0.0.1 orion.bnex.com
Removed hosts entry: 127.0.0.1 pebble.bnex.com
Removed hosts entry: 127.0.0.1 preview.bnex.com
Removed hosts entry: 127.0.0.1 quartz.bnex.com
Removed hosts entry: 127.0.0.1 terrazzo.bnex.com
Removed hosts entry: 127.0.0.1 vpos.bnex.com
Removed hosts entry: 127.0.0.1 ads.bpath.com
Removed hosts entry: 127.0.0.1 ads01.bpath.com
Removed hosts entry: 127.0.0.1 ads03.bpath.com
Removed hosts entry: 127.0.0.1 ads04.bpath.com
Removed hosts entry: 127.0.0.1 ads05.bpath.com
Removed hosts entry: 127.0.0.1 ads06.bpath.com
Removed hosts entry: 127.0.0.1 ads07.bpath.com
Removed hosts entry: 127.0.0.1 ads08.bpath.com
Removed hosts entry: 127.0.0.1 ads09.bpath.com
Removed hosts entry: 127.0.0.1 ads1.bpath.com
Removed hosts entry: 127.0.0.1 ads10.bpath.com
Removed hosts entry: 127.0.0.1 ads11.bpath.com
Removed hosts entry: 127.0.0.1 ads12.bpath.com
Removed hosts entry: 127.0.0.1 ads13.bpath.com
Removed hosts entry: 127.0.0.1 ads14.bpath.com
Removed hosts entry: 127.0.0.1 ads15.bpath.com
Removed hosts entry: 127.0.0.1 ads16.bpath.com
Removed hosts entry: 127.0.0.1 ads17.bpath.com
Removed hosts entry: 127.0.0.1 ads18.bpath.com
Removed hosts entry: 127.0.0.1 ads19.bpath.com
Removed hosts entry: 127.0.0.1 ads2.bpath.com
Removed hosts entry: 127.0.0.1 ads20.bpath.com
Removed hosts entry: 127.0.0.1 ads21.bpath.com
Removed hosts entry: 127.0.0.1 ads22.bpath.com
Removed hosts entry: 127.0.0.1 ads23.bpath.com
Removed hosts entry: 127.0.0.1 ads24.bpath.com
Removed hosts entry: 127.0.0.1 ads25.bpath.com
Removed hosts entry: 127.0.0.1 ads26.bpath.com
Removed hosts entry: 127.0.0.1 ads27.bpath.com
Removed hosts entry: 127.0.0.1 ads28.bpath.com
Removed hosts entry: 127.0.0.1 ads29.bpath.com
Removed hosts entry: 127.0.0.1 ads3.bpath.com
Removed hosts entry: 127.0.0.1 ads32.bpath.com
Removed hosts entry: 127.0.0.1 ads33.bpath.com
Removed hosts entry: 127.0.0.1 ads34.bpath.com
Removed hosts entry: 127.0.0.1 ads35.bpath.com
Removed hosts entry: 127.0.0.1 ads36.bpath.com
Removed hosts entry: 127.0.0.1 ads37.bpath.com
Removed hosts entry: 127.0.0.1 ads38.bpath.com
Removed hosts entry: 127.0.0.1 ads39.bpath.com
Removed hosts entry: 127.0.0.1 ads40.bpath.com
Removed hosts entry: 127.0.0.1 ads41.bpath.com
Removed hosts entry: 127.0.0.1 ads42.bpath.com
Removed hosts entry: 127.0.0.1 ads43.bpath.com
Removed hosts entry: 127.0.0.1 ads44.bpath.com
Removed hosts entry: 127.0.0.1 ads45.bpath.com
Removed hosts entry: 127.0.0.1 ads46.bpath.com
Removed hosts entry: 127.0.0.1 ads47.bpath.com
Removed hosts entry: 127.0.0.1 ads48.bpath.com
Removed hosts entry: 127.0.0.1 ads49.bpath.com
Removed hosts entry: 127.0.0.1 ads50.bpath.com
Removed hosts entry: 127.0.0.1 ads51.bpath.com
Removed hosts entry: 127.0.0.1 ads52.bpath.com
Removed hosts entry: 127.0.0.1 bpath.com
Removed hosts entry: 127.0.0.1 acim.com
Removed hosts entry: 127.0.0.1 commission-junction.com
Removed hosts entry: 127.0.0.1 e250a.track4.com
Removed hosts entry: 127.0.0.1 fingerhut.track4.com
Removed hosts entry: 127.0.0.1 foxy.acim.com
Removed hosts entry: 127.0.0.1 foxy.track4.com
Removed hosts entry: 127.0.0.1 ftp.acim.com
Removed hosts entry: 127.0.0.1 ftp.track4.com
Removed hosts entry: 127.0.0.1 gate.acim.com
Removed hosts entry: 127.0.0.1 gifttree.track4.com
Removed hosts entry: 127.0.0.1 maximizer.acim.com
Removed hosts entry: 127.0.0.1 ns1.acim.com
Removed hosts entry: 127.0.0.1 ns2.acim.com
Removed hosts entry: 127.0.0.1 plum.acim.com
Removed hosts entry: 127.0.0.1 sz.track4.com
Removed hosts entry: 127.0.0.1 toten.acim.com
Removed hosts entry: 127.0.0.1 towerrecords.track4.com
Removed hosts entry: 127.0.0.1 track4.com
Removed hosts entry: 127.0.0.1 translucent.acim.com
Removed hosts entry: 127.0.0.1 1.track4.com
Removed hosts entry: 127.0.0.1 2.track4.com
Removed hosts entry: 127.0.0.1 3.track4.com
Removed hosts entry: 127.0.0.1 3aad.doubleclick.net
Removed hosts entry: 127.0.0.1 aa.doubleclick.net
Removed hosts entry: 127.0.0.1 accord.netgravity.com
Removed hosts entry: 127.0.0.1 ad.au.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.br.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.ca.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.contentzone.com
Removed hosts entry: 127.0.0.1 ad.de.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.doubleclick.com
Removed hosts entry: 127.0.0.1 ad.es.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.fi.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.fr.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.it.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.jp.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.my.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.nl.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.no.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.pt.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.se.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.sg.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.sq.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.uk.doubleclick.net
Removed hosts entry: 127.0.0.1 ad.us.doubleclick.net
Removed hosts entry: 127.0.0.1 ad1.doubleclick.net
Removed hosts entry: 127.0.0.1 ad2.doubleclick.net
Removed hosts entry: 127.0.0.1 ad3.doubleclick.net
Removed hosts entry: 127.0.0.1 adcenter1.netgravity.com
Removed hosts entry: 127.0.0.1 ads-secondary.doubleclick.net
Removed hosts entry: 127.0.0.1 ads.double-click.com
Removed hosts entry: 127.0.0.1 bay-sw-10.netgravity.com
Removed hosts entry: 127.0.0.1 bbn-gw.nyc1.doubleclick.net
Removed hosts entry: 127.0.0.1 caelum.netgravity.com
Removed hosts entry: 127.0.0.1 de1.doubleclick.net
Removed hosts entry: 127.0.0.1 demo.netgravity.com
Removed hosts entry: 127.0.0.1 double-click.com
Removed hosts entry: 127.0.0.1 doubleclick.com
Removed hosts entry: 127.0.0.1 doubleclick.net
Removed hosts entry: 127.0.0.1 draco.netgravity.com
Removed hosts entry: 127.0.0.1 dyson.netgravity.com
Removed hosts entry: 127.0.0.1 ecommerce.netgravity.com
Removed hosts entry: 127.0.0.1 engpptp.netgravity.com
Removed hosts entry: 127.0.0.1 enterprise.netgravity.com
Removed hosts entry: 127.0.0.1 exnjadgda1.doubleclick.net
Removed hosts entry: 127.0.0.1 exnjadgda2.doubleclick.net
Removed hosts entry: 127.0.0.1 exnjadgds1.doubleclick.net
Removed hosts entry: 127.0.0.1 exnjmdgda1.doubleclick.net
Removed hosts entry: 127.0.0.1 exnjmdgds1.doubleclick.net
Removed hosts entry: 127.0.0.1 exodus-gw.ewr1.doubleclick.net
Removed hosts entry: 127.0.0.1 fr1.doubleclick.net
Removed hosts entry: 127.0.0.1 ftp.netgravity.com
Removed hosts entry: 127.0.0.1 gatekeeper.netgravity.com
Removed hosts entry: 127.0.0.1 gd20.doubleclick.net
Removed hosts entry: 127.0.0.1 gd25.doubleclick.net
Removed hosts entry: 127.0.0.1 gd28.doubleclick.net
Removed hosts entry: 127.0.0.1 gd4.doubleclick.net
Removed hosts entry: 127.0.0.1 gravitychannel.netgravity.com
Removed hosts entry: 127.0.0.1 gravityhome.netgravity.com
Removed hosts entry: 127.0.0.1 home.netgravity.com
Removed hosts entry: 127.0.0.1 in.doubleclick.net
Removed hosts entry: 127.0.0.1 joinchannel.netgravity.com
Removed hosts entry: 127.0.0.1 jp.doubleclick.net
Removed hosts entry: 127.0.0.1 listserver.netgravity.com
Removed hosts entry: 127.0.0.1 ln.doubleclick.net
Removed hosts entry: 127.0.0.1 lon-router.netgravity.com
Removed hosts entry: 127.0.0.1 london.netgravity.com
Removed hosts entry: 127.0.0.1 lucian.netgravity.com
Removed hosts entry: 127.0.0.1 m.doubleclick.com
Removed hosts entry: 127.0.0.1 m.doubleclick.net
Removed hosts entry: 127.0.0.1 m2.doubleclick.net
Removed hosts entry: 127.0.0.1 mailexodus.doubleclick.net
Removed hosts entry: 127.0.0.1 mdist.doubleclick.net
Removed hosts entry: 127.0.0.1 mplex-dfa.doubleclick.net
Removed hosts entry: 127.0.0.1 myhome.netgravity.com
Removed hosts entry: 127.0.0.1 nda.netgravity.com
Removed hosts entry: 127.0.0.1 netgravity.com
Removed hosts entry: 127.0.0.1 network-199-95-207-10.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-138.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-148.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-2.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-3.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-4.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-5.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-6.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-7.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-8.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-207-9.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-208-10.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-208-2.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-208-3.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-208-4.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-208-5.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-208-6.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-208-7.doubleclick.net
Removed hosts entry: 127.0.0.1 network-199-95-208-8.doubleclick.net
Removed hosts entry: 127.0.0.1 network-209-67-38-10.doubleclick.net
Removed hosts entry: 127.0.0.1 network-209-67-38-2.doubleclick.net
Removed hosts entry: 127.0.0.1 network-209-67-38-3.doubleclick.net
Removed hosts entry: 127.0.0.1 network-209-67-38-4.doubleclick.net
Removed hosts entry: 127.0.0.1 network-209-67-38-5.doubleclick.net
Removed hosts entry: 127.0.0.1 network-209-67-38-6.doubleclick.net
Removed hosts entry: 127.0.0.1 network-209-67-38-7.doubleclick.net
Removed hosts entry: 127.0.0.1 network-209-67-38-8.doubleclick.net
Removed hosts entry: 127.0.0.1 network-209-67-38-9.doubleclick.net
Removed hosts entry: 127.0.0.1 news.netgravity.com
Removed hosts entry: 127.0.0.1 ng-webserver.netgravity.com
Removed hosts entry: 127.0.0.1 nl.doubleclick.net
Removed hosts entry: 127.0.0.1 no.doubleclick.net
Removed hosts entry: 127.0.0.1 ns.doubleclick.net
Removed hosts entry: 127.0.0.1 ns1.doubleclick.net
Removed hosts entry: 127.0.0.1 ns2.doubleclick.net
Removed hosts entry: 127.0.0.1 ny-router.netgravity.com
Removed hosts entry: 127.0.0.1 ny.netgravity.com
Removed hosts entry: 127.0.0.1 phase2media.doubleclick.net
Removed hosts entry: 127.0.0.1 pptp-server.netgravity.com
Removed hosts entry: 127.0.0.1 pptp.netgravity.com
Removed hosts entry: 127.0.0.1 proxy.netgravity.com
Removed hosts entry: 127.0.0.1 rdbox.doubleclick.net
Removed hosts entry: 127.0.0.1 resolver.doubleclick.net
Removed hosts entry: 127.0.0.1 sanders.netgravity.com
Removed hosts entry: 127.0.0.1 se.doubleclick.net
Removed hosts entry: 127.0.0.1 se1.doubleclick.net
Removed hosts entry: 127.0.0.1 sitepages.doubleclick.net
Removed hosts entry: 127.0.0.1 smhq-fe1-0.netgravity.com
Removed hosts entry: 127.0.0.1 sold.netgravity.com
Removed hosts entry: 127.0.0.1 suitespot.netgravity.com
Removed hosts entry: 127.0.0.1 support.netgravity.com
Removed hosts entry: 127.0.0.1 uk.doubleclick.net
Removed hosts entry: 127.0.0.1 uk1.doubleclick.net
Removed hosts entry: 127.0.0.1 us.doubleclick.net
Removed hosts entry: 127.0.0.1 uunet-gw.nyc1.doubleclick.net
Removed hosts entry: 127.0.0.1 uunyadgda1.doubleclick.net
Removed hosts entry: 127.0.0.1 uunyadgds1.doubleclick.net
Removed hosts entry: 127.0.0.1 3.netgravity.com
Removed hosts entry: 127.0.0.1 4.netgravity.com
Removed hosts entry: 127.0.0.1 zac.netgravity.com
Removed hosts entry: 127.0.0.1 ads1.speedbit.com
Removed hosts entry: 127.0.0.1 ads2.speedbit.com
Removed hosts entry: 127.0.0.1 ads3.speedbit.com
Removed hosts entry: 127.0.0.1 speedbit.com
Removed hosts entry: 127.0.0.1 54.conducent.com
Removed hosts entry: 127.0.0.1 addbtest.conducent.com
Removed hosts entry: 127.0.0.1 addbtest.timesink.com
Removed hosts entry: 127.0.0.1 addltest.conducent.com
Removed hosts entry: 127.0.0.1 addltest.timesink.com
Removed hosts entry: 127.0.0.1 adqa.conducent.com
Removed hosts entry: 127.0.0.1 contentalpha.conducent.com
Removed hosts entry: 127.0.0.1 contentqa.conducent.com
Removed hosts entry: 127.0.0.1 contents.conducent.com
Removed hosts entry: 127.0.0.1 contents1.conducent.com
Removed hosts entry: 127.0.0.1 contenttest.conducent.com
Removed hosts entry: 127.0.0.1 digisle.conducent.com
Removed hosts entry: 127.0.0.1 dns1.conducent.com
Removed hosts entry: 127.0.0.1 download.timesink.com
Removed hosts entry: 127.0.0.1 eroom.conducent.com
Removed hosts entry: 127.0.0.1 firewall.conducent.com
Removed hosts entry: 127.0.0.1 firewall.timesink.com
Removed hosts entry: 127.0.0.1 ftp.conducent.com
Removed hosts entry: 127.0.0.1 hermes.conducent.com
Removed hosts entry: 127.0.0.1 ip134.conducent.com
Removed hosts entry: 127.0.0.1 ip134.timesink.com
Removed hosts entry: 127.0.0.1 jerry.conducent.com
Removed hosts entry: 127.0.0.1 mail.conducent.com
Removed hosts entry: 127.0.0.1 mail.timesink.com
Removed hosts entry: 127.0.0.1 nandbob.conducent.com
Removed hosts entry: 127.0.0.1 nid.conducent.com
Removed hosts entry: 127.0.0.1 nid.timesink.com
Removed hosts entry: 127.0.0.1 nidinternal.conducent.com
Removed hosts entry: 127.0.0.1 nidinternal.timesink.com
Removed hosts entry: 127.0.0.1 nidinternaltest.conducent.com
Removed hosts entry: 127.0.0.1 nidtest.conducent.com
Removed hosts entry: 127.0.0.1 nidtest.timesink.com
Removed hosts entry: 127.0.0.1 nt2.conducent.com
Removed hosts entry: 127.0.0.1 pop3.conducent.com
Removed hosts entry: 127.0.0.1 pop3.timesink.com
Removed hosts entry: 127.0.0.1 proxytest.conducent.com
Removed hosts entry: 127.0.0.1 pushv5.conducent.com
Removed hosts entry: 127.0.0.1 redirectqa.conducent.com
Removed hosts entry: 127.0.0.1 redirects.conducent.com
Removed hosts entry: 127.0.0.1 redirects.timesink.com
Removed hosts entry: 127.0.0.1 redirecttest.conducent.com
Removed hosts entry: 127.0.0.1 smtp.conducent.com
Removed hosts entry: 127.0.0.1 smtp.timesink.com
Removed hosts entry: 127.0.0.1 softwares.conducent.com
Removed hosts entry: 127.0.0.1 softwares.timesink.com
Removed hosts entry: 127.0.0.1 sterlinga.conducent.com
Removed hosts entry: 127.0.0.1 sterlingf.conducent.com
Removed hosts entry: 127.0.0.1 updates2.conducent.com
Removed hosts entry: 127.0.0.1 updatetest.conducent.com
Removed hosts entry: 127.0.0.1 warsport.timesink.com
Removed hosts entry: 127.0.0.1 conducent.com
Removed hosts entry: 127.0.0.1 test.conducent.com
Removed hosts entry: 127.0.0.1 test.timesink.com
Removed hosts entry: 127.0.0.1 zeus.conducent.com
Removed hosts entry: 127.0.0.1 zeus.timesink.com
Removed hosts entry: 127.0.0.1 bob.web3000.com
Removed hosts entry: 127.0.0.1 tasha.web3000.com
Removed hosts entry: 127.0.0.1 web3000.com
Removed hosts entry: 127.0.0.1 7.web3000.com
Removed hosts entry: 127.0.0.1 abbott.radiate.com
Removed hosts entry: 127.0.0.1 ad2-1.aureate.com
Removed hosts entry: 127.0.0.1 ad2-2.aureate.com
Removed hosts entry: 127.0.0.1 ad2-3.aureate.com
Removed hosts entry: 127.0.0.1 ad2-4.aureate.com
Removed hosts entry: 127.0.0.1 adam.radiate.com
Removed hosts entry: 127.0.0.1 adserv2-301-sjc2.radiate.com
Removed hosts entry: 127.0.0.1 adserv3-408-sjc2.radiate.com
Removed hosts entry: 127.0.0.1 adsoftware.com
Removed hosts entry: 127.0.0.1 aim.adsoftware.com
Removed hosts entry: 127.0.0.1 aim.aureate.com
Removed hosts entry: 127.0.0.1 aim1.adsoftware.com
Removed hosts entry: 127.0.0.1 aim1.aureate.com
Removed hosts entry: 127.0.0.1 aim2.adsoftware.com
Removed hosts entry: 127.0.0.1 aim2.aureate.com
Removed hosts entry: 127.0.0.1 aim3.adsoftware.com
Removed hosts entry: 127.0.0.1 aim3.aureate.com
Removed hosts entry: 127.0.0.1 aim4.adsoftware.com
Removed hosts entry: 127.0.0.1 aim4.aureate.com
Removed hosts entry: 127.0.0.1 aim5.adsoftware.com
Removed hosts entry: 127.0.0.1 aim5.aureate.com
Removed hosts entry: 127.0.0.1 aim6.adsoftware.com
Removed hosts entry: 127.0.0.1 alexander.aureate.com
Removed hosts entry: 127.0.0.1 ans-test.adsoftware.com
Removed hosts entry: 127.0.0.1 ans1.adsoftware.com
Removed hosts entry: 127.0.0.1 ans10.adsoftware.com
Removed hosts entry: 127.0.0.1 ans2.adsoftware.com
Removed hosts entry: 127.0.0.1 ans3.adsoftware.com
Removed hosts entry: 127.0.0.1 apc-pdu-1.aureate.com
Removed hosts entry: 127.0.0.1 apc-pdu-2.aureate.com
Removed hosts entry: 127.0.0.1 aristotle.aureate.com
Removed hosts entry: 127.0.0.1 ask-a-chick.com
Removed hosts entry: 127.0.0.1 aureate-colo-hp2424m.aureate.com
Removed hosts entry: 127.0.0.1 aureate-main-2611.aureate.com
Removed hosts entry: 127.0.0.1 aureate.com
Removed hosts entry: 127.0.0.1 aureatemedia.com
Removed hosts entry: 127.0.0.1 bach.aureate.com
Removed hosts entry: 127.0.0.1 bc-208-184-172-192.radiate.com
Removed hosts entry: 127.0.0.1 bigmama.radiate.com
Removed hosts entry: 127.0.0.1 binarybliss.com
Removed hosts entry: 127.0.0.1 bonnie2.radiate.com
Removed hosts entry: 127.0.0.1 brinks.radiate.com
Removed hosts entry: 127.0.0.1 brutus.radiate.com
Removed hosts entry: 127.0.0.1 caesar.aureate.com
Removed hosts entry: 127.0.0.1 confucius.aureate.com
Removed hosts entry: 127.0.0.1 constantine.aureate.com
Removed hosts entry: 127.0.0.1 cook.aureate.com
Removed hosts entry: 127.0.0.1 copernicus.aureate.com
Removed hosts entry: 127.0.0.1 corona.radiate.com
Removed hosts entry: 127.0.0.1 costello.radiate.com
Removed hosts entry: 127.0.0.1 curly.aureate.com
Removed hosts entry: 127.0.0.1 cyrus.aureate.com
Removed hosts entry: 127.0.0.1 deadmanwalking.radiate.com
Removed hosts entry: 127.0.0.1 dell.radiate.com
Removed hosts entry: 127.0.0.1 dillinger.aureate.com
Removed hosts entry: 127.0.0.1 dolphinsfootball.com
Removed hosts entry: 127.0.0.1 dosequis.radiate.com
Removed hosts entry: 127.0.0.1 download.binarybliss.com
Removed hosts entry: 127.0.0.1 foreigner.radiate.com
Removed hosts entry: 127.0.0.1 freud.aureate.com
Removed hosts entry: 127.0.0.1 ftp.gozilla.com
Removed hosts entry: 127.0.0.1 gameboy.aureate.com
Removed hosts entry: 127.0.0.1 gd1.radiate.com
Removed hosts entry: 127.0.0.1 gizmo.net
Removed hosts entry: 127.0.0.1 godzilla.radiate.com
Removed hosts entry: 127.0.0.1 gozilla.com
Removed hosts entry: 127.0.0.1 group-mail.com
Removed hosts entry: 127.0.0.1 gzs-6509.radiate.com
Removed hosts entry: 127.0.0.1 gzs-7206.radiate.com
Removed hosts entry: 127.0.0.1 gzs-ld.radiate.com
Removed hosts entry: 127.0.0.1 h-208-184-172-10.radiate.com
Removed hosts entry: 127.0.0.1 h-208-184-172-100.radiate.com
Removed hosts entry: 127.0.0.1 mm.delfinproject.com
Removed hosts entry: 127.0.0.1 www.mm.delfinproject.com
Removed hosts entry: 127.0.0.1 http://www.perfectedsecurity.com/
Removed hosts entry: 127.0.0.1 www.ad.yieldmanager.com
Removed hosts entry: 127.0.0.1 www.ads.vitalix.net
Removed hosts entry: 127.0.0.1 www.zedo.net

Scan started: 25/05/2008 13:26:55


Scanning running processes and process memory...

Number of processes/threads found: 206
Number of processes/threads scanned: 206
Number of processes/threads not scanned: 0
Number of infected processes/threads terminated: 0
Total scanning time: 25s


Scanning file system...

Scanning: C:\*.*

C:\System Volume Information\_RESTO~1\RP299\A0129249.dll (Infected with W32/Agent.BEPW)
Deleted file

Scanning: c:\System Volume Information\*.*


Running post-scan cleanup routine:

Number of files found: 115408
Number of archives unpacked: 5825
Number of files scanned: 115380
Number of files not scanned: 28
Number of files skipped due to exclude list: 0
Number of infected files found: 1
Number of infected files repaired/deleted: 1
Number of infections removed: 1
Total scanning time: 1h 31m 14s

[SaraNana]

link di freefilehosting


NFix_2008-05-25_13-26-55.log
e adesso che devo fare? con combofix non ho avuto problemi...

[SaraNana]

alluuuura

[bdoriano]

E il resto? (combofix, per la precisione)

[SaraNana]

ComboFix 08-05-24.1 - Casa 2008-05-30 12.39.34.2 - NTFSx86
Eseguito da: C:\Documents and Settings\Casa\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Creati Da 2008-04-28 al 2008-05-30 )))))))))))))))))))))))))))))))))))
.

2008-05-25 13:42 . 2008-05-25 13:42 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-05-24 20:04 . 2008-05-24 20:04 <DIR> d-------- C:\Programmi\Lavasoft
2008-05-24 20:00 . 2008-05-24 20:01 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2008-05-22 14:26 . 2008-05-22 14:26 <DIR> d-------- C:\Programmi\RFA
2008-05-22 14:24 . 2008-05-22 15:44 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\RFA_Backups
2008-05-21 20:00 . 2008-05-21 20:00 <DIR> d-------- C:\Programmi\File comuni\xing shared
2008-05-21 19:59 . 2008-05-21 19:59 <DIR> d-------- C:\Program Files
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-12 17:48 . 2008-05-12 17:49 <DIR> d-------- C:\Programmi\Spybot - Search & Destroy
2008-05-12 17:48 . 2008-05-12 19:01 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-05-12 15:05 . 2005-06-14 12:09 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-12 14:59 . 2008-05-12 14:59 <DIR> d-------- C:\Documents and Settings\LocalService\Documenti
2008-05-12 14:56 . 2008-05-12 15:05 <DIR> d-------- C:\Programmi\SpywareDetector
2008-05-12 14:28 . 2008-05-13 14:14 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-05-12 14:28 . 2008-05-13 14:14 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-05-01 13:43 . 2008-05-01 13:43 12 --a------ C:\WINDOWS\system\CTDJ.CPD
2008-05-01 13:42 . 1998-02-06 22:37 299,520 --a------ C:\WINDOWS\uninst.exe
2008-04-29 11:20 . 2008-04-29 11:20 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 11:19 . 2008-04-29 11:19 15,648 --a------ C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 11:19 . 2008-04-29 11:19 12,960 --a------ C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-01 16:58 . 2008-04-01 16:58 <DIR> d-------- C:\Programmi\Avira
2008-04-01 16:58 . 2008-04-01 16:58 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Avira
2008-04-01 16:54 . 2008-04-01 16:54 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Avg7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-24 18:06 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Lavasoft
2008-05-24 15:54 --------- d-----w C:\Programmi\Trend Micro
2008-05-21 18:00 --------- d-----w C:\Programmi\File comuni\Real
2008-05-21 17:59 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-05-21 17:59 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-05-12 17:10 --------- d-----w C:\Programmi\Windows Media Connect 2
2008-05-12 11:15 --------- d-----w C:\Programmi\Google
2008-04-01 14:53 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Grisoft
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll
2008-03-25 04:51 183,072 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-25 04:51 183,072 ------w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-20 08:06 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:06 1,845,248 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-01 16:28 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:57 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:57 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-26 11:59 294,912 ----a-w C:\WINDOWS\system32\msctf.dll
2008-02-26 11:59 294,912 ------w C:\WINDOWS\system32\dllcache\msctf.dll
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-21 02:05 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-02-21 02:05 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-02-21 02:05 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 06:50 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:50 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:33 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:33 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:33 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-02-01 10:17 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2006-02-04 20:21 524,300 -c--a-w C:\Documents and Settings\Casa\Dati applicazioni\position.bin
2005-06-07 13:58 122 -c--a-w C:\Programmi\INSTALL.LOG
2005-01-20 18:39 266 ---h--w C:\Programmi\desktop.ini
2005-01-20 18:39 11,079 -c-h--w C:\Programmi\folder.htt
.

((((((((((((((((((((((((((((( snapshot@2008-05-25_20.14.08,90 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-25 13:03:19 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-30 10:08:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 304,640 2008-01-21 23:41:32 C:\Documents and Settings\Casa\Impostazioni locali\Dati applicazioni\bak\ukvtpx.exe

----a-w 40,048 2007-05-11 02:06:32 C:\Programmi\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe

----a-w 524,800 2003-11-06 13:22:30 C:\Programmi\Compaq\SetRefresh\bak\SetRefresh.exe

-c--a-w 81,920 2004-08-22 15:05:02 C:\Programmi\D-Tools\bak\daemon.exe

-c--a-w 151,597 2004-08-29 09:36:17 C:\Programmi\File comuni\Real\Update_OB\bak\realsched.exe
----a-w 185,896 2008-05-21 17:59:21 C:\Programmi\File comuni\Real\Update_OB\realsched.exe

----a-w 579,072 2007-12-30 08:25:09 C:\Programmi\Grisoft\AVG Free\bak\avgcc.exe

----a-w 406,528 2007-12-30 08:25:09 C:\Programmi\Grisoft\AVG Free\bak\avgemc.exe

----a-w 267,048 2007-12-11 11:10:26 C:\Programmi\iTunes\bak\iTunesHelper.exe
----a-w 267,048 2007-12-11 11:10:26 C:\Programmi\iTunes\iTunesHelper.exe

----a-w 32,873 2003-08-19 15:23:34 C:\Programmi\Java\j2re1.4.2_01\bin\bak\jusched.exe

----a-w 184,320 2003-01-22 14:54:38 C:\Programmi\ltmoh\bak\Ltmoh.exe

-c--a-w 77,824 2004-09-25 17:18:41 C:\Programmi\QuickTime\bak\qttask.exe

-c--a-w 327,680 2002-02-15 17:38:10 C:\Programmi\Trend Micro\PC-cillin 2002\bak\PCCClient.exe

-c--a-w 258,048 2002-02-15 17:45:28 C:\Programmi\Trend Micro\PC-cillin 2002\bak\pccguide.exe

-c--a-w 307,266 2002-02-15 17:41:30 C:\Programmi\Trend Micro\PC-cillin 2002\bak\Pop3trap.exe

-c--a-w 13,312 2003-04-08 02:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-19 13:39:36 C:\WINDOWS\system32\ctfmon.exe

-c--a-w 40,960 2002-08-20 08:29:26 C:\WINDOWS\system32\bak\ezSP_Px.exe

.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:39 15360]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LTWinModem1"="ltmsg.exe" [2001-04-03 11:38 38912 C:\WINDOWS\system32\ltmsg.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 15:39 110592 C:\WINDOWS\system32\bthprops.cpl]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048]
"avgnt"="C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-20 13:31 262401]
"TkBellExe"="C:\Programmi\File comuni\Real\Update_OB\realsched.exe" [2008-05-21 19:59 185896]
"rfagent"="C:\Programmi\RFA\rfagent.exe" [2007-04-14 16:36 617544]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15:39 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"7H28X9M91L"= C:\WINDOWS\winlogon32.exe

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Programmi\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"ERSvc"=2 (0x2)
"Alerter"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\Casa\\Documenti\\gio2\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\iTunes\\iTunes.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\Casa\\Documenti\\gio2\\eMule.v0.48a.Applejuice.v2.3.bin\\eMule Applejuice\\emule.exe"=

R3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S2 LogNaa;LogNaa;"\\?\C:\Programmi\File comuni\System\lpt5.exe" [2003-04-08 04:00]
S2 NetFcz;NetFcz;"\\?\C:\Programmi\Windows NT\com3.exe" [2003-04-08 04:00]
S3 idrmkl;idrmkl;C:\DOCUME~1\Casa\IMPOST~1\Temp\idrmkl.sys []
S3 usbscan;Driver scanner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

.
Contenuto della cartella 'Scheduled Tasks'
"2008-05-27 13:37:10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-30 12:43:54
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-05-30 12.51.17
ComboFix-quarantined-files.txt 2008-05-30 10:51:04
ComboFix2.txt 2008-05-25 18:15:23

16 Directory 10,162,311,168 byte disponibili
20 Directory 10,163,752,960 byte disponibili

172 --- E O F --- 2008-05-28 20:36:52

[SaraNana]

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!


0.o kw significa??? ce so ke significa...ma ke itende???quale console?? combofix? ps..inizialmente come ho rifatto combofix x darvi il log ha detto ke nn era installato o qlc del genere ma ha fatto lo stesso l analisi

[bdoriano]

[SaraNana]

ho un problema con sistemscan....rikordi--->ATTENZIONE!!! Potrebbe capitare di ricevere il seguente messaggio d'errore:

Citazione:
Warning! You don't have the seDebugPrivilege, which is required for SystemScan to work.
seDebugPrivilege will be restred to Administrators Group. A REBOOT is required for changes to take effect.
Please save all data and press Ok to REBOOT your system now, or Cancel to reboot later.


In questo caso, procedi così:

- clicca su Cancel
- Scarica questo programmino: http://download.bleepingcomputer.com/sUBs/SeDebug-Restore.exe
- Eseguilo
- Riavvia il pc
- Rifai partire il file sys#####
eko a me esce quella scritta..ho scaricato il programma del link..eseguo..



"\cscript.exe" non è riconosciuto come comando interno o esterno,
un programma eseguibile o un file batch.

Please reboot your machine

Press any key to exit

riavvio ..eseguo sistemscan e m riappare la scritta


Citazione:
Warning! You don't have the seDebugPrivilege, which is required for SystemScan to work.
seDebugPrivilege will be restred to Administrators Group. A REBOOT is required for changes to take effect.
Please save all data and press Ok to REBOOT your system now, or Cancel to reboot later.
..che faccio??

[bdoriano]

Che versione di XP hai? Home o Professional?

[SaraNana]

eko il forum link report.txt cmq ho xp home attendo comandi

[Sante62]

Ciao...
Non mi pare di vedere nulla di sospetto nel log...

Adesso collegati a Kaspersky online scanner e procedi con la scansione estesa del PC.

[bdoriano]

1. Scarica la versione aggiornata di ComboFix
   Crea un file di testo con le seguenti istruzioni:
   

   Codice:

   File:: C:\WINDOWS\winlogon32.exe C:\Documents and Settings\Casa\Impostazioni locali\Dati applicazioni\bak\ukvtpx.exe Registry:: [HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] "7H28X9M91L"=-

   
   Salva il file sul desktop con il nome CFScript.txt e trascinalo sull'icona di ComboFix, come indicato in seguito:
   
   Attendi pazientemente la fine dei lavori senza toccare tastiera, mouse o altro.
   Posta il logs aggiornato di combofix.
   
   
2. Rifai questa scansione con Norman Malware Scanner

[SaraNana]

ComboFix 08-06-10.3 - Casa 2008-06-11 13:06:33.3 - NTFSx86
Eseguito da: C:\Documents and Settings\Casa\Desktop\COMBO-FIX.EXE
Command switches used :: C:\Documents and Settings\Casa\Desktop\CFScript.txt
* Creato nuovo punto di ripristino

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Casa\Impostazioni locali\Dati applicazioni\bak\ukvtpx.exe
C:\WINDOWS\winlogon32.exe
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Casa\Impostazioni locali\Dati applicazioni\bak\ukvtpx.exe

.
((((((((((((((((((((((((( Files Creati Da 2008-05-11 al 2008-06-11 )))))))))))))))))))))))))))))))))))
.

2008-06-11 12:49 . 2008-06-11 12:49 <DIR> d-------- C:\ComboFix
2008-06-11 11:59 . 2008-06-11 11:59 <DIR> d-------- C:\WINDOWS\LastGood
2008-06-10 16:25 . 2008-06-10 16:25 <DIR> d-------- C:\Programmi\Sun
2008-06-07 15:45 . 2008-06-07 15:45 <DIR> d-------- C:\Programmi\Veoh Networks
2008-06-06 13:31 . 2008-06-06 13:31 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\RFA_Backups
2008-06-04 14:55 . 2008-06-04 14:55 <DIR> d-------- C:\Programmi\Windows Resource Kits
2008-06-01 20:35 . 2008-06-01 20:35 <DIR> d-------- C:\Programmi\CCleaner
2008-05-25 13:42 . 2008-05-25 13:42 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-05-24 20:04 . 2008-05-24 20:04 <DIR> d-------- C:\Programmi\Lavasoft
2008-05-24 20:00 . 2008-05-24 20:01 <DIR> d-------- C:\Programmi\File comuni\Wise Installation Wizard
2008-05-21 20:00 . 2008-05-21 20:00 <DIR> d-------- C:\Programmi\File comuni\xing shared
2008-05-21 19:59 . 2008-05-21 19:59 <DIR> d-------- C:\Program Files
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-12 17:48 . 2008-05-12 17:49 <DIR> d-------- C:\Programmi\Spybot - Search & Destroy
2008-05-12 17:48 . 2008-05-12 19:01 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-05-12 15:05 . 2005-06-14 12:09 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-05-12 14:59 . 2008-05-12 14:59 <DIR> d-------- C:\Documents and Settings\LocalService\Documenti
2008-05-12 14:56 . 2008-05-12 15:05 <DIR> d-------- C:\Programmi\SpywareDetector
2008-05-12 14:28 . 2008-05-13 14:14 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-05-12 14:28 . 2008-05-13 14:14 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-11 10:26 --------- d-----w C:\Programmi\Java
2008-06-08 12:41 --------- d--h--w C:\Programmi\InstallShield Installation Information
2008-06-01 14:56 --------- d---a-w C:\Documents and Settings\All Users\Dati applicazioni\TEMP
2008-05-24 18:06 --------- d-----w C:\Documents and Settings\All Users\Dati applicazioni\Lavasoft
2008-05-24 15:54 --------- d-----w C:\Programmi\Trend Micro
2008-05-21 18:00 --------- d-----w C:\Programmi\File comuni\Real
2008-05-12 17:10 --------- d-----w C:\Programmi\Windows Media Connect 2
2008-05-12 11:15 --------- d-----w C:\Programmi\Google
2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2006-02-04 20:21 524,300 -c--a-w C:\Documents and Settings\Casa\Dati applicazioni\position.bin
2005-06-07 13:58 122 -c--a-w C:\Programmi\INSTALL.LOG
2005-01-20 18:39 266 ---h--w C:\Programmi\desktop.ini
2005-01-20 18:39 11,079 -c-h--w C:\Programmi\folder.htt
.

((((((((((((((((((((((((((((( snapshot@2008-05-25_20.14.08,90 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-25 13:03:19 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-11 09:40:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2007-09-08 14:17:28 77,995 ----a-w C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\index.dat
+ 2008-06-04 12:57:44 79,683 ----a-w C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\index.dat
- 2007-09-08 14:17:28 5,220 ----a-w C:\WINDOWS\PCHealth\HelpCtr\PackageStore\SkuStore.bin
+ 2008-06-04 12:57:44 5,846 ----a-w C:\WINDOWS\PCHealth\HelpCtr\PackageStore\SkuStore.bin
+ 2008-02-26 11:59:50 294,912 ------w C:\WINDOWS\system32\dllcache\msctf.dll
+ 2008-03-25 02:32:44 218,496 ----a-r C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe
+ 2008-06-06 15:57:02 74,137 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
- 2004-08-19 13:39:18 294,400 ----a-w C:\WINDOWS\system32\msctf.dll
+ 2008-02-26 11:59:50 294,912 ----a-w C:\WINDOWS\system32\msctf.dll
+ 2003-04-18 16:06:08 177,152 ----a-w C:\WINDOWS\system32\pkiview.dll
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 40,048 2007-05-11 02:06:32 C:\Programmi\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe

----a-w 524,800 2003-11-06 13:22:30 C:\Programmi\Compaq\SetRefresh\bak\SetRefresh.exe

-c--a-w 81,920 2004-08-22 15:05:02 C:\Programmi\D-Tools\bak\daemon.exe

-c--a-w 151,597 2004-08-29 09:36:17 C:\Programmi\File comuni\Real\Update_OB\bak\realsched.exe
----a-w 185,896 2008-05-21 17:59:21 C:\Programmi\File comuni\Real\Update_OB\realsched.exe

----a-w 579,072 2007-12-30 08:25:09 C:\Programmi\Grisoft\AVG Free\bak\avgcc.exe

----a-w 406,528 2007-12-30 08:25:09 C:\Programmi\Grisoft\AVG Free\bak\avgemc.exe

----a-w 267,048 2007-12-11 11:10:26 C:\Programmi\iTunes\bak\iTunesHelper.exe
----a-w 267,048 2007-12-11 11:10:26 C:\Programmi\iTunes\iTunesHelper.exe

----a-w 32,873 2003-08-19 15:23:34 C:\Programmi\Java\j2re1.4.2_01\bin\bak\jusched.exe

----a-w 184,320 2003-01-22 14:54:38 C:\Programmi\ltmoh\bak\Ltmoh.exe

-c--a-w 77,824 2004-09-25 17:18:41 C:\Programmi\QuickTime\bak\qttask.exe

-c--a-w 327,680 2002-02-15 17:38:10 C:\Programmi\Trend Micro\PC-cillin 2002\bak\PCCClient.exe

-c--a-w 258,048 2002-02-15 17:45:28 C:\Programmi\Trend Micro\PC-cillin 2002\bak\pccguide.exe

-c--a-w 307,266 2002-02-15 17:41:30 C:\Programmi\Trend Micro\PC-cillin 2002\bak\Pop3trap.exe

----a-w 304,640 2008-01-21 23:41:32 C:\QooBox\Quarantine\C\Documents and Settings\Casa\Impostazioni locali\Dati applicazioni\bak\ukvtpx.exe.vir

-c--a-w 13,312 2003-04-08 02:00:00 C:\WINDOWS\system32\bak\ctfmon.exe
----a-w 15,360 2004-08-19 13:39:36 C:\WINDOWS\system32\ctfmon.exe

-c--a-w 40,960 2002-08-20 08:29:26 C:\WINDOWS\system32\bak\ezSP_Px.exe

.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:39 15360]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"Veoh"="C:\Programmi\Veoh Networks\Veoh\VeohClient.exe" [2008-05-15 16:11 3644464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LTWinModem1"="ltmsg.exe" [2001-04-03 11:38 38912 C:\WINDOWS\system32\ltmsg.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 15:39 110592 C:\WINDOWS\system32\bthprops.cpl]
"iTunesHelper"="C:\Programmi\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048]
"avgnt"="C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-20 13:31 262401]
"TkBellExe"="C:\Programmi\File comuni\Real\Update_OB\realsched.exe" [2008-05-21 19:59 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15:39 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"7H28X9M91L"= C:\WINDOWS\winlogon32.exe

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Programmi\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"ERSvc"=2 (0x2)
"Alerter"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmi\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\Casa\\Documenti\\gio2\\eMule\\emule.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmi\\iTunes\\iTunes.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\Casa\\Documenti\\gio2\\eMule.v0.48a.Applejuice.v2.3.bin\\eMule Applejuice\\emule.exe"=
"C:\\Programmi\\Veoh Networks\\Veoh\\VeohClient.exe"=

S3 idrmkl;idrmkl;C:\DOCUME~1\Casa\IMPOST~1\Temp\idrmkl.sys []
S3 usbscan;Driver scanner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Driver archiviazione di massa USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

.
Contenuto della cartella 'Scheduled Tasks'
"2008-06-10 13:37:50 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmi\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 13:10:16
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-06-11 13:17:42
ComboFix-quarantined-files.txt 2008-06-11 11:17:38
ComboFix2.txt 2008-05-30 10:51:18
ComboFix3.txt 2008-05-25 18:15:23

17 Directory 7,769,358,336 byte disponibili
21 Directory 7,783,067,648 byte disponibili

151 --- E O F --- 2008-06-11 10:05:03








NORMAN MALWARE CLEANER

Norman Malware Cleaner
Copyright © 1990 - 2008, Norman ASA. Built 2008/06/02 19:05:48

Norman Scanner Engine Version: 5.92.08
Nvcbin.def Version: 5.92.00, Date: 2008/06/02 19:05:48, Variants: 1705334

Running pre-scan cleanup routine:
Operating System: Microsoft Windows XP Home 5.1.2600(Safe mode) Service Pack 2
Logged on user: ENRICO\Casa

Removed registry value: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools = 0x00000000

edit by bdoriano: log eliminato perché incompleto. I logs vanno caricati su FreeFileHosting come indicato qui.

[bdoriano]

Vedo che alcune voci sono ancora presenti nel log di combofix.

Norman, invece, ha sistemato una chiave di registro... ma non so cos'ha fatto dopo perché il log era troncato. Carica il log di Norman su FreeFileHosting come indicato qui.

Fai questa scansione con SystemScan, carica il log su WikiSend e posta il Forum Link che ti viene assegnato.

[SaraNana]

NFix_2008-06-11_14-13-51.log

[SaraNana]

13_06_2008_13_08_report.zip