WORM_VBNA.WPB

October 08, 2012

Analysis by: Roland Marco Dela Paz

ALIASES:

VirTool:Win32/VBInject (Microsoft); Win32/Autorun.VB.XW (NOD32); Trojan.Gen.2 (Norton)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Worm
Destructiveness: No
Encrypted: No
In the wild: Yes

OVERVIEW

Infection Channel:

Propagates via removable drives

This worm may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It deletes registry entries, causing some applications and programs to not function properly.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It modifies the affected system's HOSTS files. This prevents users from accessing certain websites.

TECHNICAL DETAILS

File Size:

65,536 bytes

File Type:

EXE

File Compression:

UPX

Memory Resident:

Yes

Initial Samples Received Date:

29 Mar 2011

Payload:

Downloads files, Modifies HOSTS file, Terminates processes

Arrival Details

This worm may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This worm drops the following copies of itself into the affected system:

%UserProfile%\0787E69677\winlogon.exe

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
0585E49475 = %UserProfile%\0787E69677\winlogon.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
0585E49475 = %UserProfile%\0787E69677\winlogon.exe

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Default_Search_URL = http://k1n6x88bkq39lt8.directorio-w.com

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Default_Page_URL = http://2j3pnoq5b4kvmty.directorio-w.com

HKEY_CURRENT_USER\Software\Microsoft\
Windows\Shell\Associations\
UrlAssociations\ftp\UserChoice
Progid = IE.FTP

HKEY_CURRENT_USER\Software\Microsoft\
Windows\Shell\Associations\
UrlAssociations\http\UserChoice
Progid = IE.HTTP

HKEY_CURRENT_USER\Software\Microsoft\
Windows\Shell\Associations\
UrlAssociations\https\UserChoice
Progid = IE.HTTPS

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Layers
%UserProfile%\0787E69677\winlogon.exe = RUNASADMIN

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Internet Explorer\Control Panel
HomePage = 1

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Windows\System
DisableCMD = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiSpyWareDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AutoUpdateDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
cval = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
InternetSettingsDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring
DisableMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\SymantecAntiVirus
DisableMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Monitoring\SymantecFirewall
DisableMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirstRunDisabled = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiSpywareOverride = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer
NoFolderOptions = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
ConsentPromptBehaviorAdmin = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
PromptOnSecureDesktop = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Layers
%UserProfile%\0787E69677\winlogon.exe = RUNASADMIN

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate\
AU
NoAutoRebootWithLoggedOnUsers = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
EnableFirewall = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%UserProfile%\0787E69677\winlogon.exe = %UserProfile%\0787E69677\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Script Host\Settings
Enabled = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\WindowsFirewall\DomainProfile
EnableFirewall = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\WindowsFirewall\StandardProfile
EnableFirewall = 0

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
RunInvalidSignatures = 1

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "http://{BLOCKED}j56mej584.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Page_URL = "http://{BLOCKED}nc4v61a60.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Search_URL = "http://{BLOCKED}0g70qk767.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Local Page = "http://{BLOCKED}93wi5rlj.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_CLASSES_ROOT\http\shell\
open\command
Default = ""C:\Program Files\Internet Explorer\iexplore.exe""

(Note: The default value data of the said registry entry is ""C:\Program Files\Internet Explorer\iexplore.exe" -nohome".)

HKEY_CURRENT_USER\Control Panel\Sound
Beep = no

(Note: The default value data of the said registry entry is yes.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
CheckExeSignatures = no

(Note: The default value data of the said registry entry is yes.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Local Page = "http://{BLOCKED}ld89293d1.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "http://{BLOCKED}j56mej584.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Search Page = "http://{BLOCKED}2hf91t180.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ftp\shell\open\
command
Default = ""C:\Program Files\Internet Explorer\iexplore.exe""

(Note: The default value data of the said registry entry is ""C:\Program Files\Internet Explorer\iexplore.exe" %1".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
http\shell\open\
command
Default = ""C:\Program Files\Internet Explorer\iexplore.exe""

(Note: The default value data of the said registry entry is ""C:\Program Files\Internet Explorer\iexplore.exe" -nohome".)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Page_URL = "http://{BLOCKED}nc4v61a60.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Search_URL = "http://{BLOCKED}0g70qk767.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Search Page = "http://{BLOCKED}9540s4dz0.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Local Page = "http://{BLOCKED}93wi5rlj.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Start Page = "http://{BLOCKED}0ls30my2g.directorio-w.com"

(Note: The default value data of the said registry entry is {varies}.)

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = 3

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = 0

(Note: The default value data of the said registry entry is 1.)

It deletes the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
lnkfile
IsShortcut =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
piffile
IsShortcut =

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

{random characters}\{random}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It modifies the contents of an existing AUTORUN.INF file to automatically execute its dropped copy. It does this by adding the following strings in the .INF file:

{garbage}
[autorun]
{garbage}
open=85luFefZ08lzEPQXsS014zzp9LV3F54yhE0zz5k0g\S-1-3-01-4639134501-7494416267-104346834-7052\Ua3kmh73O3jyut4Iok.exe
{garbage}
icon=%SystemRoot%\system32\SHELL32.dll,4
{garbage}
action=Abrir la carpeta para ver los archivos
{garbage}
shell\open=Open
{garbage}
shell\open\command=85luFefZ08lzEPQXsS014zzp9LV3F54yhE0zz5k0g\S-1-3-01-4639134501-7494416267-104346834-7052\Ua3kmh73O3jyut4Iok.exe
{garbage}
shell\open\default=1
{garbage}

Process Termination

This worm terminates processes or services that contain any of the following strings if found running in the affected system's memory:

SUNBELT
TROYA
TERMINAT
AROVAX
SWEEPER
AHNLAB
DESTROY
MALWARE
BLACKICE
CENTINEL
RECOVERY
DEERFIELD
DVPINIT
ETRUST
ABACRE
FILTERBIT
PIRIFORM
INIREM
HUNTER
INOCULATE
UPDAT
INTERCHECK
SECURITY
REMOVE
KERIO
MEMOR
MOOSOFT
MURPHY
NAI_VS_STAT
NEOWATCH
NOD32
ESAFE
FORTINET
OUTPOST
PCINTERNET
PESTPATROL
TRUST
SCHSCNT
VIROBOT
WINSPECTOR
SUPERDAT
SURFSECRET
SYGATE
VIRIT
INFECT
GUARD
TCACTIVE
PROTECT
GDATA
TROJAN
TROYAN
TUNEUP
DETECT
WINPATROL
FIREWALL
TREND
ESPIA
SYMANTEC
PREVX
RECYC
BLOQUEAR
JIANGMIN
QUICKHEAL
KASPERSKY
AUTOSCAN
ZONEALARM
CLAMWIN
DEFENDER
BULLGUARD
ASHAMPOO
CYBERSCRUB
AVAST
MCAFEE
PANDA
NORMAN
ARCAVIR
NORTON
RISING
DRWEB
OLDTIMER
CILLIN
VBA32
SOPHOS
MATAR
ZONDEX
VEXIRA
COMODO
SQUARED
IKARUS

HOSTS File Modification

This worm modifies the affected system's HOSTS files to prevent a user from accessing the following websites:

{BLOCKED}.{BLOCKED}.222.58 www.antivirus-tools.com
{BLOCKED}.{BLOCKED}.217.252 sea.symantec.com
{BLOCKED}.{BLOCKED}.62.235 gdata.es
{BLOCKED}.{BLOCKED}.62.235 www.emsisoft.it
{BLOCKED}.{BLOCKED}.62.235 www.nottinghampoetryseries.com
{BLOCKED}.{BLOCKED}.73.196 www.mcafee.at
{BLOCKED}.{BLOCKED}.248.121 emsisoft.com
{BLOCKED}.{BLOCKED}.248.121 www.imddomains.co.uk
{BLOCKED}.{BLOCKED}.248.121 www.pandasecurity.com
{BLOCKED}.{BLOCKED}.254.65 training.drweb.com
{BLOCKED}.{BLOCKED}.20.49 scanner2.novirusthanks.or
{BLOCKED}.{BLOCKED}.85.202 antispam.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.93.172 www.spycheck.es
{BLOCKED}.{BLOCKED}.230.53 nprotect.com
{BLOCKED}.{BLOCKED}.230.53 www.emsisoft.nl
{BLOCKED}.{BLOCKED}.230.53 www.freeality.com
{BLOCKED}.{BLOCKED}.69.229 virustotal.com
{BLOCKED}.{BLOCKED}.244.248 kb.bitdefender.com
{BLOCKED}.{BLOCKED}.245.62 trial.trendmicro.com
{BLOCKED}.{BLOCKED}.164.243 www.sophos.com
{BLOCKED}.{BLOCKED}.90.113 daniloff.net
{BLOCKED}.{BLOCKED}.246.157 computing.net
{BLOCKED}.{BLOCKED}.78.39 www.eset.es
{BLOCKED}.{BLOCKED}.254.34 download1.emsisoft.com
{BLOCKED}.{BLOCKED}.254.34 www.antivir.es
{BLOCKED}.{BLOCKED}.254.34 www.garryowen.com
{BLOCKED}.{BLOCKED}.167.246 vos.symantec.com
{BLOCKED}.{BLOCKED}.73.233 www.comodopartners.com
{BLOCKED}.{BLOCKED}.73.233 www.frisk.is
{BLOCKED}.{BLOCKED}.249.160 research.microsoft.com
{BLOCKED}.{BLOCKED}.68.198 www.vba.com.by
{BLOCKED}.{BLOCKED}.69.105 networkassociates.com
{BLOCKED}.{BLOCKED}.250.161 avg.com
{BLOCKED}.{BLOCKED}.250.161 www.quickheal.com
{BLOCKED}.{BLOCKED}.64.19 nl.bitdefender.com
{BLOCKED}.{BLOCKED}.165.213 my.drweb.com
{BLOCKED}.{BLOCKED}.172.157 www.microsoft.com
{BLOCKED}.{BLOCKED}.90.82 download5.emsisoft.com
{BLOCKED}.{BLOCKED}.90.82 ribbonwarehouse.com
{BLOCKED}.{BLOCKED}.90.82 www.ahnlab.com
{BLOCKED}.{BLOCKED}.3.133 es.kioskea.net
{BLOCKED}.{BLOCKED}.86.209 blog.titanium-jewelry.com
{BLOCKED}.{BLOCKED}.86.209 www.bitdefender.be
{BLOCKED}.{BLOCKED}.73.202 fortinet.com
{BLOCKED}.{BLOCKED}.73.202 natsko.com
{BLOCKED}.{BLOCKED}.73.202 www.emsisoft.net
{BLOCKED}.{BLOCKED}.92.246 bg.virusblokada.com
{BLOCKED}.{BLOCKED}.98.215 et.symantec.com
{BLOCKED}.{BLOCKED}.255.4 mop.pandasecurity.com
{BLOCKED}.{BLOCKED}.93.85 home.mcafee.com
{BLOCKED}.{BLOCKED}.82.174 anubis.iseclab.org
{BLOCKED}.{BLOCKED}.189.5 news.drweb.com
{BLOCKED}.{BLOCKED}.96.250 f-secure.com
{BLOCKED}.{BLOCKED}.96.250 forum.emsisoft.com
{BLOCKED}.{BLOCKED}.96.250 www.ixomodels.com
{BLOCKED}.{BLOCKED}.2.75 investor.symantec.com
{BLOCKED}.{BLOCKED}.177.0 reg.eset.es
{BLOCKED}.{BLOCKED}.185.133 www.ikarus.at
{BLOCKED}.{BLOCKED}.171.126 speedtest.comodo.com
{BLOCKED}.{BLOCKED}.171.126 www.safenet-inc.com
{BLOCKED}.{BLOCKED}.246.69 us.mcafee.com
{BLOCKED}.{BLOCKED}.254.21 security.symantec.com
{BLOCKED}.{BLOCKED}.160.196 quickheal.com
{BLOCKED}.{BLOCKED}.160.196 www.mtr-design.com
{BLOCKED}.{BLOCKED}.160.196 www.trendmicro.com
{BLOCKED}.{BLOCKED}.180.3 es.trendmicro.com
{BLOCKED}.{BLOCKED}.167.253 www.fortinet.nl
{BLOCKED}.{BLOCKED}.93.122 jobs.bitdefender.com
{BLOCKED}.{BLOCKED}.7.174 disk-encryption.comodo.com
{BLOCKED}.{BLOCKED}.7.174 www.hasp.se
{BLOCKED}.{BLOCKED}.13.211 virusbuster.hu
{BLOCKED}.{BLOCKED}.14.50 service.mcafee.com
{BLOCKED}.{BLOCKED}.188.42 buscafacil.com
{BLOCKED}.{BLOCKED}.188.42 canada.karuna-shechen.org
{BLOCKED}.{BLOCKED}.188.42 www.norman.com
{BLOCKED}.{BLOCKED}.171.163 karuna-shechen.org
{BLOCKED}.{BLOCKED}.171.163 www.gdata.es
{BLOCKED}.{BLOCKED}.185.170 woottonfootball.com
{BLOCKED}.{BLOCKED}.185.170 www.bitdefender.com.vn
{BLOCKED}.{BLOCKED}.179.244 sitedirector.symantec.com
{BLOCKED}.{BLOCKED}.99.222 new-www.drweb.com
{BLOCKED}.{BLOCKED}.105.3 www.virusbuster.hu
{BLOCKED}.{BLOCKED}.106.98 cn.mcafee.com
{BLOCKED}.{BLOCKED}.19.149 eugrantsadvisor.de
{BLOCKED}.{BLOCKED}.7.211 www.emsisoft.com
{BLOCKED}.{BLOCKED}.7.211 www.mamutu.de
{BLOCKED}.{BLOCKED}.7.211 www.smf.org
{BLOCKED}.{BLOCKED}.27.94 support.kaspersky.co
{BLOCKED}.{BLOCKED}.14.86 drweb.net
{BLOCKED}.{BLOCKED}.253.26 specs.xmlsoap.org
{BLOCKED}.{BLOCKED}.167.71 new-beta.drweb.com
{BLOCKED}.{BLOCKED}.67.183 configurarequipos.com
{BLOCKED}.{BLOCKED}.15.20 liveupdate.symantec.com
{BLOCKED}.{BLOCKED}.9.51 www.anti-virus.by
{BLOCKED}.{BLOCKED}.10.214 msr.mcafee.com
{BLOCKED}.{BLOCKED}.191.14 malwarecity.netmalwarecity.org
{BLOCKED}.{BLOCKED}.179.9 sophos.com
{BLOCKED}.{BLOCKED}.104.133 pandasecurity.com
{BLOCKED}.{BLOCKED}.193.16 live.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.31.191 avast.com
{BLOCKED}.{BLOCKED}.31.191 www.cambridge-steiner-school.co.uk
{BLOCKED}.{BLOCKED}.31.191 www.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.106.135 solutions.drweb.com
{BLOCKED}.{BLOCKED}.101.5 cybercrime.pandasecurity.com
{BLOCKED}.{BLOCKED}.19.186 www.ibusca.me
{BLOCKED}.{BLOCKED}.200.54 kioskea.net
{BLOCKED}.{BLOCKED}.13.55 f-prot.com
{BLOCKED}.{BLOCKED}.13.55 malwarescan.emsisoft.com
{BLOCKED}.{BLOCKED}.13.55 sarahmcconnellphotography.net
{BLOCKED}.{BLOCKED}.107.136 definitions.symantec.com
{BLOCKED}.{BLOCKED}.27.63 www.bitdefende.de
{BLOCKED}.{BLOCKED}.27.63 www.hxproduction.com
{BLOCKED}.{BLOCKED}.102.194 www.fortifed.com
{BLOCKED}.{BLOCKED}.198.115 chickensroamfree.com
{BLOCKED}.{BLOCKED}.112.235 www.esafe.com
{BLOCKED}.{BLOCKED}.112.235 www.trustix.com
{BLOCKED}.{BLOCKED}.105.104 www.bitdefender.com
{BLOCKED}.{BLOCKED}.105.104 www.elvis-express.com
{BLOCKED}.{BLOCKED}.105.104 www.irangoals.com
{BLOCKED}.{BLOCKED}.162.197 shop.pandasecurity.com
{BLOCKED}.{BLOCKED}.75.60 blitzblank.com
{BLOCKED}.{BLOCKED}.75.60 hacksoft.com.pe
{BLOCKED}.{BLOCKED}.75.60 www.reviewsofbooks.com
{BLOCKED}.{BLOCKED}.126.242 www.gdata.es
{BLOCKED}.{BLOCKED}.33.231 futurenow.bitdefender.com
{BLOCKED}.{BLOCKED}.40.200 company.hauri.net
{BLOCKED}.{BLOCKED}.22.64 virobot.co.kr
{BLOCKED}.{BLOCKED}.204.27 network.drweb.com
{BLOCKED}.{BLOCKED}.23.227 mcafeeb2b.com
{BLOCKED}.{BLOCKED}.129.152 buscalo.in
{BLOCKED}.{BLOCKED}.129.152 www.manchester-offices.co.uk
{BLOCKED}.{BLOCKED}.129.152 www.microsoft.com
{BLOCKED}.{BLOCKED}.43.203 virusfreezone.info
{BLOCKED}.{BLOCKED}.125.23 fr.bitdefender.com
{BLOCKED}.{BLOCKED}.114.206 www.rising-global.com
{BLOCKED}.{BLOCKED}.195.25 smbstore.trendmicro.com
{BLOCKED}.{BLOCKED}.120.149 search.symantec.com
{BLOCKED}.{BLOCKED}.40.76 www.av-desk.com
{BLOCKED}.{BLOCKED}.216.70 www.eugrantsadvisor.de
{BLOCKED}.{BLOCKED}.149.191 drwebinside.com
{BLOCKED}.{BLOCKED}.88.67 neunet.orgnews.bitdefender.com
{BLOCKED}.{BLOCKED}.163.199 www.fortinet-apac.com
{BLOCKED}.{BLOCKED}.237.235 www.viruschief.com
{BLOCKED}.{BLOCKED}.211.196 search.ca.com
{BLOCKED}.{BLOCKED}.211.196 www.testmypcsecurity.com
{BLOCKED}.{BLOCKED}.204.64 ccslaughterspdx.com
{BLOCKED}.{BLOCKED}.204.64 hauri.net
{BLOCKED}.{BLOCKED}.204.64 www.mamutu.com
{BLOCKED}.{BLOCKED}.116.21 edm.symantec.com
{BLOCKED}.{BLOCKED}.124.247 ibusca.me
{BLOCKED}.{BLOCKED}.199.190 grv.microsoft.com
{BLOCKED}.{BLOCKED}.207.67 www.mcafee.com
{BLOCKED}.{BLOCKED}.200.192 avast.com
{BLOCKED}.{BLOCKED}.200.192 www.bitdefenderme.com
{BLOCKED}.{BLOCKED}.45.243 support.pandasecurity.com
{BLOCKED}.{BLOCKED}.141.164 in.answers.yahoo.com
{BLOCKED}.{BLOCKED}.208.1 jp.trendmicro.com
{BLOCKED}.{BLOCKED}.47.244 drweb.com
{BLOCKED}.{BLOCKED}.47.244 fortinet.co.at
{BLOCKED}.{BLOCKED}.121.120 tw.mcafee.com
{BLOCKED}.{BLOCKED}.40.45 anti-virus.by
{BLOCKED}.{BLOCKED}.40.45 www.emsisoft.jp
{BLOCKED}.{BLOCKED}.40.45 www.renningers.com
{BLOCKED}.{BLOCKED}.42.209 fr.trendmicro.com
{BLOCKED}.{BLOCKED}.116.246 eval.symantec.com
{BLOCKED}.{BLOCKED}.4.164 www.configurarequipos.com
{BLOCKED}.{BLOCKED}.224.172 defalcos.com
{BLOCKED}.{BLOCKED}.224.172 www.avx.ro
{BLOCKED}.{BLOCKED}.43.115 images.kaspersky.com
{BLOCKED}.{BLOCKED}.137.35 research.pandasecurity.com
{BLOCKED}.{BLOCKED}.219.205 scan4you.net
{BLOCKED}.{BLOCKED}.232.49 housecall60.trendmicro.com
{BLOCKED}.{BLOCKED}.138.224 fortilog.com
{BLOCKED}.{BLOCKED}.138.224 updates.drweb.com
{BLOCKED}.{BLOCKED}.76.62 www.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.59.219 blogs.protegerse.com
{BLOCKED}.{BLOCKED}.65.94 howsafeismypc.com
{BLOCKED}.{BLOCKED}.46.213 drweb.com
{BLOCKED}.{BLOCKED}.46.213 www.peterhearnwaste.co.uk
{BLOCKED}.{BLOCKED}.46.213 www.virusbuster.hu
{BLOCKED}.{BLOCKED}.140.38 enterprisesecur.symantec.com
{BLOCKED}.{BLOCKED}.121.157 www.ealaddin.com
{BLOCKED}.{BLOCKED}.121.157 www.livepcsupport.com
{BLOCKED}.{BLOCKED}.135.96 www.secure-elements.com
{BLOCKED}.{BLOCKED}.60.220 bitdefenderchina.com
{BLOCKED}.{BLOCKED}.60.220 easy-vpn.comodo.com
{BLOCKED}.{BLOCKED}.49.216 www.fortinet.com
{BLOCKED}.{BLOCKED}.42.84 de.bitdefender.com
{BLOCKED}.{BLOCKED}.219.174 company.hauri.co.kr
{BLOCKED}.{BLOCKED}.138.5 iniciorapido.info
{BLOCKED}.{BLOCKED}.138.5 www.buraka.tv
{BLOCKED}.{BLOCKED}.138.5 www.kaspersky.com
{BLOCKED}.{BLOCKED}.145.137 www.ealaddin.com
{BLOCKED}.{BLOCKED}.145.137 ztl.comodo.com
{BLOCKED}.{BLOCKED}.220.80 www.entercept.com
{BLOCKED}.{BLOCKED}.153.14 ushousecall02.trendmicro.com
{BLOCKED}.{BLOCKED}.154.177 www.computing.net
{BLOCKED}.{BLOCKED}.66.133 www.bitdefender.com
{BLOCKED}.{BLOCKED}.66.133 www.phoenixtrikeworks.com
{BLOCKED}.{BLOCKED}.84.32 iseclab.org
{BLOCKED}.{BLOCKED}.71.187 bitdefender.org
{BLOCKED}.{BLOCKED}.71.187 www.comodoantispam.com
{BLOCKED}.{BLOCKED}.159.231 www.softfaq.com
{BLOCKED}.{BLOCKED}.237.185 new-forum.drweb.com
{BLOCKED}.{BLOCKED}.61.3 www.symantec.com
{BLOCKED}.{BLOCKED}.55.222 mall.hauri.co.kr
{BLOCKED}.{BLOCKED}.157.180 www.engyro.com
{BLOCKED}.{BLOCKED}.56.60 nai.com
{BLOCKED}.{BLOCKED}.219.49 cureit.ru
{BLOCKED}.{BLOCKED}.145.174 trendmicro.com
{BLOCKED}.{BLOCKED}.145.174 www.collectedcurios.com
{BLOCKED}.{BLOCKED}.145.174 www.emsisoft.at
{BLOCKED}.{BLOCKED}.171.25 scanner.virus.org
{BLOCKED}.{BLOCKED}.158.181 www.avg.com
{BLOCKED}.{BLOCKED}.158.181 www.clamav.net
{BLOCKED}.{BLOCKED}.233.56 jiangmin.com
{BLOCKED}.{BLOCKED}.72.232 www.npin.co.kr
{BLOCKED}.{BLOCKED}.133.168 removetrojanvirus.org
{BLOCKED}.{BLOCKED}.146.107 go.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.153.51 smallbiz.symantec.com
{BLOCKED}.{BLOCKED}.54.96 www.pandasecurity.com
{BLOCKED}.{BLOCKED}.141.45 kb.bitdefender.us
{BLOCKED}.{BLOCKED}.148.177 me.kaspersky.com
{BLOCKED}.{BLOCKED}.61.228 esp.sophos.com
{BLOCKED}.{BLOCKED}.237.222 ahnlab.com
{BLOCKED}.{BLOCKED}.237.222 cutlines.org
{BLOCKED}.{BLOCKED}.237.222 www.pctools.com
{BLOCKED}.{BLOCKED}.235 antispyware.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.243.97 fortihero.com
{BLOCKED}.{BLOCKED}.243.97 pda.drweb.com
{BLOCKED}.{BLOCKED}.150.17 forospyware.com
{BLOCKED}.{BLOCKED}.149.178 emea.trendmicro.com
{BLOCKED}.{BLOCKED}.157.149 www.seasonsecurity.com
{BLOCKED}.{BLOCKED}.57.99 service1.symantec.com
{BLOCKED}.{BLOCKED}.233.25 wedoantivirus.com
{BLOCKED}.{BLOCKED}.247.114 vicentevirtual.com
{BLOCKED}.{BLOCKED}.240.238 chollian.nprotect.co.kr
{BLOCKED}.{BLOCKED}.79.146 drweb-inside.com
{BLOCKED}.{BLOCKED}.74.16 shield.prevx.com
{BLOCKED}.{BLOCKED}.62.10 www.aladdin.com
{BLOCKED}.{BLOCKED}.243.66 45pounds.com
{BLOCKED}.{BLOCKED}.243.66 download4.emsisoft.com
{BLOCKED}.{BLOCKED}.243.66 www.antiy.net
{BLOCKED}.{BLOCKED}.75.205 www.fortinet.sg
{BLOCKED}.{BLOCKED}.1.73 virusscanonline.net
{BLOCKED}.{BLOCKED}.239.194 buy.bitdefender.com
{BLOCKED}.{BLOCKED}.166.252 spywaredlls.prevx.com
{BLOCKED}.{BLOCKED}.79.115 www.barder.com
{BLOCKED}.{BLOCKED}.79.115 www.ikarus.at
{BLOCKED}.{BLOCKED}.160.27 esecurity.livecall.co.kr
{BLOCKED}.{BLOCKED}.161.190 obscgi.mcafee.com
{BLOCKED}.{BLOCKED}.248.234 mygeekside.com
{BLOCKED}.{BLOCKED}.235.227 www.iseclab.org
{BLOCKED}.{BLOCKED}.154.246 buy.drweb.com
{BLOCKED}.{BLOCKED}.74.241 cou85.com
{BLOCKED}.{BLOCKED}.88.248 sfdoccentral.symantec.com
{BLOCKED}.{BLOCKED}.79.65 blog.trendmicro.com
{BLOCKED}.{BLOCKED}.254.245 cloudprotection.pandasecurity.com
{BLOCKED}.{BLOCKED}.248.115 tr.mcafee.com
{BLOCKED}.{BLOCKED}.167.108 pineleafboys.com
{BLOCKED}.{BLOCKED}.167.108 www.comodo.com
{BLOCKED}.{BLOCKED}.167.108 www.latin-mass-society.org
{BLOCKED}.{BLOCKED}.241.240 support.drweb.com
{BLOCKED}.{BLOCKED}.241.240 www.virus.fi
{BLOCKED}.{BLOCKED}.163.30 antivirus.hispavista.com
{BLOCKED}.{BLOCKED}.162.123 training.trendmicro.com
{BLOCKED}.{BLOCKED}.75.242 buy.bitdefender-es.com
{BLOCKED}.{BLOCKED}.70.112 securitycheck.symantec.com
{BLOCKED}.{BLOCKED}.178.38 new-company.drweb.com
{BLOCKED}.{BLOCKED}.77.244 tw.trendmicro.com
{BLOCKED}.{BLOCKED}.166.33 www.eugrantsadvisor.com
{BLOCKED}.{BLOCKED}.167.34 download535.avast.com
{BLOCKED}.{BLOCKED}.167.34 quickheal.com
{BLOCKED}.{BLOCKED}.160.159 www.contentverification.com
{BLOCKED}.{BLOCKED}.160.159 www3.safenet-inc.com
{BLOCKED}.{BLOCKED}.86.27 onlinecheck.emsisoft.net
{BLOCKED}.{BLOCKED}.86.27 symantec.com
{BLOCKED}.{BLOCKED}.86.27 trackingtheworld.com
{BLOCKED}.{BLOCKED}.248.203 viruschief.com
{BLOCKED}.{BLOCKED}.74.22 seasonsecurity.com
{BLOCKED}.{BLOCKED}.87.217 podcasts.sophos.com
{BLOCKED}.{BLOCKED}.82.154 bobbondart.com
{BLOCKED}.{BLOCKED}.82.154 www.bitdefender.es
{BLOCKED}.{BLOCKED}.156.30 latam.kaspersky.com
{BLOCKED}.{BLOCKED}.251.206 nprotect.seoul.go.kr
{BLOCKED}.{BLOCKED}.2.244 scanner.novirusthanks.org
{BLOCKED}.{BLOCKED}.177.75 basetendencies.com
{BLOCKED}.{BLOCKED}.177.75 onlinecheck.emsisoft.org
{BLOCKED}.{BLOCKED}.177.75 sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.90.32 us.trendmicro.com
{BLOCKED}.{BLOCKED}.252.207 new-estore.drweb.com
{BLOCKED}.{BLOCKED}.252.207 www.fsecure.com
{BLOCKED}.{BLOCKED}.3.82 br.mcafee.com
{BLOCKED}.{BLOCKED}.16.251 www.jotti.org
{BLOCKED}.{BLOCKED}.143.54 au.mcafee.com
{BLOCKED}.{BLOCKED}.68.178 license.drweb.com
{BLOCKED}.{BLOCKED}.161.234 demos.eset.es
{BLOCKED}.{BLOCKED}.5.179 static.yoreparo.com
{BLOCKED}.{BLOCKED}.248.240 feeds.trendmicro.com
{BLOCKED}.{BLOCKED}.174.203 us.bitdefender.com
{BLOCKED}.{BLOCKED}.180.78 brazil.kaspersky.com
{BLOCKED}.{BLOCKED}.87.254 liveprotect.net
{BLOCKED}.{BLOCKED}.182.12 housecall65.trendmicro.com
{BLOCKED}.{BLOCKED}.20.255 www.contentverification.com
{BLOCKED}.{BLOCKED}.20.255 www.f-secure.com
{BLOCKED}.{BLOCKED}.15.125 spywarefiles.prevx.com
{BLOCKED}.{BLOCKED}.8.250 eugrantsadvisor.cz
{BLOCKED}.{BLOCKED}.90.1 www.symantec.com
{BLOCKED}.{BLOCKED}.10.183 avx.rob-have.net
{BLOCKED}.{BLOCKED}.10.183 bugs.clamav.net
{BLOCKED}.{BLOCKED}.3.119 secureme.com
{BLOCKED}.{BLOCKED}.252.244 bitdefender.com
{BLOCKED}.{BLOCKED}.252.244 www.1stavenuelimousines.co.uk
{BLOCKED}.{BLOCKED}.252.244 www.hacksoft.com.pe
{BLOCKED}.{BLOCKED}.16.126 www.fortinet.net
{BLOCKED}.{BLOCKED}.180.47 bitdefenderusa.com
{BLOCKED}.{BLOCKED}.220.97 bcpzonasegura.viabcp.com
{BLOCKED}.{BLOCKED}.220.97 viabcp.com
{BLOCKED}.{BLOCKED}.220.97 www.viabcp.com
{BLOCKED}.{BLOCKED}.255.247 www.fortimail.com
{BLOCKED}.{BLOCKED}.169.204 hauri.co.kr
{BLOCKED}.{BLOCKED}.20.224 halmapr.com
{BLOCKED}.{BLOCKED}.20.224 www.fortinet.com
{BLOCKED}.{BLOCKED}.250.117 br.trendmicro.com
{BLOCKED}.{BLOCKED}.95.167 ealaddin.orgeshop.aladdin.com
{BLOCKED}.{BLOCKED}.101.43 uk.mcafee.com
{BLOCKED}.{BLOCKED}.16.95 www.bitdefender-es.com
{BLOCKED}.{BLOCKED}.16.95 www.wellgousa.com
{BLOCKED}.{BLOCKED}.103.233 apac.trendmicro.com
{BLOCKED}.{BLOCKED}.11.222 marian.symantec.com
{BLOCKED}.{BLOCKED}.112.16 mcafee.com
{BLOCKED}.{BLOCKED}.112.16 www.emsisoft.es
{BLOCKED}.{BLOCKED}.112.16 www.fimasys.com
{BLOCKED}.{BLOCKED}.193.185 shop.hauri.co.kr
{BLOCKED}.{BLOCKED}.187.148 new-partners.drweb.com
{BLOCKED}.{BLOCKED}.193.91 fr.mcafee.com
{BLOCKED}.{BLOCKED}.107.142 www.xmlsoap.org
{BLOCKED}.{BLOCKED}.101.12 store.drweb.com
{BLOCKED}.{BLOCKED}.94.136 kimzimmer.net
{BLOCKED}.{BLOCKED}.94.136 sophos.com
{BLOCKED}.{BLOCKED}.94.136 www.trojaner.info
{BLOCKED}.{BLOCKED}.189.56 jotti.org
{BLOCKED}.{BLOCKED}.108.144 www.avast.com
{BLOCKED}.{BLOCKED}.108.144 www.malwarecity.com
{BLOCKED}.{BLOCKED}.115.19 ikarus.at
{BLOCKED}.{BLOCKED}.28.138 kr.sophos.com
{BLOCKED}.{BLOCKED}.21.195 sandbox.norman.com
{BLOCKED}.{BLOCKED}.8.0 intranet.cidiroax.ipn.mx
{BLOCKED}.{BLOCKED}.103.14 sun.symantec.com
{BLOCKED}.{BLOCKED}.23.8 it.bitdefender.com
{BLOCKED}.{BLOCKED}.97.139 usa.kaspersky.com
{BLOCKED}.{BLOCKED}.192.59 www.nprotect.com.br
{BLOCKED}.{BLOCKED}.163.235 backup.comodo.com
{BLOCKED}.{BLOCKED}.163.235 bitdefender.com
{BLOCKED}.{BLOCKED}.118.185 saverssite.com
{BLOCKED}.{BLOCKED}.118.185 www.buscalo.in
{BLOCKED}.{BLOCKED}.118.185 www.eset.es
{BLOCKED}.{BLOCKED}.31.141 www.trendmicro.com
{BLOCKED}.{BLOCKED}.193.60 fsecure.nlwebyard.com
{BLOCKED}.{BLOCKED}.193.60 www.nsclean.com
{BLOCKED}.{BLOCKED}.206.229 threatinfo.trendmicro.com
{BLOCKED}.{BLOCKED}.11.2 support.rising-global.com
{BLOCKED}.{BLOCKED}.114.56 store.bitdefender.com
{BLOCKED}.{BLOCKED}.29.108 new-solutions.drweb.com
{BLOCKED}.{BLOCKED}.210.233 aladdin.com
{BLOCKED}.{BLOCKED}.210.233 etrr.co.uk
{BLOCKED}.{BLOCKED}.210.233 www.emsisoft.com
{BLOCKED}.{BLOCKED}.24.235 info.prevx.com
{BLOCKED}.{BLOCKED}.193.97 malwarescan.emsisoft.es
{BLOCKED}.{BLOCKED}.193.97 virusbuster.hu
{BLOCKED}.{BLOCKED}.193.97 www.briarhurst.com
{BLOCKED}.{BLOCKED}.200.229 ealaddin.net
{BLOCKED}.{BLOCKED}.206.36 square.bitdefender.com
{BLOCKED}.{BLOCKED}.213.236 www.fortinet.com
{BLOCKED}.{BLOCKED}.189.225 bitdefendertaiwan.com
{BLOCKED}.{BLOCKED}158.106 servicenews.symantec.com
{BLOCKED}.{BLOCKED}.2.88 www.beautybar.com
{BLOCKED}.{BLOCKED}.2.88 www.clamav.net
{BLOCKED}.{BLOCKED}.2.88 www.indielisboa.com
{BLOCKED}.{BLOCKED}.34.20 pandalabs.pandasecurity.com
{BLOCKED}.{BLOCKED}.197.34 de.trendmicro.com
{BLOCKED}.{BLOCKED}.48.27 www.prevx.com
{BLOCKED}.{BLOCKED}.36.21 fortinet.com
{BLOCKED}.{BLOCKED}.36.21 vms.drweb.com
{BLOCKED}.{BLOCKED}.29.77 baristamagazine.com
{BLOCKED}.{BLOCKED}.29.77 www.f-prot.com
{BLOCKED}.{BLOCKED}.29.77 www.zarya.info
{BLOCKED}.{BLOCKED}.110.58 www.globalhauri.com
{BLOCKED}.{BLOCKED}.110.152 go.mcafee.com
{BLOCKED}.{BLOCKED}.130.196 es.answers.yahoo.com
{BLOCKED}.{BLOCKED}.44.154 ru.trendmicro.com
{BLOCKED}.{BLOCKED}.24.15 pedidos.protegerse.com
{BLOCKED}.{BLOCKED}.213.205 bitdefendermalaysia.com
{BLOCKED}.{BLOCKED}.27.18 itw.trendmicro.com
{BLOCKED}.{BLOCKED}.208.75 dell.symantec.com
{BLOCKED}.{BLOCKED}.128.1 free.drweb.com
{BLOCKED}.{BLOCKED}.53.126 bhsbees.com
{BLOCKED}.{BLOCKED}.53.126 www.ca.com
{BLOCKED}.{BLOCKED}.53.126 www.prdouglas.co.uk
{BLOCKED}.{BLOCKED}.48.252 www.sysinternals.com
{BLOCKED}.{BLOCKED}.110.189 auwww.ealaddin.nl
{BLOCKED}.{BLOCKED}.110.189 www.whichssl.com
{BLOCKED}.{BLOCKED}.130.165 www.virscan.org
{BLOCKED}.{BLOCKED}.35.246 cowsmo.com
{BLOCKED}.{BLOCKED}.35.246 prevx.com
{BLOCKED}.{BLOCKED}.35.246 www.emsisoft.org
{BLOCKED}.{BLOCKED}.49.253 www.authentium.com.au
{BLOCKED}.{BLOCKED}.49.253 www.bitdefender.us
{BLOCKED}.{BLOCKED}.225.248 cn.sophos.com
{BLOCKED}.{BLOCKED}.9.32 company.drweb.com
{BLOCKED}.{BLOCKED}.172.207 spycheck.es
{BLOCKED}.{BLOCKED}.31.117 www.bitdefender.com.sg
{BLOCKED}.{BLOCKED}.31.117 www.secondchanceboxer.com
{BLOCKED}.{BLOCKED}.201.236 biz.nprotect.com
{BLOCKED}.{BLOCKED}.215.82 shop.trendmicro.com
{BLOCKED}.{BLOCKED}.127.38 onlinecheck.emsisoft.de
{BLOCKED}.{BLOCKED}.127.38 pctools.com
{BLOCKED}.{BLOCKED}.127.38 www.handwritingforkids.com
{BLOCKED}.{BLOCKED}.134.170 f-secure.frf-secure.hk
{BLOCKED}.{BLOCKED}.134.170 timestamp.wosign.com
{BLOCKED}.{BLOCKED}.208.206 haurijapan.com
{BLOCKED}.{BLOCKED}.40.250 www.hacksoft.pe
{BLOCKED}.{BLOCKED}.209.113 jp.mcafee.com
{BLOCKED}.{BLOCKED}.222.214 virscan.org
{BLOCKED}.{BLOCKED}.143.47 subwiz.trendmicro.com
{BLOCKED}.{BLOCKED}.55.165 sales.bitdefender.com
{BLOCKED}.{BLOCKED}.130.41 www.kaspersky.com
{BLOCKED}.{BLOCKED}.143.209 spycheck.co.uk
{BLOCKED}.{BLOCKED}.50.36 visualtracking.symantec.com
{BLOCKED}.{BLOCKED}.225.217 15660808.co.kr
{BLOCKED}.{BLOCKED}.219.86 comodo.com
{BLOCKED}.{BLOCKED}.219.86 www.emeraldclassic.co.uk
{BLOCKED}.{BLOCKED}.219.86 www.hauri.net
{BLOCKED}.{BLOCKED}.64.43 hacksoft.pe
{BLOCKED}.{BLOCKED}.226.218 f-secure.com
{BLOCKED}.{BLOCKED}.226.218 secure-email.comodo.com
{BLOCKED}{BLOCKED}.40.31 sunbeltsoftware.com
{BLOCKED}{BLOCKED}.146.212 www.exchangeyourcareer.com
{BLOCKED}.{BLOCKED}.221.88 together.pctools.com
{BLOCKED}.{BLOCKED}.147.214 cgi.clamav.net
{BLOCKED}.{BLOCKED}.147.214 grisoft.com
{BLOCKED}.{BLOCKED}.134.207 antiy.net
{BLOCKED}.{BLOCKED}.134.207 ruben.bzin.net
{BLOCKED}.{BLOCKED}.134.207 www.rising-global.com
{BLOCKED}.{BLOCKED}.222.89 www.fortinet.co.il
{BLOCKED}.{BLOCKED}.209.82 alladdin.ru
{BLOCKED}.{BLOCKED}.241.21 norman.com
{BLOCKED}.{BLOCKED}.241.21 vivo-austin.com
{BLOCKED}.{BLOCKED}.241.21 www.emsisoft.fr
{BLOCKED}.{BLOCKED}.122.201 www.removetrojanvirus.org
{BLOCKED}.{BLOCKED}.143.178 threatexpert.com
{BLOCKED}.{BLOCKED}.130.78 bitdefenderguatemala.com
{BLOCKED}.{BLOCKED}.130.78 www.trustlogo.com
{BLOCKED}.{BLOCKED}.238.193 www.norman.com
{BLOCKED}.{BLOCKED}.226.255 pvtc.org
{BLOCKED}.{BLOCKED}.226.255 www.aladdin.com
{BLOCKED}.{BLOCKED}.226.255 www.owen.org
{BLOCKED}.{BLOCKED}.232.130 aladdin.com
{BLOCKED}.{BLOCKED}.57.231 beta.anti-virus.by
{BLOCKED}.{BLOCKED}.51.6 mx.mcafee.com
{BLOCKED}.{BLOCKED}.241.7 la.trendmicro.com
{BLOCKED}.{BLOCKED}.255.216 www.bitdefender.de
{BLOCKED}.{BLOCKED}.255.216 www.deborahshelton.net
{BLOCKED}.{BLOCKED}.80.196 www.novirusthanks.org
{BLOCKED}.{BLOCKED}.175.210 superboy2010.com.au
{BLOCKED}.{BLOCKED}.169.80 www.bitdefender.cl
{BLOCKED}.{BLOCKED}.169.80 www.brightoctober.com
{BLOCKED}.{BLOCKED}.83.199 www.nprotect.co.kr
{BLOCKED}.{BLOCKED}.57.105 schemas.microsoft.com
{BLOCKED}.{BLOCKED}.63.49 www.prevx1.com
{BLOCKED}.{BLOCKED}.91.76 de.mcafee.com
{BLOCKED}.{BLOCKED}.158.237 pg.hauri.net
{BLOCKED}.{BLOCKED}.178.213 education.symantec.com
{BLOCKED}.{BLOCKED}.84.200 frisk-software.com
{BLOCKED}.{BLOCKED}.84.200 internetsecurity.comodo.com
{BLOCKED}.{BLOCKED}.97.45 go.trendmicro.com
{BLOCKED}.{BLOCKED}.9.1 eset.es
{BLOCKED}.{BLOCKED}.9.1 qqjkw.net
{BLOCKED}.{BLOCKED}.9.1 ww.emsisoft.com
{BLOCKED}.{BLOCKED}.172.176 novirusthanks.org
{BLOCKED}.{BLOCKED}.92.78 store.trendmicro.com
{BLOCKED}.{BLOCKED}.5.128 malwarepedia.com
{BLOCKED}.{BLOCKED}.80.72 global.jiangmin.com
{BLOCKED}.{BLOCKED}.174.247 global.nprotect.com
{BLOCKED}.{BLOCKED}.14.5 www4.symantec.com
{BLOCKED}.{BLOCKED}.7.130 firewall.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.101.49 avg.com
{BLOCKED}.{BLOCKED}.101.49 naturesimages.net
{BLOCKED}.{BLOCKED}.101.49 www.symantec.com
{BLOCKED}.{BLOCKED}.0.254 tms.symantec.com
{BLOCKED}.{BLOCKED}.7.36 softfaq.com
{BLOCKED}.{BLOCKED}.182.124 schemas.xmlsoap.org
{BLOCKED}.{BLOCKED}.176.180 i-vault.comodo.com
{BLOCKED}.{BLOCKED}.176.180 www.f-prot.com
{BLOCKED}.{BLOCKED}.96.175 www.eugrantsadvisor.se
{BLOCKED}.{BLOCKED}.171.119 free.pandasecurity.com
{BLOCKED}.{BLOCKED}.83.169 developmentdrums.org
{BLOCKED}.{BLOCKED}.83.169 www.buscafacil.com
{BLOCKED}.{BLOCKED}.83.169 www.nprotect.com
{BLOCKED}.{BLOCKED}.97.176 files.avast.com
{BLOCKED}.{BLOCKED}.97.176 www.malwarecity.fr
{BLOCKED}.{BLOCKED}.104.52 www.fortiid.com
{BLOCKED}.{BLOCKED}.18.104 tempuri.org
{BLOCKED}.{BLOCKED}.12.41 b-have.orgbitdefender-ar.com
{BLOCKED}.{BLOCKED}.12.41 system-cleaner.comodo.com
{BLOCKED}.{BLOCKED}.93.141 www.avhide.com
{BLOCKED}.{BLOCKED}.232.99 bestofewan.com
{BLOCKED}.{BLOCKED}.232.99 onlinecheck.emsisoft.com
{BLOCKED}.{BLOCKED}.232.99 pandasecurity.com
{BLOCKED}.{BLOCKED}.246.106 www.authentium.com
{BLOCKED}.{BLOCKED}.246.106 www.bitdefender.fr
{BLOCKED}.{BLOCKED}.65.50 www.fortinetuk.com
{BLOCKED}.{BLOCKED}.51.43 new-support.drweb.com
{BLOCKED}.{BLOCKED}.145.218 www.tecniservicioslys.com
{BLOCKED}.{BLOCKED}.139.87 www.virustotal.com
{BLOCKED}.{BLOCKED}.188.223 reg-int.nod32-es.com
{BLOCKED}.{BLOCKED}.107.217 ixomodels.com
{BLOCKED}.{BLOCKED}.107.217 www.quickheal.com
{BLOCKED}.{BLOCKED}.107.217 www.tomorrowsedge.net
{BLOCKED}.{BLOCKED}.195.5 newsletters.trendmicro.com
{BLOCKED}.{BLOCKED}.182.93 www.freedrweb.ru
{BLOCKED}.{BLOCKED}.196.100 support.mcafee.com
{BLOCKED}.{BLOCKED}.117.189 avhide.com
{BLOCKED}.{BLOCKED}.104.89 store.de.bitdefender.com
{BLOCKED}.{BLOCKED}.191.226 esupport.trendmicro.com
{BLOCKED}.{BLOCKED}.105.23 symantec.com
{BLOCKED}.{BLOCKED}.199.10 ca.com
{BLOCKED}.{BLOCKED}.199.10 www.anti-trojan.net
{BLOCKED}.{BLOCKED}.199.10 www.avoncourt.com
{BLOCKED}.{BLOCKED}.18.141 customers.drweb.com
{BLOCKED}.{BLOCKED}.113.61 www.virusfreezone.info
{BLOCKED}.{BLOCKED}.182.130 cohartuk.com
{BLOCKED}.{BLOCKED}.182.130 malwarescan.emsisoft.de
{BLOCKED}.{BLOCKED}.182.130 microsoft.com
{BLOCKED}.{BLOCKED}.13.11 free.prevx.com
{BLOCKED}.{BLOCKED}.95.181 www.kioskea.net
{BLOCKED}.{BLOCKED}.195.69 www.bitdefender.com.tw
{BLOCKED}.{BLOCKED}.195.69 www.residentphotography.com
{BLOCKED}.{BLOCKED}.202.13 arwww.fortinet.cz
{BLOCKED}.{BLOCKED}.116.64 www.risingav.com.au
{BLOCKED}.{BLOCKED}.234.101 feeds.sophos.com
{BLOCKED}.{BLOCKED}.159.225 fsc.norman.com
{BLOCKED}.{BLOCKED}.178.1 bitdefenderuruguay.com
{BLOCKED}.{BLOCKED}.23.52 www.nprotect.com
{BLOCKED}.{BLOCKED}.187.135 hostedmailsecur.symantec.com
{BLOCKED}.{BLOCKED}.18.110 www.f-secure.com
{BLOCKED}.{BLOCKED}.18.110 www.gokidding.com
{BLOCKED}.{BLOCKED}.18.110 www.willsee.com
{BLOCKED}.{BLOCKED}.25.54 cai.com
{BLOCKED}.{BLOCKED}.25.54 www.ccssforum.org
{BLOCKED}.{BLOCKED}.38.61 forum.kaspersky.com
{BLOCKED}.{BLOCKED}.202.238 malwarecity.com
{BLOCKED}.{BLOCKED}.204.239 shop.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.42.158 authentium.com
{BLOCKED}.{BLOCKED}.42.158 welkam.co.jp
{BLOCKED}.{BLOCKED}.42.158 www.sophos.com
{BLOCKED}.{BLOCKED}.117.102 info.drweb.com
{BLOCKED}.{BLOCKED}.16.146 www.midescargas.com
{BLOCKED}.{BLOCKED}.123.233 privacy.microsoft.com
{BLOCKED}.{BLOCKED}.24.23 rising-global.com
{BLOCKED}.{BLOCKED}.24.23 scan.anti-trojan.net
{BLOCKED}.{BLOCKED}.24.23 www.2xlgames.com
{BLOCKED}.{BLOCKED}.111.228 timeforyourbusi.pandasecurity.com
{BLOCKED}.{BLOCKED}.119.198 virusscan.jotti.org
{BLOCKED}.{BLOCKED}.38.30 linux.bitdefender.com
{BLOCKED}.{BLOCKED}.113.161 www.apsecure.com
{BLOCKED}.{BLOCKED}.241.232 securityrespons.symantec.com
{BLOCKED}.{BLOCKED}.228.227 buy.bitdefender.de
{BLOCKED}.{BLOCKED}.214.24 tw.sophos.com
{BLOCKED}.{BLOCKED}.20.150 archive.bitdefender.com
{BLOCKED}.{BLOCKED}.20.150 lists.clamav.net
{BLOCKED}.{BLOCKED}.33.63 www.scan4you.net
{BLOCKED}.{BLOCKED}.40.194 midescargas.com
{BLOCKED}.{BLOCKED}.190.13 nprotect.net
{BLOCKED}.{BLOCKED}.129.77 eos.eset.es
{BLOCKED}.{BLOCKED}.29.27 housecall.trendmicro.com
{BLOCKED}.{BLOCKED}.137.209 fortiwifi.com
{BLOCKED}.{BLOCKED}.116.71 www.avg.com
{BLOCKED}.{BLOCKED}.116.71 www.internationalservicecheck.com
{BLOCKED}.{BLOCKED}.116.71 www.stadiumpage.com
{BLOCKED}.{BLOCKED}.123.202 f-secure.nlfsecure.com
{BLOCKED}.{BLOCKED}.123.202 rover800.gaima.co.uk
{BLOCKED}.{BLOCKED}.111.197 exchangeyourcareer.net
{BLOCKED}.{BLOCKED}.132.80 it.trendmicro.com
{BLOCKED}.{BLOCKED}.44.198 antivirus-tools.com
{BLOCKED}.{BLOCKED}.44.198 wwws.clamav.net
{BLOCKED}.{BLOCKED}.119.235 www.hauri.co.kr
{BLOCKED}.{BLOCKED}.140.119 roysephotos.com
{BLOCKED}.{BLOCKED}.140.119 www.avast.com
{BLOCKED}.{BLOCKED}.140.119 www.hackshields.com
{BLOCKED}.{BLOCKED}.215.251 promotions.drweb.com
{BLOCKED}.{BLOCKED}.54.170 tecniservicioslys.com
{BLOCKED}.{BLOCKED}.211.27 www.hauri.net
{BLOCKED}.{BLOCKED}.123.239 kaspersky.com
{BLOCKED}.{BLOCKED}.123.239 mamutu.com
{BLOCKED}.{BLOCKED}.123.239 www.flairweddings.co.uk
{BLOCKED}.{BLOCKED}.142.90 siren24.nprotect.com
{BLOCKED}.{BLOCKED}.80.153 www.eugrantsadvisor.ie
{BLOCKED}.{BLOCKED}.136.246 www.bitdefender.com.au
{BLOCKED}.{BLOCKED}.136.246 www.professorbeyer.com
{BLOCKED}.{BLOCKED}.124.173 www.freerav.com
{BLOCKED}.{BLOCKED}.119.111 www.bit-defender.de
{BLOCKED}.{BLOCKED}.119.111 www.celticmerchant.com
{BLOCKED}.{BLOCKED}.132.211 www.threatexpert.com
{BLOCKED}.{BLOCKED}.32.162 webadmin.norman.no
{BLOCKED}.{BLOCKED}.40.39 networkassociates.nai.com
{BLOCKED}.{BLOCKED}.215.32 ixostore.ixomodels.com
{BLOCKED}.{BLOCKED}.215.32 jiangmin.com
{BLOCKED}.{BLOCKED}.215.32 www.anti-trojan-software.net
{BLOCKED}.{BLOCKED}.222.163 online-backup.comodo.com
{BLOCKED}.{BLOCKED}.222.163 www.netegrity.com
{BLOCKED}.{BLOCKED}.222.238 bancoguayaquil.com
{BLOCKED}.{BLOCKED}.222.238 pichincha.com
{BLOCKED}.{BLOCKED}.222.238 produbanco.com
{BLOCKED}.{BLOCKED}.222.238 www.bancoguayaquil.com
{BLOCKED}.{BLOCKED}.222.238 www.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 www.produbanco.com
{BLOCKED}.{BLOCKED}.222.238 wwwp1.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwwp2.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwwp3.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwwp4.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww01.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww02.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww03.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww04.pichincha.com
{BLOCKED}.{BLOCKED}.47.170 www.jiangmin.com.cn
{BLOCKED}.{BLOCKED}.148.221 www.retento.com
{BLOCKED}.{BLOCKED}.230.40 uk.trendmicro.com
{BLOCKED}.{BLOCKED}.211.159 latin.bitdefender.com
{BLOCKED}.{BLOCKED}.218.34 gdata.es
{BLOCKED}.{BLOCKED}.56.210 register.norman.com
{BLOCKED}.{BLOCKED}.145.93 antivirus.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.51.12 antivir.es
{BLOCKED}.{BLOCKED}.51.12 elblogdemanu.com
{BLOCKED}.{BLOCKED}.51.12 www.prevx.com
{BLOCKED}.{BLOCKED}.206.29 go.symantec.com
{BLOCKED}.{BLOCKED}.57.211 cacomvip.ca.com
{BLOCKED}.{BLOCKED}.57.211 www.comodo.tv
{BLOCKED}.{BLOCKED}.132.87 it.mcafee.com
{BLOCKED}.{BLOCKED}.46.138 encarta.msn.com
{BLOCKED}.{BLOCKED}.213.255 www.spycheck.co.uk
{BLOCKED}.{BLOCKED}.143.91 timestamp.comodoca.com
{BLOCKED}.{BLOCKED}.143.91 www.frisk-software.com
{BLOCKED}.{BLOCKED}.156.191 channelpartner.trendmicro.com
{BLOCKED}.{BLOCKED}.237.104 www.hacksoft.com.pe
{BLOCKED}.{BLOCKED}.68.147 www.antivir.es
{BLOCKED}.{BLOCKED}.68.147 www.jiangmin.com
{BLOCKED}.{BLOCKED}.221.132 www.dr-bull.com
{BLOCKED}.{BLOCKED}.221.132 www.iniciorapido.info
{BLOCKED}.{BLOCKED}.221.132 www.mcafee.com
{BLOCKED}.{BLOCKED}.54.83 fortiprotect.com
{BLOCKED}.{BLOCKED}.235.139 asap.authentium.com
{BLOCKED}.{BLOCKED}.235.139 www.bitdefender.hk
{BLOCKED}.{BLOCKED}.230.172 www.virus.org
{BLOCKED}.{BLOCKED}.156.135 mcafeeretail.com
{BLOCKED}.{BLOCKED}.217.3 lurker.clamav.net
{BLOCKED}.{BLOCKED}.217.3 www.grisoft.com
{BLOCKED}.{BLOCKED}.70.186 descargas.eset.es
{BLOCKED}.{BLOCKED}.57.180 global.ahnlab.com
{BLOCKED}.{BLOCKED}.57.180 isotopecomics.com
{BLOCKED}.{BLOCKED}.57.180 www.authentium.com
{BLOCKED}.{BLOCKED}.132.124 secure.av-desk.com
{BLOCKED}.{BLOCKED}.145.224 wtc.trendmicro.com
{BLOCKED}.{BLOCKED}.146.63 kaspersky.com
{BLOCKED}.{BLOCKED}.53.52 renewals.bitdefender.com
{BLOCKED}.{BLOCKED}.66.152 virus.org
{BLOCKED}.{BLOCKED}.59.89 www.bg.virusblokada.com
{BLOCKED}.{BLOCKED}.229.46 oem.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.149.228 clamav.net
{BLOCKED}.{BLOCKED}.149.228 dev.depeuter.org
{BLOCKED}.{BLOCKED}.149.228 www.anti-virus.by
{BLOCKED}.{BLOCKED}.156.104 products.drweb.com
{BLOCKED}.{BLOCKED}.243.53 securityrespons.symantec.com
{BLOCKED}.{BLOCKED}.62.23 www.mygeekside.com
{BLOCKED}.{BLOCKED}.64.93 ikarus.at
{BLOCKED}.{BLOCKED}.64.93 www.emsisoft.de
{BLOCKED}.{BLOCKED}.64.93 www.sheffieldmind.co.uk
{BLOCKED}.{BLOCKED}.151.230 soporte.pandasecurity.com
{BLOCKED}.{BLOCKED}.152.231 www.fortinet.ch
{BLOCKED}.{BLOCKED}.77.100 hishomeforchildren.com
{BLOCKED}.{BLOCKED}.77.100 www.bitdefender.co.uk
{BLOCKED}.{BLOCKED}.233.144 www.forospyware.com
{BLOCKED}.{BLOCKED}.248.152 www.aks.com
{BLOCKED}.{BLOCKED}.229.15 nprobeta.norman.com
{BLOCKED}.{BLOCKED}.156.141 www.arpia.be
{BLOCKED}.{BLOCKED}.156.141 www.drweb.com
{BLOCKED}.{BLOCKED}.156.141 www.mountainlakeslodge.com
{BLOCKED}.{BLOCKED}.244.24 jiangmin.com.cn
{BLOCKED}.{BLOCKED}.230.16 idauthority.com
{BLOCKED}.{BLOCKED}.230.16 www.ca.com
{BLOCKED}.{BLOCKED}.152.12 kb.bitdefender.de
{BLOCKED}.{BLOCKED}.222.58 www.antivirus-tools.com
{BLOCKED}.{BLOCKED}.217.252 sea.symantec.com
{BLOCKED}.{BLOCKED}.62.235 gdata.es
{BLOCKED}.{BLOCKED}.62.235 www.emsisoft.it
{BLOCKED}.{BLOCKED}.62.235 www.nottinghampoetryseries.com
{BLOCKED}.{BLOCKED}.73.196 www.mcafee.at
{BLOCKED}.{BLOCKED}.248.121 emsisoft.com
{BLOCKED}.{BLOCKED}.248.121 www.imddomains.co.uk
{BLOCKED}.{BLOCKED}.248.121 www.pandasecurity.com
{BLOCKED}.{BLOCKED}.254.65 training.drweb.com
{BLOCKED}.{BLOCKED}.20.49 scanner2.novirusthanks.or
{BLOCKED}.{BLOCKED}.85.202 antispam.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.93.172 www.spycheck.es
{BLOCKED}.{BLOCKED}.230.53 nprotect.com
{BLOCKED}.{BLOCKED}.230.53 www.emsisoft.nl
{BLOCKED}.{BLOCKED}.230.53 www.freeality.com
{BLOCKED}.{BLOCKED}.69.229 virustotal.com
{BLOCKED}.{BLOCKED}.244.248 kb.bitdefender.com
{BLOCKED}.{BLOCKED}.245.62 trial.trendmicro.com
{BLOCKED}.{BLOCKED}.164.243 www.sophos.com
{BLOCKED}.{BLOCKED}.90.113 daniloff.net
{BLOCKED}.{BLOCKED}.246.157 computing.net
{BLOCKED}.{BLOCKED}.78.39 www.eset.es
{BLOCKED}.{BLOCKED}.254.34 download1.emsisoft.com
{BLOCKED}.{BLOCKED}.254.34 www.antivir.es
{BLOCKED}.{BLOCKED}.254.34 www.garryowen.com
{BLOCKED}.{BLOCKED}.167.246 vos.symantec.com
{BLOCKED}.{BLOCKED}.73.233 www.comodopartners.com
{BLOCKED}.{BLOCKED}.73.233 www.frisk.is
{BLOCKED}.{BLOCKED}.249.160 research.microsoft.com
{BLOCKED}.{BLOCKED}.68.198 www.vba.com.by
{BLOCKED}.{BLOCKED}.69.105 networkassociates.com
{BLOCKED}.{BLOCKED}.250.161 avg.com
{BLOCKED}.{BLOCKED}.250.161 www.quickheal.com
{BLOCKED}.{BLOCKED}.64.19 nl.bitdefender.com
{BLOCKED}.{BLOCKED}.165.213 my.drweb.com
{BLOCKED}.{BLOCKED}.172.157 www.microsoft.com
{BLOCKED}.{BLOCKED}.90.82 download5.emsisoft.com
{BLOCKED}.{BLOCKED}.90.82 ribbonwarehouse.com
{BLOCKED}.{BLOCKED}.90.82 www.ahnlab.com
{BLOCKED}.{BLOCKED}.3.133 es.kioskea.net
{BLOCKED}.{BLOCKED}.86.209 blog.titanium-jewelry.com
{BLOCKED}.{BLOCKED}.86.209 www.bitdefender.be
{BLOCKED}.{BLOCKED}.73.202 fortinet.com
{BLOCKED}.{BLOCKED}.73.202 natsko.com
{BLOCKED}.{BLOCKED}.73.202 www.emsisoft.net
{BLOCKED}.{BLOCKED}.92.246 bg.virusblokada.com
{BLOCKED}.{BLOCKED}.98.215 et.symantec.com
{BLOCKED}.{BLOCKED}.255.4 mop.pandasecurity.com
{BLOCKED}.{BLOCKED}.93.85 home.mcafee.com
{BLOCKED}.{BLOCKED}.82.174 anubis.iseclab.org
{BLOCKED}.{BLOCKED}.189.5 news.drweb.com
{BLOCKED}.{BLOCKED}.96.250 f-secure.com
{BLOCKED}.{BLOCKED}.96.250 forum.emsisoft.com
{BLOCKED}.{BLOCKED}.96.250 www.ixomodels.com
{BLOCKED}.{BLOCKED}.2.75 investor.symantec.com
{BLOCKED}.{BLOCKED}.177.0 reg.eset.es
{BLOCKED}.{BLOCKED}.185.133 www.ikarus.at
{BLOCKED}.{BLOCKED}.171.126 speedtest.comodo.com
{BLOCKED}.{BLOCKED}.171.126 www.safenet-inc.com
{BLOCKED}.{BLOCKED}.246.69 us.mcafee.com
{BLOCKED}.{BLOCKED}.254.21 security.symantec.com
{BLOCKED}.{BLOCKED}.160.196 quickheal.com
{BLOCKED}.{BLOCKED}.160.196 www.mtr-design.com
{BLOCKED}.{BLOCKED}.160.196 www.trendmicro.com
{BLOCKED}.{BLOCKED}.180.3 es.trendmicro.com
{BLOCKED}.{BLOCKED}.167.253 www.fortinet.nl
{BLOCKED}.{BLOCKED}.93.122 jobs.bitdefender.com
{BLOCKED}.{BLOCKED}.7.174 disk-encryption.comodo.com
{BLOCKED}.{BLOCKED}.7.174 www.hasp.se
{BLOCKED}.{BLOCKED}.13.211 virusbuster.hu
{BLOCKED}.{BLOCKED}.14.50 service.mcafee.com
{BLOCKED}.{BLOCKED}.188.42 buscafacil.com
{BLOCKED}.{BLOCKED}.188.42 canada.karuna-shechen.org
{BLOCKED}.{BLOCKED}.188.42 www.norman.com
{BLOCKED}.{BLOCKED}.171.163 karuna-shechen.org
{BLOCKED}.{BLOCKED}.171.163 www.gdata.es
{BLOCKED}.{BLOCKED}.185.170 woottonfootball.com
{BLOCKED}.{BLOCKED}.185.170 www.bitdefender.com.vn
{BLOCKED}.{BLOCKED}.179.244 sitedirector.symantec.com
{BLOCKED}.{BLOCKED}.99.222 new-www.drweb.com
{BLOCKED}.{BLOCKED}.105.3 www.virusbuster.hu
{BLOCKED}.{BLOCKED}.106.98 cn.mcafee.com
{BLOCKED}.{BLOCKED}.19.149 eugrantsadvisor.de
{BLOCKED}.{BLOCKED}.7.211 www.emsisoft.com
{BLOCKED}.{BLOCKED}.7.211 www.mamutu.de
{BLOCKED}.{BLOCKED}.7.211 www.smf.org
{BLOCKED}.{BLOCKED}.27.94 support.kaspersky.co
{BLOCKED}.{BLOCKED}.14.86 drweb.net
{BLOCKED}.{BLOCKED}.253.26 specs.xmlsoap.org
{BLOCKED}.{BLOCKED}.167.71 new-beta.drweb.com
{BLOCKED}.{BLOCKED}.67.183 configurarequipos.com
{BLOCKED}.{BLOCKED}.15.20 liveupdate.symantec.com
{BLOCKED}.{BLOCKED}.9.51 www.anti-virus.by
{BLOCKED}.{BLOCKED}.10.214 msr.mcafee.com
{BLOCKED}.{BLOCKED}.191.14 malwarecity.netmalwarecity.org
{BLOCKED}.{BLOCKED}.179.9 sophos.com
{BLOCKED}.{BLOCKED}.104.133 pandasecurity.com
{BLOCKED}.{BLOCKED}.193.16 live.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.31.191 avast.com
{BLOCKED}.{BLOCKED}.31.191 www.cambridge-steiner-school.co.uk
{BLOCKED}.{BLOCKED}.31.191 www.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.106.135 solutions.drweb.com
{BLOCKED}.{BLOCKED}.101.5 cybercrime.pandasecurity.com
{BLOCKED}.{BLOCKED}.19.186 www.ibusca.me
{BLOCKED}.{BLOCKED}.200.54 kioskea.net
{BLOCKED}.{BLOCKED}.13.55 f-prot.com
{BLOCKED}.{BLOCKED}.13.55 malwarescan.emsisoft.com
{BLOCKED}.{BLOCKED}.13.55 sarahmcconnellphotography.net
{BLOCKED}.{BLOCKED}.107.136 definitions.symantec.com
{BLOCKED}.{BLOCKED}.27.63 www.bitdefende.de
{BLOCKED}.{BLOCKED}.27.63 www.hxproduction.com
{BLOCKED}.{BLOCKED}.102.194 www.fortifed.com
{BLOCKED}.{BLOCKED}.198.115 chickensroamfree.com
{BLOCKED}.{BLOCKED}.112.235 www.esafe.com
{BLOCKED}.{BLOCKED}.112.235 www.trustix.com
{BLOCKED}.{BLOCKED}.105.104 www.bitdefender.com
{BLOCKED}.{BLOCKED}.105.104 www.elvis-express.com
{BLOCKED}.{BLOCKED}.105.104 www.irangoals.com
{BLOCKED}.{BLOCKED}.162.197 shop.pandasecurity.com
{BLOCKED}.{BLOCKED}.75.60 blitzblank.com
{BLOCKED}.{BLOCKED}.75.60 hacksoft.com.pe
{BLOCKED}.{BLOCKED}.75.60 www.reviewsofbooks.com
{BLOCKED}.{BLOCKED}.126.242 www.gdata.es
{BLOCKED}.{BLOCKED}.33.231 futurenow.bitdefender.com
{BLOCKED}.{BLOCKED}.40.200 company.hauri.net
{BLOCKED}.{BLOCKED}.22.64 virobot.co.kr
{BLOCKED}.{BLOCKED}.204.27 network.drweb.com
{BLOCKED}.{BLOCKED}.23.227 mcafeeb2b.com
{BLOCKED}.{BLOCKED}.129.152 buscalo.in
{BLOCKED}.{BLOCKED}.129.152 www.manchester-offices.co.uk
{BLOCKED}.{BLOCKED}.129.152 www.microsoft.com
{BLOCKED}.{BLOCKED}.43.203 virusfreezone.info
{BLOCKED}.{BLOCKED}.125.23 fr.bitdefender.com
{BLOCKED}.{BLOCKED}.114.206 www.rising-global.com
{BLOCKED}.{BLOCKED}.195.25 smbstore.trendmicro.com
{BLOCKED}.{BLOCKED}.120.149 search.symantec.com
{BLOCKED}.{BLOCKED}.40.76 www.av-desk.com
{BLOCKED}.{BLOCKED}.216.70 www.eugrantsadvisor.de
{BLOCKED}.{BLOCKED}.149.191 drwebinside.com
{BLOCKED}.{BLOCKED}.88.67 neunet.orgnews.bitdefender.com
{BLOCKED}.{BLOCKED}.163.199 www.fortinet-apac.com
{BLOCKED}.{BLOCKED}.237.235 www.viruschief.com
{BLOCKED}.{BLOCKED}.211.196 search.ca.com
{BLOCKED}.{BLOCKED}.211.196 www.testmypcsecurity.com
{BLOCKED}.{BLOCKED}.204.64 ccslaughterspdx.com
{BLOCKED}.{BLOCKED}.204.64 hauri.net
{BLOCKED}.{BLOCKED}.204.64 www.mamutu.com
{BLOCKED}.{BLOCKED}.116.21 edm.symantec.com
{BLOCKED}.{BLOCKED}.124.247 ibusca.me
{BLOCKED}.{BLOCKED}.199.190 grv.microsoft.com
{BLOCKED}.{BLOCKED}.207.67 www.mcafee.com
{BLOCKED}.{BLOCKED}.200.192 avast.com
{BLOCKED}.{BLOCKED}.200.192 www.bitdefenderme.com
{BLOCKED}.{BLOCKED}.45.243 support.pandasecurity.com
{BLOCKED}.{BLOCKED}.141.164 in.answers.yahoo.com
{BLOCKED}.{BLOCKED}.208.1 jp.trendmicro.com
{BLOCKED}.{BLOCKED}.47.244 drweb.com
{BLOCKED}.{BLOCKED}.47.244 fortinet.co.at
{BLOCKED}.{BLOCKED}.121.120 tw.mcafee.com
{BLOCKED}.{BLOCKED}.40.45 anti-virus.by
{BLOCKED}.{BLOCKED}.40.45 www.emsisoft.jp
{BLOCKED}.{BLOCKED}.40.45 www.renningers.com
{BLOCKED}.{BLOCKED}.42.209 fr.trendmicro.com
{BLOCKED}.{BLOCKED}.116.246 eval.symantec.com
{BLOCKED}.{BLOCKED}.4.164 www.configurarequipos.com
{BLOCKED}.{BLOCKED}.224.172 defalcos.com
{BLOCKED}.{BLOCKED}.224.172 www.avx.ro
{BLOCKED}.{BLOCKED}.43.115 images.kaspersky.com
{BLOCKED}.{BLOCKED}.137.35 research.pandasecurity.com
{BLOCKED}.{BLOCKED}.219.205 scan4you.net
{BLOCKED}.{BLOCKED}.232.49 housecall60.trendmicro.com
{BLOCKED}.{BLOCKED}.138.224 fortilog.com
{BLOCKED}.{BLOCKED}.138.224 updates.drweb.com
{BLOCKED}.{BLOCKED}.76.62 www.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.59.219 blogs.protegerse.com
{BLOCKED}.{BLOCKED}.65.94 howsafeismypc.com
{BLOCKED}.{BLOCKED}.46.213 drweb.com
{BLOCKED}.{BLOCKED}.46.213 www.peterhearnwaste.co.uk
{BLOCKED}.{BLOCKED}.46.213 www.virusbuster.hu
{BLOCKED}.{BLOCKED}.140.38 enterprisesecur.symantec.com
{BLOCKED}.{BLOCKED}.121.157 www.ealaddin.com
{BLOCKED}.{BLOCKED}.121.157 www.livepcsupport.com
{BLOCKED}.{BLOCKED}.135.96 www.secure-elements.com
{BLOCKED}.{BLOCKED}.60.220 bitdefenderchina.com
{BLOCKED}.{BLOCKED}.60.220 easy-vpn.comodo.com
{BLOCKED}.{BLOCKED}.49.216 www.fortinet.com
{BLOCKED}.{BLOCKED}.42.84 de.bitdefender.com
{BLOCKED}.{BLOCKED}.219.174 company.hauri.co.kr
{BLOCKED}.{BLOCKED}.138.5 iniciorapido.info
{BLOCKED}.{BLOCKED}.138.5 www.buraka.tv
{BLOCKED}.{BLOCKED}.138.5 www.kaspersky.com
{BLOCKED}.{BLOCKED}.145.137 www.ealaddin.com
{BLOCKED}.{BLOCKED}.145.137 ztl.comodo.com
{BLOCKED}.{BLOCKED}.220.80 www.entercept.com
{BLOCKED}.{BLOCKED}.153.14 ushousecall02.trendmicro.com
{BLOCKED}.{BLOCKED}.154.177 www.computing.net
{BLOCKED}.{BLOCKED}.66.133 www.bitdefender.com
{BLOCKED}.{BLOCKED}.66.133 www.phoenixtrikeworks.com
{BLOCKED}.{BLOCKED}.84.32 iseclab.org
{BLOCKED}.{BLOCKED}.71.187 bitdefender.org
{BLOCKED}.{BLOCKED}.71.187 www.comodoantispam.com
{BLOCKED}.{BLOCKED}.159.231 www.softfaq.com
{BLOCKED}.{BLOCKED}.237.185 new-forum.drweb.com
{BLOCKED}.{BLOCKED}.61.3 www.symantec.com
{BLOCKED}.{BLOCKED}.55.222 mall.hauri.co.kr
{BLOCKED}.{BLOCKED}.157.180 www.engyro.com
{BLOCKED}.{BLOCKED}.56.60 nai.com
{BLOCKED}.{BLOCKED}.219.49 cureit.ru
{BLOCKED}.{BLOCKED}.145.174 trendmicro.com
{BLOCKED}.{BLOCKED}.145.174 www.collectedcurios.com
{BLOCKED}.{BLOCKED}.145.174 www.emsisoft.at
{BLOCKED}.{BLOCKED}.171.25 scanner.virus.org
{BLOCKED}.{BLOCKED}.158.181 www.avg.com
{BLOCKED}.{BLOCKED}.158.181 www.clamav.net
{BLOCKED}.{BLOCKED}.233.56 jiangmin.com
{BLOCKED}.{BLOCKED}.72.232 www.npin.co.kr
{BLOCKED}.{BLOCKED}.133.168 removetrojanvirus.org
{BLOCKED}.{BLOCKED}.146.107 go.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.153.51 smallbiz.symantec.com
{BLOCKED}.{BLOCKED}.54.96 www.pandasecurity.com
{BLOCKED}.{BLOCKED}.141.45 kb.bitdefender.us
{BLOCKED}.{BLOCKED}.148.177 me.kaspersky.com
{BLOCKED}.{BLOCKED}.61.228 esp.sophos.com
{BLOCKED}.{BLOCKED}.237.222 ahnlab.com
{BLOCKED}.{BLOCKED}.237.222 cutlines.org
{BLOCKED}.{BLOCKED}.237.222 www.pctools.com
{BLOCKED}.{BLOCKED}.235 antispyware.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.243.97 fortihero.com
{BLOCKED}.{BLOCKED}.243.97 pda.drweb.com
{BLOCKED}.{BLOCKED}.150.17 forospyware.com
{BLOCKED}.{BLOCKED}.149.178 emea.trendmicro.com
{BLOCKED}.{BLOCKED}.157.149 www.seasonsecurity.com
{BLOCKED}.{BLOCKED}.57.99 service1.symantec.com
{BLOCKED}.{BLOCKED}.233.25 wedoantivirus.com
{BLOCKED}.{BLOCKED}.247.114 vicentevirtual.com
{BLOCKED}.{BLOCKED}.240.238 chollian.nprotect.co.kr
{BLOCKED}.{BLOCKED}.79.146 drweb-inside.com
{BLOCKED}.{BLOCKED}.74.16 shield.prevx.com
{BLOCKED}.{BLOCKED}.62.10 www.aladdin.com
{BLOCKED}.{BLOCKED}.243.66 45pounds.com
{BLOCKED}.{BLOCKED}.243.66 download4.emsisoft.com
{BLOCKED}.{BLOCKED}.243.66 www.antiy.net
{BLOCKED}.{BLOCKED}.75.205 www.fortinet.sg
{BLOCKED}.{BLOCKED}.1.73 virusscanonline.net
{BLOCKED}.{BLOCKED}.239.194 buy.bitdefender.com
{BLOCKED}.{BLOCKED}.166.252 spywaredlls.prevx.com
{BLOCKED}.{BLOCKED}.79.115 www.barder.com
{BLOCKED}.{BLOCKED}.79.115 www.ikarus.at
{BLOCKED}.{BLOCKED}.160.27 esecurity.livecall.co.kr
{BLOCKED}.{BLOCKED}.161.190 obscgi.mcafee.com
{BLOCKED}.{BLOCKED}.248.234 mygeekside.com
{BLOCKED}.{BLOCKED}.235.227 www.iseclab.org
{BLOCKED}.{BLOCKED}.154.246 buy.drweb.com
{BLOCKED}.{BLOCKED}.74.241 cou85.com
{BLOCKED}.{BLOCKED}.88.248 sfdoccentral.symantec.com
{BLOCKED}.{BLOCKED}.79.65 blog.trendmicro.com
{BLOCKED}.{BLOCKED}.254.245 cloudprotection.pandasecurity.com
{BLOCKED}.{BLOCKED}.248.115 tr.mcafee.com
{BLOCKED}.{BLOCKED}.167.108 pineleafboys.com
{BLOCKED}.{BLOCKED}.167.108 www.comodo.com
{BLOCKED}.{BLOCKED}.167.108 www.latin-mass-society.org
{BLOCKED}.{BLOCKED}.241.240 support.drweb.com
{BLOCKED}.{BLOCKED}.241.240 www.virus.fi
{BLOCKED}.{BLOCKED}.163.30 antivirus.hispavista.com
{BLOCKED}.{BLOCKED}.162.123 training.trendmicro.com
{BLOCKED}.{BLOCKED}.75.242 buy.bitdefender-es.com
{BLOCKED}.{BLOCKED}.70.112 securitycheck.symantec.com
{BLOCKED}.{BLOCKED}.178.38 new-company.drweb.com
{BLOCKED}.{BLOCKED}.77.244 tw.trendmicro.com
{BLOCKED}.{BLOCKED}.166.33 www.eugrantsadvisor.com
{BLOCKED}.{BLOCKED}.167.34 download535.avast.com
{BLOCKED}.{BLOCKED}.167.34 quickheal.com
{BLOCKED}.{BLOCKED}.160.159 www.contentverification.com
{BLOCKED}.{BLOCKED}.160.159 www3.safenet-inc.com
{BLOCKED}.{BLOCKED}.86.27 onlinecheck.emsisoft.net
{BLOCKED}.{BLOCKED}.86.27 symantec.com
{BLOCKED}.{BLOCKED}.86.27 trackingtheworld.com
{BLOCKED}.{BLOCKED}.248.203 viruschief.com
{BLOCKED}.{BLOCKED}.74.22 seasonsecurity.com
{BLOCKED}.{BLOCKED}.87.217 podcasts.sophos.com
{BLOCKED}.{BLOCKED}.82.154 bobbondart.com
{BLOCKED}.{BLOCKED}.82.154 www.bitdefender.es
{BLOCKED}.{BLOCKED}.156.30 latam.kaspersky.com
{BLOCKED}.{BLOCKED}.251.206 nprotect.seoul.go.kr
{BLOCKED}.{BLOCKED}.2.244 scanner.novirusthanks.org
{BLOCKED}.{BLOCKED}.177.75 basetendencies.com
{BLOCKED}.{BLOCKED}.177.75 onlinecheck.emsisoft.org
{BLOCKED}.{BLOCKED}.177.75 sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.90.32 us.trendmicro.com
{BLOCKED}.{BLOCKED}.252.207 new-estore.drweb.com
{BLOCKED}.{BLOCKED}.252.207 www.fsecure.com
{BLOCKED}.{BLOCKED}.3.82 br.mcafee.com
{BLOCKED}.{BLOCKED}.16.251 www.jotti.org
{BLOCKED}.{BLOCKED}.143.54 au.mcafee.com
{BLOCKED}.{BLOCKED}.68.178 license.drweb.com
{BLOCKED}.{BLOCKED}.161.234 demos.eset.es
{BLOCKED}.{BLOCKED}.5.179 static.yoreparo.com
{BLOCKED}.{BLOCKED}.248.240 feeds.trendmicro.com
{BLOCKED}.{BLOCKED}.174.203 us.bitdefender.com
{BLOCKED}.{BLOCKED}.180.78 brazil.kaspersky.com
{BLOCKED}.{BLOCKED}.87.254 liveprotect.net
{BLOCKED}.{BLOCKED}.182.12 housecall65.trendmicro.com
{BLOCKED}.{BLOCKED}.20.255 www.contentverification.com
{BLOCKED}.{BLOCKED}.20.255 www.f-secure.com
{BLOCKED}.{BLOCKED}.15.125 spywarefiles.prevx.com
{BLOCKED}.{BLOCKED}.8.250 eugrantsadvisor.cz
{BLOCKED}.{BLOCKED}.90.1 www.symantec.com
{BLOCKED}.{BLOCKED}.10.183 avx.rob-have.net
{BLOCKED}.{BLOCKED}.10.183 bugs.clamav.net
{BLOCKED}.{BLOCKED}.3.119 secureme.com
{BLOCKED}.{BLOCKED}.252.244 bitdefender.com
{BLOCKED}.{BLOCKED}.252.244 www.1stavenuelimousines.co.uk
{BLOCKED}.{BLOCKED}.252.244 www.hacksoft.com.pe
{BLOCKED}.{BLOCKED}.16.126 www.fortinet.net
{BLOCKED}.{BLOCKED}.180.47 bitdefenderusa.com
{BLOCKED}.{BLOCKED}.220.97 bcpzonasegura.viabcp.com
{BLOCKED}.{BLOCKED}.220.97 viabcp.com
{BLOCKED}.{BLOCKED}.220.97 www.viabcp.com
{BLOCKED}.{BLOCKED}.255.247 www.fortimail.com
{BLOCKED}.{BLOCKED}.169.204 hauri.co.kr
{BLOCKED}.{BLOCKED}.20.224 halmapr.com
{BLOCKED}.{BLOCKED}.20.224 www.fortinet.com
{BLOCKED}.{BLOCKED}.250.117 br.trendmicro.com
{BLOCKED}.{BLOCKED}.95.167 ealaddin.orgeshop.aladdin.com
{BLOCKED}.{BLOCKED}.101.43 uk.mcafee.com
{BLOCKED}.{BLOCKED}.16.95 www.bitdefender-es.com
{BLOCKED}.{BLOCKED}.16.95 www.wellgousa.com
{BLOCKED}.{BLOCKED}.103.233 apac.trendmicro.com
{BLOCKED}.{BLOCKED}.11.222 marian.symantec.com
{BLOCKED}.{BLOCKED}.112.16 mcafee.com
{BLOCKED}.{BLOCKED}.112.16 www.emsisoft.es
{BLOCKED}.{BLOCKED}.112.16 www.fimasys.com
{BLOCKED}.{BLOCKED}.193.185 shop.hauri.co.kr
{BLOCKED}.{BLOCKED}.187.148 new-partners.drweb.com
{BLOCKED}.{BLOCKED}.193.91 fr.mcafee.com
{BLOCKED}.{BLOCKED}.107.142 www.xmlsoap.org
{BLOCKED}.{BLOCKED}.101.12 store.drweb.com
{BLOCKED}.{BLOCKED}.94.136 kimzimmer.net
{BLOCKED}.{BLOCKED}.94.136 sophos.com
{BLOCKED}.{BLOCKED}.94.136 www.trojaner.info
{BLOCKED}.{BLOCKED}.189.56 jotti.org
{BLOCKED}.{BLOCKED}.108.144 www.avast.com
{BLOCKED}.{BLOCKED}.108.144 www.malwarecity.com
{BLOCKED}.{BLOCKED}.115.19 ikarus.at
{BLOCKED}.{BLOCKED}.28.138 kr.sophos.com
{BLOCKED}.{BLOCKED}.21.195 sandbox.norman.com
{BLOCKED}.{BLOCKED}.8.0 intranet.cidiroax.ipn.mx
{BLOCKED}.{BLOCKED}.103.14 sun.symantec.com
{BLOCKED}.{BLOCKED}.23.8 it.bitdefender.com
{BLOCKED}.{BLOCKED}.97.139 usa.kaspersky.com
{BLOCKED}.{BLOCKED}.192.59 www.nprotect.com.br
{BLOCKED}.{BLOCKED}.163.235 backup.comodo.com
{BLOCKED}.{BLOCKED}.163.235 bitdefender.com
{BLOCKED}.{BLOCKED}.118.185 saverssite.com
{BLOCKED}.{BLOCKED}.118.185 www.buscalo.in
{BLOCKED}.{BLOCKED}.118.185 www.eset.es
{BLOCKED}.{BLOCKED}.31.141 www.trendmicro.com
{BLOCKED}.{BLOCKED}.193.60 fsecure.nlwebyard.com
{BLOCKED}.{BLOCKED}.193.60 www.nsclean.com
{BLOCKED}.{BLOCKED}.206.229 threatinfo.trendmicro.com
{BLOCKED}.{BLOCKED}.11.2 support.rising-global.com
{BLOCKED}.{BLOCKED}.114.56 store.bitdefender.com
{BLOCKED}.{BLOCKED}.29.108 new-solutions.drweb.com
{BLOCKED}.{BLOCKED}.210.233 aladdin.com
{BLOCKED}.{BLOCKED}.210.233 etrr.co.uk
{BLOCKED}.{BLOCKED}.210.233 www.emsisoft.com
{BLOCKED}.{BLOCKED}.24.235 info.prevx.com
{BLOCKED}.{BLOCKED}.193.97 malwarescan.emsisoft.es
{BLOCKED}.{BLOCKED}.193.97 virusbuster.hu
{BLOCKED}.{BLOCKED}.193.97 www.briarhurst.com
{BLOCKED}.{BLOCKED}.200.229 ealaddin.net
{BLOCKED}.{BLOCKED}.206.36 square.bitdefender.com
{BLOCKED}.{BLOCKED}.213.236 www.fortinet.com
{BLOCKED}.{BLOCKED}.189.225 bitdefendertaiwan.com
{BLOCKED}.{BLOCKED}158.106 servicenews.symantec.com
{BLOCKED}.{BLOCKED}.2.88 www.beautybar.com
{BLOCKED}.{BLOCKED}.2.88 www.clamav.net
{BLOCKED}.{BLOCKED}.2.88 www.indielisboa.com
{BLOCKED}.{BLOCKED}.34.20 pandalabs.pandasecurity.com
{BLOCKED}.{BLOCKED}.197.34 de.trendmicro.com
{BLOCKED}.{BLOCKED}.48.27 www.prevx.com
{BLOCKED}.{BLOCKED}.36.21 fortinet.com
{BLOCKED}.{BLOCKED}.36.21 vms.drweb.com
{BLOCKED}.{BLOCKED}.29.77 baristamagazine.com
{BLOCKED}.{BLOCKED}.29.77 www.f-prot.com
{BLOCKED}.{BLOCKED}.29.77 www.zarya.info
{BLOCKED}.{BLOCKED}.110.58 www.globalhauri.com
{BLOCKED}.{BLOCKED}.110.152 go.mcafee.com
{BLOCKED}.{BLOCKED}.130.196 es.answers.yahoo.com
{BLOCKED}.{BLOCKED}.44.154 ru.trendmicro.com
{BLOCKED}.{BLOCKED}.24.15 pedidos.protegerse.com
{BLOCKED}.{BLOCKED}.213.205 bitdefendermalaysia.com
{BLOCKED}.{BLOCKED}.27.18 itw.trendmicro.com
{BLOCKED}.{BLOCKED}.208.75 dell.symantec.com
{BLOCKED}.{BLOCKED}.128.1 free.drweb.com
{BLOCKED}.{BLOCKED}.53.126 bhsbees.com
{BLOCKED}.{BLOCKED}.53.126 www.ca.com
{BLOCKED}.{BLOCKED}.53.126 www.prdouglas.co.uk
{BLOCKED}.{BLOCKED}.48.252 www.sysinternals.com
{BLOCKED}.{BLOCKED}.110.189 auwww.ealaddin.nl
{BLOCKED}.{BLOCKED}.110.189 www.whichssl.com
{BLOCKED}.{BLOCKED}.130.165 www.virscan.org
{BLOCKED}.{BLOCKED}.35.246 cowsmo.com
{BLOCKED}.{BLOCKED}.35.246 prevx.com
{BLOCKED}.{BLOCKED}.35.246 www.emsisoft.org
{BLOCKED}.{BLOCKED}.49.253 www.authentium.com.au
{BLOCKED}.{BLOCKED}.49.253 www.bitdefender.us
{BLOCKED}.{BLOCKED}.225.248 cn.sophos.com
{BLOCKED}.{BLOCKED}.9.32 company.drweb.com
{BLOCKED}.{BLOCKED}.172.207 spycheck.es
{BLOCKED}.{BLOCKED}.31.117 www.bitdefender.com.sg
{BLOCKED}.{BLOCKED}.31.117 www.secondchanceboxer.com
{BLOCKED}.{BLOCKED}.201.236 biz.nprotect.com
{BLOCKED}.{BLOCKED}.215.82 shop.trendmicro.com
{BLOCKED}.{BLOCKED}.127.38 onlinecheck.emsisoft.de
{BLOCKED}.{BLOCKED}.127.38 pctools.com
{BLOCKED}.{BLOCKED}.127.38 www.handwritingforkids.com
{BLOCKED}.{BLOCKED}.134.170 f-secure.frf-secure.hk
{BLOCKED}.{BLOCKED}.134.170 timestamp.wosign.com
{BLOCKED}.{BLOCKED}.208.206 haurijapan.com
{BLOCKED}.{BLOCKED}.40.250 www.hacksoft.pe
{BLOCKED}.{BLOCKED}.209.113 jp.mcafee.com
{BLOCKED}.{BLOCKED}.222.214 virscan.org
{BLOCKED}.{BLOCKED}.143.47 subwiz.trendmicro.com
{BLOCKED}.{BLOCKED}.55.165 sales.bitdefender.com
{BLOCKED}.{BLOCKED}.130.41 www.kaspersky.com
{BLOCKED}.{BLOCKED}.143.209 spycheck.co.uk
{BLOCKED}.{BLOCKED}.50.36 visualtracking.symantec.com
{BLOCKED}.{BLOCKED}.225.217 15660808.co.kr
{BLOCKED}.{BLOCKED}.219.86 comodo.com
{BLOCKED}.{BLOCKED}.219.86 www.emeraldclassic.co.uk
{BLOCKED}.{BLOCKED}.219.86 www.hauri.net
{BLOCKED}.{BLOCKED}.64.43 hacksoft.pe
{BLOCKED}.{BLOCKED}.226.218 f-secure.com
{BLOCKED}.{BLOCKED}.226.218 secure-email.comodo.com
{BLOCKED}{BLOCKED}.40.31 sunbeltsoftware.com
{BLOCKED}{BLOCKED}.146.212 www.exchangeyourcareer.com
{BLOCKED}.{BLOCKED}.221.88 together.pctools.com
{BLOCKED}.{BLOCKED}.147.214 cgi.clamav.net
{BLOCKED}.{BLOCKED}.147.214 grisoft.com
{BLOCKED}.{BLOCKED}.134.207 antiy.net
{BLOCKED}.{BLOCKED}.134.207 ruben.bzin.net
{BLOCKED}.{BLOCKED}.134.207 www.rising-global.com
{BLOCKED}.{BLOCKED}.222.89 www.fortinet.co.il
{BLOCKED}.{BLOCKED}.209.82 alladdin.ru
{BLOCKED}.{BLOCKED}.241.21 norman.com
{BLOCKED}.{BLOCKED}.241.21 vivo-austin.com
{BLOCKED}.{BLOCKED}.241.21 www.emsisoft.fr
{BLOCKED}.{BLOCKED}.122.201 www.removetrojanvirus.org
{BLOCKED}.{BLOCKED}.143.178 threatexpert.com
{BLOCKED}.{BLOCKED}.130.78 bitdefenderguatemala.com
{BLOCKED}.{BLOCKED}.130.78 www.trustlogo.com
{BLOCKED}.{BLOCKED}.238.193 www.norman.com
{BLOCKED}.{BLOCKED}.226.255 pvtc.org
{BLOCKED}.{BLOCKED}.226.255 www.aladdin.com
{BLOCKED}.{BLOCKED}.226.255 www.owen.org
{BLOCKED}.{BLOCKED}.232.130 aladdin.com
{BLOCKED}.{BLOCKED}.57.231 beta.anti-virus.by
{BLOCKED}.{BLOCKED}.51.6 mx.mcafee.com
{BLOCKED}.{BLOCKED}.241.7 la.trendmicro.com
{BLOCKED}.{BLOCKED}.255.216 www.bitdefender.de
{BLOCKED}.{BLOCKED}.255.216 www.deborahshelton.net
{BLOCKED}.{BLOCKED}.80.196 www.novirusthanks.org
{BLOCKED}.{BLOCKED}.175.210 superboy2010.com.au
{BLOCKED}.{BLOCKED}.169.80 www.bitdefender.cl
{BLOCKED}.{BLOCKED}.169.80 www.brightoctober.com
{BLOCKED}.{BLOCKED}.83.199 www.nprotect.co.kr
{BLOCKED}.{BLOCKED}.57.105 schemas.microsoft.com
{BLOCKED}.{BLOCKED}.63.49 www.prevx1.com
{BLOCKED}.{BLOCKED}.91.76 de.mcafee.com
{BLOCKED}.{BLOCKED}.158.237 pg.hauri.net
{BLOCKED}.{BLOCKED}.178.213 education.symantec.com
{BLOCKED}.{BLOCKED}.84.200 frisk-software.com
{BLOCKED}.{BLOCKED}.84.200 internetsecurity.comodo.com
{BLOCKED}.{BLOCKED}.97.45 go.trendmicro.com
{BLOCKED}.{BLOCKED}.9.1 eset.es
{BLOCKED}.{BLOCKED}.9.1 qqjkw.net
{BLOCKED}.{BLOCKED}.9.1 ww.emsisoft.com
{BLOCKED}.{BLOCKED}.172.176 novirusthanks.org
{BLOCKED}.{BLOCKED}.92.78 store.trendmicro.com
{BLOCKED}.{BLOCKED}.5.128 malwarepedia.com
{BLOCKED}.{BLOCKED}.80.72 global.jiangmin.com
{BLOCKED}.{BLOCKED}.174.247 global.nprotect.com
{BLOCKED}.{BLOCKED}.14.5 www4.symantec.com
{BLOCKED}.{BLOCKED}.7.130 firewall.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.101.49 avg.com
{BLOCKED}.{BLOCKED}.101.49 naturesimages.net
{BLOCKED}.{BLOCKED}.101.49 www.symantec.com
{BLOCKED}.{BLOCKED}.0.254 tms.symantec.com
{BLOCKED}.{BLOCKED}.7.36 softfaq.com
{BLOCKED}.{BLOCKED}.182.124 schemas.xmlsoap.org
{BLOCKED}.{BLOCKED}.176.180 i-vault.comodo.com
{BLOCKED}.{BLOCKED}.176.180 www.f-prot.com
{BLOCKED}.{BLOCKED}.96.175 www.eugrantsadvisor.se
{BLOCKED}.{BLOCKED}.171.119 free.pandasecurity.com
{BLOCKED}.{BLOCKED}.83.169 developmentdrums.org
{BLOCKED}.{BLOCKED}.83.169 www.buscafacil.com
{BLOCKED}.{BLOCKED}.83.169 www.nprotect.com
{BLOCKED}.{BLOCKED}.97.176 files.avast.com
{BLOCKED}.{BLOCKED}.97.176 www.malwarecity.fr
{BLOCKED}.{BLOCKED}.104.52 www.fortiid.com
{BLOCKED}.{BLOCKED}.18.104 tempuri.org
{BLOCKED}.{BLOCKED}.12.41 b-have.orgbitdefender-ar.com
{BLOCKED}.{BLOCKED}.12.41 system-cleaner.comodo.com
{BLOCKED}.{BLOCKED}.93.141 www.avhide.com
{BLOCKED}.{BLOCKED}.232.99 bestofewan.com
{BLOCKED}.{BLOCKED}.232.99 onlinecheck.emsisoft.com
{BLOCKED}.{BLOCKED}.232.99 pandasecurity.com
{BLOCKED}.{BLOCKED}.246.106 www.authentium.com
{BLOCKED}.{BLOCKED}.246.106 www.bitdefender.fr
{BLOCKED}.{BLOCKED}.65.50 www.fortinetuk.com
{BLOCKED}.{BLOCKED}.51.43 new-support.drweb.com
{BLOCKED}.{BLOCKED}.145.218 www.tecniservicioslys.com
{BLOCKED}.{BLOCKED}.139.87 www.virustotal.com
{BLOCKED}.{BLOCKED}.188.223 reg-int.nod32-es.com
{BLOCKED}.{BLOCKED}.107.217 ixomodels.com
{BLOCKED}.{BLOCKED}.107.217 www.quickheal.com
{BLOCKED}.{BLOCKED}.107.217 www.tomorrowsedge.net
{BLOCKED}.{BLOCKED}.195.5 newsletters.trendmicro.com
{BLOCKED}.{BLOCKED}.182.93 www.freedrweb.ru
{BLOCKED}.{BLOCKED}.196.100 support.mcafee.com
{BLOCKED}.{BLOCKED}.117.189 avhide.com
{BLOCKED}.{BLOCKED}.104.89 store.de.bitdefender.com
{BLOCKED}.{BLOCKED}.191.226 esupport.trendmicro.com
{BLOCKED}.{BLOCKED}.105.23 symantec.com
{BLOCKED}.{BLOCKED}.199.10 ca.com
{BLOCKED}.{BLOCKED}.199.10 www.anti-trojan.net
{BLOCKED}.{BLOCKED}.199.10 www.avoncourt.com
{BLOCKED}.{BLOCKED}.18.141 customers.drweb.com
{BLOCKED}.{BLOCKED}.113.61 www.virusfreezone.info
{BLOCKED}.{BLOCKED}.182.130 cohartuk.com
{BLOCKED}.{BLOCKED}.182.130 malwarescan.emsisoft.de
{BLOCKED}.{BLOCKED}.182.130 microsoft.com
{BLOCKED}.{BLOCKED}.13.11 free.prevx.com
{BLOCKED}.{BLOCKED}.95.181 www.kioskea.net
{BLOCKED}.{BLOCKED}.195.69 www.bitdefender.com.tw
{BLOCKED}.{BLOCKED}.195.69 www.residentphotography.com
{BLOCKED}.{BLOCKED}.202.13 arwww.fortinet.cz
{BLOCKED}.{BLOCKED}.116.64 www.risingav.com.au
{BLOCKED}.{BLOCKED}.234.101 feeds.sophos.com
{BLOCKED}.{BLOCKED}.159.225 fsc.norman.com
{BLOCKED}.{BLOCKED}.178.1 bitdefenderuruguay.com
{BLOCKED}.{BLOCKED}.23.52 www.nprotect.com
{BLOCKED}.{BLOCKED}.187.135 hostedmailsecur.symantec.com
{BLOCKED}.{BLOCKED}.18.110 www.f-secure.com
{BLOCKED}.{BLOCKED}.18.110 www.gokidding.com
{BLOCKED}.{BLOCKED}.18.110 www.willsee.com
{BLOCKED}.{BLOCKED}.25.54 cai.com
{BLOCKED}.{BLOCKED}.25.54 www.ccssforum.org
{BLOCKED}.{BLOCKED}.38.61 forum.kaspersky.com
{BLOCKED}.{BLOCKED}.202.238 malwarecity.com
{BLOCKED}.{BLOCKED}.204.239 shop.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.42.158 authentium.com
{BLOCKED}.{BLOCKED}.42.158 welkam.co.jp
{BLOCKED}.{BLOCKED}.42.158 www.sophos.com
{BLOCKED}.{BLOCKED}.117.102 info.drweb.com
{BLOCKED}.{BLOCKED}.16.146 www.midescargas.com
{BLOCKED}.{BLOCKED}.123.233 privacy.microsoft.com
{BLOCKED}.{BLOCKED}.24.23 rising-global.com
{BLOCKED}.{BLOCKED}.24.23 scan.anti-trojan.net
{BLOCKED}.{BLOCKED}.24.23 www.2xlgames.com
{BLOCKED}.{BLOCKED}.111.228 timeforyourbusi.pandasecurity.com
{BLOCKED}.{BLOCKED}.119.198 virusscan.jotti.org
{BLOCKED}.{BLOCKED}.38.30 linux.bitdefender.com
{BLOCKED}.{BLOCKED}.113.161 www.apsecure.com
{BLOCKED}.{BLOCKED}.241.232 securityrespons.symantec.com
{BLOCKED}.{BLOCKED}.228.227 buy.bitdefender.de
{BLOCKED}.{BLOCKED}.214.24 tw.sophos.com
{BLOCKED}.{BLOCKED}.20.150 archive.bitdefender.com
{BLOCKED}.{BLOCKED}.20.150 lists.clamav.net
{BLOCKED}.{BLOCKED}.33.63 www.scan4you.net
{BLOCKED}.{BLOCKED}.40.194 midescargas.com
{BLOCKED}.{BLOCKED}.190.13 nprotect.net
{BLOCKED}.{BLOCKED}.129.77 eos.eset.es
{BLOCKED}.{BLOCKED}.29.27 housecall.trendmicro.com
{BLOCKED}.{BLOCKED}.137.209 fortiwifi.com
{BLOCKED}.{BLOCKED}.116.71 www.avg.com
{BLOCKED}.{BLOCKED}.116.71 www.internationalservicecheck.com
{BLOCKED}.{BLOCKED}.116.71 www.stadiumpage.com
{BLOCKED}.{BLOCKED}.123.202 f-secure.nlfsecure.com
{BLOCKED}.{BLOCKED}.123.202 rover800.gaima.co.uk
{BLOCKED}.{BLOCKED}.111.197 exchangeyourcareer.net
{BLOCKED}.{BLOCKED}.132.80 it.trendmicro.com
{BLOCKED}.{BLOCKED}.44.198 antivirus-tools.com
{BLOCKED}.{BLOCKED}.44.198 wwws.clamav.net
{BLOCKED}.{BLOCKED}.119.235 www.hauri.co.kr
{BLOCKED}.{BLOCKED}.140.119 roysephotos.com
{BLOCKED}.{BLOCKED}.140.119 www.avast.com
{BLOCKED}.{BLOCKED}.140.119 www.hackshields.com
{BLOCKED}.{BLOCKED}.215.251 promotions.drweb.com
{BLOCKED}.{BLOCKED}.54.170 tecniservicioslys.com
{BLOCKED}.{BLOCKED}.211.27 www.hauri.net
{BLOCKED}.{BLOCKED}.123.239 kaspersky.com
{BLOCKED}.{BLOCKED}.123.239 mamutu.com
{BLOCKED}.{BLOCKED}.123.239 www.flairweddings.co.uk
{BLOCKED}.{BLOCKED}.142.90 siren24.nprotect.com
{BLOCKED}.{BLOCKED}.80.153 www.eugrantsadvisor.ie
{BLOCKED}.{BLOCKED}.136.246 www.bitdefender.com.au
{BLOCKED}.{BLOCKED}.136.246 www.professorbeyer.com
{BLOCKED}.{BLOCKED}.124.173 www.freerav.com
{BLOCKED}.{BLOCKED}.119.111 www.bit-defender.de
{BLOCKED}.{BLOCKED}.119.111 www.celticmerchant.com
{BLOCKED}.{BLOCKED}.132.211 www.threatexpert.com
{BLOCKED}.{BLOCKED}.32.162 webadmin.norman.no
{BLOCKED}.{BLOCKED}.40.39 networkassociates.nai.com
{BLOCKED}.{BLOCKED}.215.32 ixostore.ixomodels.com
{BLOCKED}.{BLOCKED}.215.32 jiangmin.com
{BLOCKED}.{BLOCKED}.215.32 www.anti-trojan-software.net
{BLOCKED}.{BLOCKED}.222.163 online-backup.comodo.com
{BLOCKED}.{BLOCKED}.222.163 www.netegrity.com
{BLOCKED}.{BLOCKED}.222.238 bancoguayaquil.com
{BLOCKED}.{BLOCKED}.222.238 pichincha.com
{BLOCKED}.{BLOCKED}.222.238 produbanco.com
{BLOCKED}.{BLOCKED}.222.238 www.bancoguayaquil.com
{BLOCKED}.{BLOCKED}.222.238 www.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 www.produbanco.com
{BLOCKED}.{BLOCKED}.222.238 wwwp1.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwwp2.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwwp3.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwwp4.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww01.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww02.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww03.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww04.pichincha.com
{BLOCKED}.{BLOCKED}.47.170 www.jiangmin.com.cn
{BLOCKED}.{BLOCKED}.148.221 www.retento.com
{BLOCKED}.{BLOCKED}.230.40 uk.trendmicro.com
{BLOCKED}.{BLOCKED}.211.159 latin.bitdefender.com
{BLOCKED}.{BLOCKED}.218.34 gdata.es
{BLOCKED}.{BLOCKED}.56.210 register.norman.com
{BLOCKED}.{BLOCKED}.145.93 antivirus.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.51.12 antivir.es
{BLOCKED}.{BLOCKED}.51.12 elblogdemanu.com
{BLOCKED}.{BLOCKED}.51.12 www.prevx.com
{BLOCKED}.{BLOCKED}.206.29 go.symantec.com
{BLOCKED}.{BLOCKED}.57.211 cacomvip.ca.com
{BLOCKED}.{BLOCKED}.57.211 www.comodo.tv
{BLOCKED}.{BLOCKED}.132.87 it.mcafee.com
{BLOCKED}.{BLOCKED}.46.138 encarta.msn.com
{BLOCKED}.{BLOCKED}.213.255 www.spycheck.co.uk
{BLOCKED}.{BLOCKED}.143.91 timestamp.comodoca.com
{BLOCKED}.{BLOCKED}.143.91 www.frisk-software.com
{BLOCKED}.{BLOCKED}.156.191 channelpartner.trendmicro.com
{BLOCKED}.{BLOCKED}.237.104 www.hacksoft.com.pe
{BLOCKED}.{BLOCKED}.68.147 www.antivir.es
{BLOCKED}.{BLOCKED}.68.147 www.jiangmin.com
{BLOCKED}.{BLOCKED}.221.132 www.dr-bull.com
{BLOCKED}.{BLOCKED}.221.132 www.iniciorapido.info
{BLOCKED}.{BLOCKED}.221.132 www.mcafee.com
{BLOCKED}.{BLOCKED}.54.83 fortiprotect.com
{BLOCKED}.{BLOCKED}.235.139 asap.authentium.com
{BLOCKED}.{BLOCKED}.235.139 www.bitdefender.hk
{BLOCKED}.{BLOCKED}.230.172 www.virus.org
{BLOCKED}.{BLOCKED}.156.135 mcafeeretail.com
{BLOCKED}.{BLOCKED}.217.3 lurker.clamav.net
{BLOCKED}.{BLOCKED}.217.3 www.grisoft.com
{BLOCKED}.{BLOCKED}.70.186 descargas.eset.es
{BLOCKED}.{BLOCKED}.57.180 global.ahnlab.com
{BLOCKED}.{BLOCKED}.57.180 isotopecomics.com
{BLOCKED}.{BLOCKED}.57.180 www.authentium.com
{BLOCKED}.{BLOCKED}.132.124 secure.av-desk.com
{BLOCKED}.{BLOCKED}.145.224 wtc.trendmicro.com
{BLOCKED}.{BLOCKED}.146.63 kaspersky.com
{BLOCKED}.{BLOCKED}.53.52 renewals.bitdefender.com
{BLOCKED}.{BLOCKED}.66.152 virus.org
{BLOCKED}.{BLOCKED}.59.89 www.bg.virusblokada.com
{BLOCKED}.{BLOCKED}.229.46 oem.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.149.228 clamav.net
{BLOCKED}.{BLOCKED}.149.228 dev.depeuter.org
{BLOCKED}.{BLOCKED}.149.228 www.anti-virus.by
{BLOCKED}.{BLOCKED}.156.104 products.drweb.com
{BLOCKED}.{BLOCKED}.243.53 securityrespons.symantec.com
{BLOCKED}.{BLOCKED}.62.23 www.mygeekside.com
{BLOCKED}.{BLOCKED}.64.93 ikarus.at
{BLOCKED}.{BLOCKED}.64.93 www.emsisoft.de
{BLOCKED}.{BLOCKED}.64.93 www.sheffieldmind.co.uk
{BLOCKED}.{BLOCKED}.151.230 soporte.pandasecurity.com
{BLOCKED}.{BLOCKED}.152.231 www.fortinet.ch
{BLOCKED}.{BLOCKED}.77.100 hishomeforchildren.com
{BLOCKED}.{BLOCKED}.77.100 www.bitdefender.co.uk
{BLOCKED}.{BLOCKED}.233.144 www.forospyware.com
{BLOCKED}.{BLOCKED}.248.152 www.aks.com
{BLOCKED}.{BLOCKED}.229.15 nprobeta.norman.com
{BLOCKED}.{BLOCKED}.156.141 www.arpia.be
{BLOCKED}.{BLOCKED}.156.141 www.drweb.com
{BLOCKED}.{BLOCKED}.156.141 www.mountainlakeslodge.com
{BLOCKED}.{BLOCKED}.244.24 jiangmin.com.cn
{BLOCKED}.{BLOCKED}.230.16 idauthority.com
{BLOCKED}.{BLOCKED}.230.16 www.ca.com
{BLOCKED}.{BLOCKED}.152.12 kb.bitdefender.de

Other Details

This worm does the following:

It creates a shortcut for every file and folder in removable drives. The shortcut file executes the malware copy when run.

NOTES:

It deletes all keys in the following registry that do not have a file path reference:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

It hijacks certain applications by creating the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{application name}
Debugger =%UserProfile%\0787E69677\winlogon.exe

where {application name} are the following:

BullGuard.exe
ChromeSetup.exe
ComboFix.exe
Diskmon.exe
EHttpSrv.exe
FPAVServer.exe
Filemon.exe
FirewallControlPanel.exe
FirewallSettings.exe
GenericRenosFix.exe
GoogleToolbarInstaller_download_signed.exe
HJTInstall.exe
HelpPane.exe
HiJackThis.exe
HostsChk.exe
IEDFix.exe
MSASCui.exe
Netscape.exe
Opera_964_int_Setup.exe
Process.exe
Procmon.exe
Regmon.exe
Restart.exe
Safari.exe
SandboxieBITS.exe
SandboxieCrypto.exe
SandboxieDcomLaunch.exe
SandboxieRpcSs.exe
SandboxieWUAU.exe
SbieCtrl.exe
SbieSvc.exe
SmitfraudFix.exe
SrchSTS.exe
UCCLSID.exe
UI0Detect.exe
UserAccountControlSettings.exe
VACFix.exe
WS2Fix.exe
WerFault.exe
_avp.exe
_avp32.exe
_avpcc.exe
_avpm.exe
_findviru.exe
a2servic.exe
ackwin32.exe
acs.exe
advxdwin.exe
agentsvr.exe
agentw.exe
ahnsd.exe
alerter.exe
alertsvc.exe
alogserv.exe
amon.exe
amon9x.exe
anti-trojan.exe
antigen.exe
antivirus.exe
ants.exe
apimonitor.exe
aplica32.exe
apvxdwin.exe
ashWebSv.exe
atcon.exe
atguard.exe
atro55en.exe
atupdater.exe
atwatch.exe
aupdate.exe
autodown.exe
autotrace.exe
autoupdate.exe
avcenter.exe
avconfig.exe
avconsol.exe
ave32.exe
avgcc32.exe
avgctrl.exe
avgemc.exe
avgnt.exe
avgserv.exe
avgserv9.exe
avguard.exe
avgw.exe
avkpop.exe
avkserv.exe
avkservice.exe
avkwcl9.exe
avkwctl9.exe
avnotify.exe
avnt.exe
avp.exe
avp32.exe
avpcc.exe
avpdos32.exe
avpexec.exe
avpinst.exe
avpm.exe
avpmon.exe
avpnt.exe
avptc32.exe
avpupd.exe
avrescue.exe
avscanavshadow.exe
avsched32.exe
avsynmgr.exe
avupgsvc.exe
avwebloader.exe
avwin95.exe
avwinnt.exe
avwsc.exe
avwupd32.exe
avxmonitor9x.exe
avxmonitornt.exe
avxquar.exe
avxw.exe
azonealarm.exe
bd_professional.exe
bidef.exe
bidserver.exe
bipcp.exe
bipcpevalsetup.exe
bisp.exe
blackd.exe
blackice.exe
boot.exe
bootwarn.exe
borg2.exe
bs120.exe
callmsi.exe
ccapp.exe
ccevtmgr.exe
cclaw.exe
ccpxysvc.exe
ccsetmgr.exe
ccshtdwn.exe
cdp.exe
cfgwiz.exe
cfiadmin.exe
cfiaudit.exe
cfind.exe
cfinet.exe
cfinet32.exe
clamauto.exe
claw95.exe
claw95cf.exe
claw95ct.exe
clean.exe
cleaner.exe
cleaner3.exe
cleanpc.exe
cmd.exe
cmgrdian.exe
cmon016.exe
connectionmonitor.exe
cpd.exe
cpdclnt.exe
cpf.exe
cpf9x206.exe
cpfnt206.exe
csinject.exe
csinsm32.exe
css1631.exe
ctfmon.exe
ctrl.exe
cv.exe
cwnb181.exe
cwntdwmo.exe
defalert.exe
defscangui.exe
defwatch.exe
deputy.exe
doors.exe
dpf.exe
drvins32.exe
drwatson.exe
drweb32.exe
dumphive.exe
dv95.exe
dv95_o.exe
dvp95.exe
dvp95_0.exe
earthagent.exe
ecengine.exe
ecls.exe
ecmd.exe
edi.exe
efinet32.exe
efpeadm.exe
egui.exe
ekrn.exe
ent.exe
esafe.exe
escanh95.exe
escanhnt.exe
escanv95.exe
espwatch.exe
etrustcipe.exe
evpn.exe
ewido.exe
exantivirus-cnet.exe
exit.exe
expert.exe
explored.exe
f-agnt95.exe
f-prot.exe
f-prot95.exe
f-stopw.exe
fa-setup.exe
fact.exe
fameh32.exe
fast.exe
fch32.exe
fih32.exe
findviru.exe
firewall.exe
fix-it.exe
flowprotector.exe
fnrb32.exe
fp-win.exe
fp-win_trial.exe
fprot.exe
fprot95.exe
frw.exe
fsaa.exe
fsav.exe
fsav32.exe
fsav530stbyb.exe
fsav530wtbyb.exe
fsav95.exe
fsave32.exe
fsgk32.exe
fslaunch.exe
fsm32.exe
fsma32.exe
fsmb32.exe
fssm32.exe
fwenc.exe
fwinstall.exe
gbmenu.exe
gbpoll.exe
generics.exe
gibe.exe
gpedit.exe
guard.exe
guarddog.exe
guardgui.exe
guardhlp.exe
hacktracersetup.exe
hidec.exe
htlog.exe
hwpe.exe
iamapp.exe
iamserv.exe
iamstats.exe
ibmasn.exe
ibmavsp.exe
icload95.exe
icloadnt.exe
icmon.exe
icmoon.exe
icssuppnt.exe
icsupp.exe
icsupp95.exe
icsuppnt.exe
iface.exe
ifw2000.exe
iomon98.exe
iparmor.exe
iris.exe
isrv95.exe
jammer.exe
jed.exe
jedi.exe
kav8.0.0.357es.exe
kavlite40eng.exe
kavpers40eng.exe
kavsvc.exe
kerio-pf-213-en-win.exe
kerio-wrl-421-en-win.exe
kerio-wrp-421-en-win.exe
killprocesssetup161.exe
kis8.0.0.506latam.exe
kpf.exe
kpfw32.exe
ldnetmon.exe
ldpro.exe
ldpromenu.exe
ldscan.exe
licmgr.exe
localnet.exe
lockdown.exe
lockdown2000.exe
lookout.exe
lsetup.exe
luall.exe
luau.exe
lucomserver.exe
luinit.exe
luspt.exe
mbam.exe
mbamgui.exe
mbamservice.exe
mcagent.exe
mcmnhdlr.exe
mcshield.exe
mctool.exe
mcuimgr.exe
mcupdate.exe
mcvsrte.exe
mcvsshld.exe
mdll.exe
mfw2en.exe
mfweng3.02d30.exe
mgavrtcl.exe
mgavrte.exe
mghtml.exe
mgui.exe
minilog.exe
monitor.exe
monsys32.exe
monsysnt.exe
monwow.exe
moolive.exe
mpfagent.exe
mpfservice.exe
mpftray.exe
mrflux.exe
msblast.exe
msconfig.exe
msinfo32.exe
msn.exe
mspatch.exe
mssmmc32.exe
mu0311ad.exe
mwatch.exe
mxtask.exe
n32scan.exe
n32scanw.exe
nai_vs_stat.exe
nav32_loader.exe
nav80try.exe
navap.exe
navapsvc.exe
navapw32.exe
navauto-protect.exe
navdx.exe
naveng.exe
navengnavex15.exe
navex15.exe
navlu32.exe
navnt.exe
navrunr.exe
navsched.exe
navstub.exe
navw.exe
navw32.exe
navwnt.exe
nc2000.exe
ncinst4.exe
nd98spst.exe
ndd32.exe
ndntspst.exe
neomonitor.exe
neowatchlog.exe
netarmor.exe
netcfg.exe
netinfo.exe
netmon.exe
netscanpro.exe
netspyhunter-1.2.exe
netstat.exe
netutils.exe
nisserv.exe
nisum.exe
nmain.exe
nod32.exe
normist.exe
norton_internet_secu_3.0_407.exe
notstart.exe
npf40_tw_98_nt_me_2k.exe
npfmessenger.exe
nprotect.exe
npscheck.exe
npssvc.exe
nsched32.exe
ntdetect.exe
ntrtscan.exe
ntxconfig.exe
nui.exe
nupdate.exe
nupgrade.exe
nvapsvc.exe
nvarch16.exe
nvc95.exe
nvlaunch.exe
nvsvc32.exe
nwinst4.exe
nwservice.exe
nwtool16.exe
offguard.exe
ogrc.exe
opera.exe
ostronet.exe
outpost.exe
outpostinstall.exe
outpostproinstall.exe
padmin.exe
panixk.exe
pathping.exe
pavcl.exe
pavproxy.exe
pavsched.exe
pavw.exe
pcc2002s902.exe
pcc2k_76_1436.exe
pccclient.exe
pccguide.exe
pcciomon.exe
pccmain.exe
pccntmon.exe
pccpfw.exe
pccwin97.exe
pccwin98.exe
pcdsetup.exe
pcfwallicon.exe
pcip10117_0.exe
pcscan.exe
pcscanpdsetup.exe
penis32.exe
periscope.exe
persfw.exe
perswf.exe
pev.exe
pf2.exe
pfwadmin.exe
ping.exe
pingscan.exe
platin.exe
pop3trap.exe
poproxy.exe
popscan.exe
portdetective.exe
portmon.exe
portmonitor.exe
ppinupdt.exe
pptbc.exe
ppvstop.exe
prckiller.exe
processmonitor.exe
procexp.exe
procexplorerv1.0.exe
programauditor.exe
proport.exe
protectx.exe
pspf.exe
purge.exe
pview.exe
pview95.exe
qconsole.exe
qserver.exe
rapapp.exe
rav.exe
rav7.exe
rav7win.exe
rav8win32eng.exe
realmon.exe
regedit.exe
regedt32.exe
rescue.exe
rescue32.exe
route.exe
routemon.exe
rrguard.exe
rshell.exe
rstrui.exe
rtvscn95.exe
rulaunch.exe
safeweb.exe
sbserv.exe
scan32.exe
scan95.exe
scanpm.exe
sched.exe
schedapp.exe
scrscan.exe
scvhosl.exe
sd.exe
sdclt.exe
serv95.exe
setup_flowprotector_us.exe
setupvameeval.exe
sgssfw32.exe
sh.exe
sharedaccess.exe
shellspyinstall.exe
shn.exe
smc.exe
sofi.exe
spf.exe
sphinx.exe
spider.exe
spysweeper.exe
spyxx.exe
srwatch.exe
ss3edit.exe
st2.exe
supftrl.exe
supporter5.exe
sweep.exe
sweep95.exe
sweepnet.exe
sweepsrv.sys.exe
swnetsup.exe
swreg.exe
swsc.exe
swxcacls.exe
symproxysvc.exe
symtray.exe
sysdoc32.exe
syshelp.exe
taskkill.exe
tasklist.exe
taskmgr.exe
taskmon.exe
taumon.exe
tauscan.exe
tbscan.exe
tc.exe
tca.exe
tcm.exe
tcpsvs32.exe
tds-3.exe
tds2-98.exe
tds2-nt.exe
tds2.exe
tfak.exe
tfak5.exe
tftpd.exe
tgbob.exe
titanin.exe
titaninxp.exe
tmlisten.exe
tmntsrv.exe
tracerpt.exe
tracert.exe
trjscan.exe
trjsetup.exe
trojantrap3.exe
undoboot.exe
unzip.exe
update.exe
vbcmserv.exe
vbcons.exe
vbust.exe
vbwin9x.exe
vbwinntw.exe
vccmserv.exe
vcleaner.exe
vcontrol.exe
vcsetup.exe
vet32.exe
vet95.exe
vet98.exe
vettray.exe
vfsetup.exe
vir-help.exe
virusmdpersonalfirewall.exe
vmsrvc.exe
vnlan300.exe
vnpc3000.exe
vpc32.exe
vpc42.exe
vpcmap.exe
vpfw30s.exe
vptray.exe
vscan.exe
vscan40.exe
vscenu6.02d30.exe
vsched.exe
vsecomr.exe
vshwin32.exe
vsisetup.exe
vsmain.exe
vsmon.exe
vsscan40.exe
vsstat.exe
vswin9xe.exe
vswinntse.exe
vswinperse.exe
vvstat.exe
w32dsm89.exe
w9x.exe
watchdog.exe
webscan.exe
webscanx.exe
webtrap.exe
wfindv32.exe
wgfe95.exe
whoswatchingme.exe
wimmun32.exe
wingate.exe
winhlpp32.exe
wink.exe
winmgm32.exe
winppr32.exe
winrecon.exe
winroute.exe
winservices.exe
winsfcm.exe
wmias.exe
wmiav.exe
wnt.exe
wradmin.exe
wrctrl.exe
wsbgate.exe
wuauclt.exe
wyvernworksfirewall.exe
xpf202en.exe
xscan.exe
zapro.exe
zapsetup3001.exe
zatutor.exe
zatutorzauinst.exe
zauinst.exe
zlh.exe
zonalarm.exe
zonalm2601.exe
zonealarm.exe

As a result, the malware runs everytime any of the above-mentioned applications are executed.

SOLUTION

Minimum Scan Engine:

8.900

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Enable Registry Editor, Task Manager, and Folder options

[ Learn More ]

By doing this step, you also enable other applications/programs disabled by this malware/grayware.

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{application name}
- Debugger =%UserProfile%\0787E69677\winlogon.exe
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- 0585E49475 = %UserProfile%\0787E69677\winlogon.exe
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- 0585E49475 = %UserProfile%\0787E69677\winlogon.exe
In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- Default_Search_URL = http://{BLOCKED}bkq39lt8.directorio-w.com
In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- Default_Page_URL = http://{BLOCKED}q5b4kvmty.directorio-w.com
In HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ftp\UserChoice
- Progid = IE.FTP
In HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
- Progid = IE.HTTP
In HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice
- Progid = IE.HTTPS
In HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
- %UserProfile%\0787E69677\winlogon.exe = RUNASADMIN
In HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
- HomePage = 1
In HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
- DisableCMD = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- UacDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiSpyWareDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiVirusDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AntiVirusOverride = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AutoUpdateDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- cval = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirewallDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- InternetSettingsDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring
- DisableMonitoring = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus
- DisableMonitoring = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall
- DisableMonitoring = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiVirusDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiVirusOverride = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirewallDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirewallOverride = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- FirstRunDisabled = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- UpdatesDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- UacDisableNotify = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
- AntiSpywareOverride = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
- NoFolderOptions = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
- ConsentPromptBehaviorAdmin = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
- EnableLUA = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
- PromptOnSecureDesktop = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
- %UserProfile%\0787E69677\winlogon.exe = RUNASADMIN
In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
- NoAutoRebootWithLoggedOnUsers = 1
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
- DisableNotifications = 1
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
- DoNotAllowExceptions = 0
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
- EnableFirewall = 0
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- DisableNotifications = 1
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
- DoNotAllowExceptions = 0
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
- %UserProfile%\0787E69677\winlogon.exe = %UserProfile%\0787E69677\winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings
- Enabled = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
- EnableFirewall = 0
In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
- EnableFirewall = 0
In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download
- RunInvalidSignatures = 1

To delete the registry value this malware/grayware created:

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows
NT>CurrentVersion>Image File Execution Options>{application
name}
In the right panel, locate and delete the entry:
Debugger = %UserProfile%\0787E69677>winlogon.exe
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
0585E49475 = %UserProfile%\0787E69677>winlogon.exe
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
0585E49475 = %UserProfile%\0787E69677>winlogon.exe
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet
Explorer>Main
In the right panel, locate and delete the entry:
Default_Search_URL = Software>Microsoft>Internet">http://{BLOCKED}bkq39lt8.directorio-w.com
Again In the right panel, locate and delete the entry:
Default_Page_URL = Software>Microsoft>Windows>Shell>Associations>UrlAssociations>ftp>UserChoice
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>Shell>Associations>UrlAssociations>ftp>UserChoice
In the right panel, locate and delete the entry:
Progid = IE.FTP
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>Shell>Associations>UrlAssociations>http>UserChoice
In the right panel, locate and delete the entry:
Progid = IE.HTTP
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>Shell>Associations>UrlAssociations>https>UserChoice
In the right panel, locate and delete the entry:
Progid = IE.HTTPS
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows
NT>CurrentVersion>AppCompatFlags>Layers
In the right panel, locate and delete the entry:
%UserProfile%\0787E69677>winlogon.exe = RUNASADMIN
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Policies>Microsoft>Internet
Explorer>Control Panel
In the right panel, locate and delete the entry:
HomePage = 1
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Policies>Microsoft>Windows>System
In the right panel, locate and delete the entry:
DisableCMD = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security
Center
In the right panel, locate and delete the entry:
UacDisableNotify = 1
Again In the right panel, locate and delete the entry:
AntiSpyWareDisableNotify = 1
Again In the right panel, locate and delete the entry:
AntiVirusDisableNotify = 1
Again In the right panel, locate and delete the entry:
AntiVirusOverride = 0
Again In the right panel, locate and delete the entry:
AutoUpdateDisableNotify = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center
In the right panel, locate and delete the entry:
cval = 1
Again In the right panel, locate and delete the entry:
FirewallDisableNotify = 1
Again In the right panel, locate and delete the entry:
InternetSettingsDisableNotify = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security
Center>Monitoring
In the right panel, locate and delete the entry:
DisableMonitoring = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security
Center>Monitoring>SymantecAntiVirus
In the right panel, locate and delete the entry:
DisableMonitoring = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security
Center>Monitoring>SymantecFirewall
In the right panel, locate and delete the entry:
DisableMonitoring = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security
Center>Svc
In the right panel, locate and delete the entry:
AntiVirusDisableNotify = 1
Again In the right panel, locate and delete the entry:
AntiVirusOverride = 0
Again In the right panel, locate and delete the entry:
FirewallDisableNotify = 1
Again In the right panel, locate and delete the entry:
FirewallOverride = 0
Again In the right panel, locate and delete the entry:
FirstRunDisabled = 1
Again In the right panel, locate and delete the entry:
UpdatesDisableNotify = 1
Again In the right panel, locate and delete the entry:
UacDisableNotify = 1
Again In the right panel, locate and delete the entry:
AntiSpywareOverride = 0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Explorer
In the right panel, locate and delete the entry:
NoFolderOptions = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>system
In the right panel, locate and delete the entry:
ConsentPromptBehaviorAdmin = 0
Again In the right panel, locate and delete the entry:
EnableLUA = 0
Again In the right panel, locate and delete the entry:
PromptOnSecureDesktop = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows
NT>CurrentVersion>AppCompatFlags>Layers
In the right panel, locate and delete the entry:
%UserProfile%\0787E69677>winlogon.exe = RUNASADMIN
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows>WindowsUpdate>AU
In the right panel, locate and delete the entry:
NoAutoRebootWithLoggedOnUsers = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>SharedAccess>Parameters>FirewallPolicy>DomainProfile
In the right panel, locate and delete the entry:
DisableNotifications = 1
Again In the right panel, locate and delete the entry:
DoNotAllowExceptions = 0
Again In the right panel, locate and delete the entry:
EnableFirewall = 0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile
In the right panel, locate and delete the entry:
DisableNotifications = 1
Again In the right panel, locate and delete the entry:
DoNotAllowExceptions = 0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile>AuthorizedApplications>List
In the right panel, locate and delete the entry:
%UserProfile%\0787E69677>winlogon.exe = %UserProfile%\0787E69677>winlogon.exe:*:Enabled:@xpsp2res.dll,-53342401
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows
Script Host>Settings
In the right panel, locate and delete the entry:
Enabled = 0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>WindowsFirewall>DomainProfile
In the right panel, locate and delete the entry:
EnableFirewall = 0
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>WindowsFirewall>StandardProfile
In the right panel, locate and delete the entry:
EnableFirewall = 0
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet
Explorer>Download
In the right panel, locate and delete the entry:
RunInvalidSignatures = 1
Close Registry Editor.

Step 5

Restore this modified registry value

[ Learn More ]

In HKEY_CLASSES_ROOT\http\shell\open\command
- From: Default = ""C:\Program Files\Internet Explorer\iexplore.exe""
  To: Default = ""C:\Program Files\Internet Explorer\iexplore.exe" -nohome"
In HKEY_CURRENT_USER\Control Panel\Sound
- From: Beep = no
  To: Beep = yes
In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download
- From: CheckExeSignatures = no
  To: CheckExeSignatures = yes
In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- From: Local Page = http://{BLOCKED}ld89293d1.directorio-w.com"
  To: Local Page = {varies}
In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- From: Start Page = http://{BLOCKED}j56mej584.directorio-w.com"
  To: Start Page = {varies}
In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
- From: Search Page = http://{BLOCKED}2hf91t180.directorio-w.com"
  To: Search Page = {varies}
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ftp\shell\open\command
- From: Default = ""C:\Program Files\Internet Explorer\iexplore.exe""
  To: Default = ""C:\Program Files\Internet Explorer\iexplore.exe" %1"
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\http\shell\open\command
- From: Default = ""C:\Program Files\Internet Explorer\iexplore.exe""
  To: Default = ""C:\Program Files\Internet Explorer\iexplore.exe" -nohome"
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
- From: Default_Page_URL = http://{BLOCKED}nc4v61a60.directorio-w.com"
  ToDefault_Page_URL = {varies}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
- From: Default_Search_URL = 'http://{BLOCKED}0g70qk767.directorio-w.com"
  To:Default_Search_URL = {varies}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
- From: Search Page =
  http://{BLOCKED}540s4dz0.directorio-w.com"
  To: Search Page = {varies}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
- From: Local Page =
  To'>http://{BLOCKED}j93wi5rlj.directorio-w.com"
  To: Local Page = {varies}
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
- From: Start Page = "
  http://{BLOCKED}0ls30my2g.directorio-w.com"
  To: Start Page = {varies}
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: Hidden = 2
  To: Hidden = 1
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: HideFileExt = 3
  To: HideFileExt = 0
In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: ShowSuperHidden = 0
  To: ShowSuperHidden = 1

To restore the registry value this malware/grayware modified:

Open Registry Editor. Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>http>shell>open>command
In the right panel, locate the registry value:
Default = ""C:>Program Files>Internet Explorer>iexplore.exe""
Right-click on the value name and choose Modify. Change the value data of this entry to:
Default = ""C:>Program Files>Internet Explorer>iexplore.exe"
-nohome"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Control Panel>Sound
In the right panel, locate the registry value:
Beep = no
Right-click on the value name and choose Modify. Change the value data of this entry to:
Beep = yes
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet
Explorer>Download
In the right panel, locate the registry value:
CheckExeSignatures = no
Right-click on the value name and choose Modify. Change the value data of this entry to:
CheckExeSignatures = yes
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet
Explorer>Main
In the right panel, locate the registry value:
Local Page =
http://{BLOCKED}ld89293d1.directorio-w.com" Page
Again In the right panel, locate the registry value:
Start Page = http://{BLOCKED}j56mej584.directorio-w.com"
Page
Again In the right panel, locate the registry value:
Search Page =
http://{BLOCKED}2hf91t180.directorio-w.com" Page
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ftp>shell>open>command
In the right panel, locate the registry value:
Default = ""C:>Program Files>Internet Explorer>iexplore.exe""
Right-click on the value name and choose Modify. Change the value data of this entry to:
Default = ""C:>Program Files>Internet Explorer>iexplore.exe"
%1"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>http>shell>open>command
In the right panel, locate the registry value:
Default = ""C:>Program Files>Internet Explorer>iexplore.exe""
Right-click on the value name and choose Modify. Change the value data of this entry to:
Default = ""C:>Program Files>Internet Explorer>iexplore.exe"
-nohome"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet
Explorer>Main
In the right panel, locate the registry value:
Default_Page_URL =
http://{BLOCKED}nc4v61a60.directorio-w.com
Again In the right panel, locate the registry value:
Default_Search_URL = http://{BLOCKED}0g70qk767.directorio-w.com
Again In the right panel, locate the registry value:
Search Page
= "http://{BLOCKED}9540s4dz0.directorio-w.com"Page
Again In the right panel, locate the registry value:
Local Page = http://{BLOCKED}j93wi5rlj.directorio-w.com
Page
Again In the right panel, locate the registry value:
Start Page = http://{BLOCKED}0ls30my2g.directorio-w.com
Page
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced
In the right panel, locate the registry value:
Hidden = 2
Right-click on the value name and choose Modify. Change the value data of this entry to:
Hidden = 1
Again In the right panel, locate the registry value:
HideFileExt = 3
Right-click on the value name and choose Modify. Change the value data of this entry to:
HideFileExt = 0
Again In the right panel, locate the registry value:
ShowSuperHidden = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
ShowSuperHidden = 1
Close Registry Editor.

Step 6

Remove these strings added by the malware/grayware/spyware in the HOSTS file

[ Learn More ]

{BLOCKED}.{BLOCKED}.222.58 www.antivirus-tools.com
{BLOCKED}.{BLOCKED}.217.252 sea.symantec.com
{BLOCKED}.{BLOCKED}.62.235 gdata.es
{BLOCKED}.{BLOCKED}.62.235 www.emsisoft.it
{BLOCKED}.{BLOCKED}.62.235 www.nottinghampoetryseries.com
{BLOCKED}.{BLOCKED}.73.196 www.mcafee.at
{BLOCKED}.{BLOCKED}.248.121 emsisoft.com
{BLOCKED}.{BLOCKED}.248.121 www.imddomains.co.uk
{BLOCKED}.{BLOCKED}.248.121 www.pandasecurity.com
{BLOCKED}.{BLOCKED}.254.65 training.drweb.com
{BLOCKED}.{BLOCKED}.20.49 scanner2.novirusthanks.or
{BLOCKED}.{BLOCKED}.85.202 antispam.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.93.172 www.spycheck.es
{BLOCKED}.{BLOCKED}.230.53 nprotect.com
{BLOCKED}.{BLOCKED}.230.53 www.emsisoft.nl
{BLOCKED}.{BLOCKED}.230.53 www.freeality.com
{BLOCKED}.{BLOCKED}.69.229 virustotal.com
{BLOCKED}.{BLOCKED}.244.248 kb.bitdefender.com
{BLOCKED}.{BLOCKED}.245.62 trial.trendmicro.com
{BLOCKED}.{BLOCKED}.164.243 www.sophos.com
{BLOCKED}.{BLOCKED}.90.113 daniloff.net
{BLOCKED}.{BLOCKED}.246.157 computing.net
{BLOCKED}.{BLOCKED}.78.39 www.eset.es
{BLOCKED}.{BLOCKED}.254.34 download1.emsisoft.com
{BLOCKED}.{BLOCKED}.254.34 www.antivir.es
{BLOCKED}.{BLOCKED}.254.34 www.garryowen.com
{BLOCKED}.{BLOCKED}.167.246 vos.symantec.com
{BLOCKED}.{BLOCKED}.73.233 www.comodopartners.com
{BLOCKED}.{BLOCKED}.73.233 www.frisk.is
{BLOCKED}.{BLOCKED}.249.160 research.microsoft.com
{BLOCKED}.{BLOCKED}.68.198 www.vba.com.by
{BLOCKED}.{BLOCKED}.69.105 networkassociates.com
{BLOCKED}.{BLOCKED}.250.161 avg.com
{BLOCKED}.{BLOCKED}.250.161 www.quickheal.com
{BLOCKED}.{BLOCKED}.64.19 nl.bitdefender.com
{BLOCKED}.{BLOCKED}.165.213 my.drweb.com
{BLOCKED}.{BLOCKED}.172.157 www.microsoft.com
{BLOCKED}.{BLOCKED}.90.82 download5.emsisoft.com
{BLOCKED}.{BLOCKED}.90.82 ribbonwarehouse.com
{BLOCKED}.{BLOCKED}.90.82 www.ahnlab.com
{BLOCKED}.{BLOCKED}.3.133 es.kioskea.net
{BLOCKED}.{BLOCKED}.86.209 blog.titanium-jewelry.com
{BLOCKED}.{BLOCKED}.86.209 www.bitdefender.be
{BLOCKED}.{BLOCKED}.73.202 fortinet.com
{BLOCKED}.{BLOCKED}.73.202 natsko.com
{BLOCKED}.{BLOCKED}.73.202 www.emsisoft.net
{BLOCKED}.{BLOCKED}.92.246 bg.virusblokada.com
{BLOCKED}.{BLOCKED}.98.215 et.symantec.com
{BLOCKED}.{BLOCKED}.255.4 mop.pandasecurity.com
{BLOCKED}.{BLOCKED}.93.85 home.mcafee.com
{BLOCKED}.{BLOCKED}.82.174 anubis.iseclab.org
{BLOCKED}.{BLOCKED}.189.5 news.drweb.com
{BLOCKED}.{BLOCKED}.96.250 f-secure.com
{BLOCKED}.{BLOCKED}.96.250 forum.emsisoft.com
{BLOCKED}.{BLOCKED}.96.250 www.ixomodels.com
{BLOCKED}.{BLOCKED}.2.75 investor.symantec.com
{BLOCKED}.{BLOCKED}.177.0 reg.eset.es
{BLOCKED}.{BLOCKED}.185.133 www.ikarus.at
{BLOCKED}.{BLOCKED}.171.126 speedtest.comodo.com
{BLOCKED}.{BLOCKED}.171.126 www.safenet-inc.com
{BLOCKED}.{BLOCKED}.246.69 us.mcafee.com
{BLOCKED}.{BLOCKED}.254.21 security.symantec.com
{BLOCKED}.{BLOCKED}.160.196 quickheal.com
{BLOCKED}.{BLOCKED}.160.196 www.mtr-design.com
{BLOCKED}.{BLOCKED}.160.196 www.trendmicro.com
{BLOCKED}.{BLOCKED}.180.3 es.trendmicro.com
{BLOCKED}.{BLOCKED}.167.253 www.fortinet.nl
{BLOCKED}.{BLOCKED}.93.122 jobs.bitdefender.com
{BLOCKED}.{BLOCKED}.7.174 disk-encryption.comodo.com
{BLOCKED}.{BLOCKED}.7.174 www.hasp.se
{BLOCKED}.{BLOCKED}.13.211 virusbuster.hu
{BLOCKED}.{BLOCKED}.14.50 service.mcafee.com
{BLOCKED}.{BLOCKED}.188.42 buscafacil.com
{BLOCKED}.{BLOCKED}.188.42 canada.karuna-shechen.org
{BLOCKED}.{BLOCKED}.188.42 www.norman.com
{BLOCKED}.{BLOCKED}.171.163 karuna-shechen.org
{BLOCKED}.{BLOCKED}.171.163 www.gdata.es
{BLOCKED}.{BLOCKED}.185.170 woottonfootball.com
{BLOCKED}.{BLOCKED}.185.170 www.bitdefender.com.vn
{BLOCKED}.{BLOCKED}.179.244 sitedirector.symantec.com
{BLOCKED}.{BLOCKED}.99.222 new-www.drweb.com
{BLOCKED}.{BLOCKED}.105.3 www.virusbuster.hu
{BLOCKED}.{BLOCKED}.106.98 cn.mcafee.com
{BLOCKED}.{BLOCKED}.19.149 eugrantsadvisor.de
{BLOCKED}.{BLOCKED}.7.211 www.emsisoft.com
{BLOCKED}.{BLOCKED}.7.211 www.mamutu.de
{BLOCKED}.{BLOCKED}.7.211 www.smf.org
{BLOCKED}.{BLOCKED}.27.94 support.kaspersky.co
{BLOCKED}.{BLOCKED}.14.86 drweb.net
{BLOCKED}.{BLOCKED}.253.26 specs.xmlsoap.org
{BLOCKED}.{BLOCKED}.167.71 new-beta.drweb.com
{BLOCKED}.{BLOCKED}.67.183 configurarequipos.com
{BLOCKED}.{BLOCKED}.15.20 liveupdate.symantec.com
{BLOCKED}.{BLOCKED}.9.51 www.anti-virus.by
{BLOCKED}.{BLOCKED}.10.214 msr.mcafee.com
{BLOCKED}.{BLOCKED}.191.14 malwarecity.netmalwarecity.org
{BLOCKED}.{BLOCKED}.179.9 sophos.com
{BLOCKED}.{BLOCKED}.104.133 pandasecurity.com
{BLOCKED}.{BLOCKED}.193.16 live.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.31.191 avast.com
{BLOCKED}.{BLOCKED}.31.191 www.cambridge-steiner-school.co.uk
{BLOCKED}.{BLOCKED}.31.191 www.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.106.135 solutions.drweb.com
{BLOCKED}.{BLOCKED}.101.5 cybercrime.pandasecurity.com
{BLOCKED}.{BLOCKED}.19.186 www.ibusca.me
{BLOCKED}.{BLOCKED}.200.54 kioskea.net
{BLOCKED}.{BLOCKED}.13.55 f-prot.com
{BLOCKED}.{BLOCKED}.13.55 malwarescan.emsisoft.com
{BLOCKED}.{BLOCKED}.13.55 sarahmcconnellphotography.net
{BLOCKED}.{BLOCKED}.107.136 definitions.symantec.com
{BLOCKED}.{BLOCKED}.27.63 www.bitdefende.de
{BLOCKED}.{BLOCKED}.27.63 www.hxproduction.com
{BLOCKED}.{BLOCKED}.102.194 www.fortifed.com
{BLOCKED}.{BLOCKED}.198.115 chickensroamfree.com
{BLOCKED}.{BLOCKED}.112.235 www.esafe.com
{BLOCKED}.{BLOCKED}.112.235 www.trustix.com
{BLOCKED}.{BLOCKED}.105.104 www.bitdefender.com
{BLOCKED}.{BLOCKED}.105.104 www.elvis-express.com
{BLOCKED}.{BLOCKED}.105.104 www.irangoals.com
{BLOCKED}.{BLOCKED}.162.197 shop.pandasecurity.com
{BLOCKED}.{BLOCKED}.75.60 blitzblank.com
{BLOCKED}.{BLOCKED}.75.60 hacksoft.com.pe
{BLOCKED}.{BLOCKED}.75.60 www.reviewsofbooks.com
{BLOCKED}.{BLOCKED}.126.242 www.gdata.es
{BLOCKED}.{BLOCKED}.33.231 futurenow.bitdefender.com
{BLOCKED}.{BLOCKED}.40.200 company.hauri.net
{BLOCKED}.{BLOCKED}.22.64 virobot.co.kr
{BLOCKED}.{BLOCKED}.204.27 network.drweb.com
{BLOCKED}.{BLOCKED}.23.227 mcafeeb2b.com
{BLOCKED}.{BLOCKED}.129.152 buscalo.in
{BLOCKED}.{BLOCKED}.129.152 www.manchester-offices.co.uk
{BLOCKED}.{BLOCKED}.129.152 www.microsoft.com
{BLOCKED}.{BLOCKED}.43.203 virusfreezone.info
{BLOCKED}.{BLOCKED}.125.23 fr.bitdefender.com
{BLOCKED}.{BLOCKED}.114.206 www.rising-global.com
{BLOCKED}.{BLOCKED}.195.25 smbstore.trendmicro.com
{BLOCKED}.{BLOCKED}.120.149 search.symantec.com
{BLOCKED}.{BLOCKED}.40.76 www.av-desk.com
{BLOCKED}.{BLOCKED}.216.70 www.eugrantsadvisor.de
{BLOCKED}.{BLOCKED}.149.191 drwebinside.com
{BLOCKED}.{BLOCKED}.88.67 neunet.orgnews.bitdefender.com
{BLOCKED}.{BLOCKED}.163.199 www.fortinet-apac.com
{BLOCKED}.{BLOCKED}.237.235 www.viruschief.com
{BLOCKED}.{BLOCKED}.211.196 search.ca.com
{BLOCKED}.{BLOCKED}.211.196 www.testmypcsecurity.com
{BLOCKED}.{BLOCKED}.204.64 ccslaughterspdx.com
{BLOCKED}.{BLOCKED}.204.64 hauri.net
{BLOCKED}.{BLOCKED}.204.64 www.mamutu.com
{BLOCKED}.{BLOCKED}.116.21 edm.symantec.com
{BLOCKED}.{BLOCKED}.124.247 ibusca.me
{BLOCKED}.{BLOCKED}.199.190 grv.microsoft.com
{BLOCKED}.{BLOCKED}.207.67 www.mcafee.com
{BLOCKED}.{BLOCKED}.200.192 avast.com
{BLOCKED}.{BLOCKED}.200.192 www.bitdefenderme.com
{BLOCKED}.{BLOCKED}.45.243 support.pandasecurity.com
{BLOCKED}.{BLOCKED}.141.164 in.answers.yahoo.com
{BLOCKED}.{BLOCKED}.208.1 jp.trendmicro.com
{BLOCKED}.{BLOCKED}.47.244 drweb.com
{BLOCKED}.{BLOCKED}.47.244 fortinet.co.at
{BLOCKED}.{BLOCKED}.121.120 tw.mcafee.com
{BLOCKED}.{BLOCKED}.40.45 anti-virus.by
{BLOCKED}.{BLOCKED}.40.45 www.emsisoft.jp
{BLOCKED}.{BLOCKED}.40.45 www.renningers.com
{BLOCKED}.{BLOCKED}.42.209 fr.trendmicro.com
{BLOCKED}.{BLOCKED}.116.246 eval.symantec.com
{BLOCKED}.{BLOCKED}.4.164 www.configurarequipos.com
{BLOCKED}.{BLOCKED}.224.172 defalcos.com
{BLOCKED}.{BLOCKED}.224.172 www.avx.ro
{BLOCKED}.{BLOCKED}.43.115 images.kaspersky.com
{BLOCKED}.{BLOCKED}.137.35 research.pandasecurity.com
{BLOCKED}.{BLOCKED}.219.205 scan4you.net
{BLOCKED}.{BLOCKED}.232.49 housecall60.trendmicro.com
{BLOCKED}.{BLOCKED}.138.224 fortilog.com
{BLOCKED}.{BLOCKED}.138.224 updates.drweb.com
{BLOCKED}.{BLOCKED}.76.62 www.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.59.219 blogs.protegerse.com
{BLOCKED}.{BLOCKED}.65.94 howsafeismypc.com
{BLOCKED}.{BLOCKED}.46.213 drweb.com
{BLOCKED}.{BLOCKED}.46.213 www.peterhearnwaste.co.uk
{BLOCKED}.{BLOCKED}.46.213 www.virusbuster.hu
{BLOCKED}.{BLOCKED}.140.38 enterprisesecur.symantec.com
{BLOCKED}.{BLOCKED}.121.157 www.ealaddin.com
{BLOCKED}.{BLOCKED}.121.157 www.livepcsupport.com
{BLOCKED}.{BLOCKED}.135.96 www.secure-elements.com
{BLOCKED}.{BLOCKED}.60.220 bitdefenderchina.com
{BLOCKED}.{BLOCKED}.60.220 easy-vpn.comodo.com
{BLOCKED}.{BLOCKED}.49.216 www.fortinet.com
{BLOCKED}.{BLOCKED}.42.84 de.bitdefender.com
{BLOCKED}.{BLOCKED}.219.174 company.hauri.co.kr
{BLOCKED}.{BLOCKED}.138.5 iniciorapido.info
{BLOCKED}.{BLOCKED}.138.5 www.buraka.tv
{BLOCKED}.{BLOCKED}.138.5 www.kaspersky.com
{BLOCKED}.{BLOCKED}.145.137 www.ealaddin.com
{BLOCKED}.{BLOCKED}.145.137 ztl.comodo.com
{BLOCKED}.{BLOCKED}.220.80 www.entercept.com
{BLOCKED}.{BLOCKED}.153.14 ushousecall02.trendmicro.com
{BLOCKED}.{BLOCKED}.154.177 www.computing.net
{BLOCKED}.{BLOCKED}.66.133 www.bitdefender.com
{BLOCKED}.{BLOCKED}.66.133 www.phoenixtrikeworks.com
{BLOCKED}.{BLOCKED}.84.32 iseclab.org
{BLOCKED}.{BLOCKED}.71.187 bitdefender.org
{BLOCKED}.{BLOCKED}.71.187 www.comodoantispam.com
{BLOCKED}.{BLOCKED}.159.231 www.softfaq.com
{BLOCKED}.{BLOCKED}.237.185 new-forum.drweb.com
{BLOCKED}.{BLOCKED}.61.3 www.symantec.com
{BLOCKED}.{BLOCKED}.55.222 mall.hauri.co.kr
{BLOCKED}.{BLOCKED}.157.180 www.engyro.com
{BLOCKED}.{BLOCKED}.56.60 nai.com
{BLOCKED}.{BLOCKED}.219.49 cureit.ru
{BLOCKED}.{BLOCKED}.145.174 trendmicro.com
{BLOCKED}.{BLOCKED}.145.174 www.collectedcurios.com
{BLOCKED}.{BLOCKED}.145.174 www.emsisoft.at
{BLOCKED}.{BLOCKED}.171.25 scanner.virus.org
{BLOCKED}.{BLOCKED}.158.181 www.avg.com
{BLOCKED}.{BLOCKED}.158.181 www.clamav.net
{BLOCKED}.{BLOCKED}.233.56 jiangmin.com
{BLOCKED}.{BLOCKED}.72.232 www.npin.co.kr
{BLOCKED}.{BLOCKED}.133.168 removetrojanvirus.org
{BLOCKED}.{BLOCKED}.146.107 go.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.153.51 smallbiz.symantec.com
{BLOCKED}.{BLOCKED}.54.96 www.pandasecurity.com
{BLOCKED}.{BLOCKED}.141.45 kb.bitdefender.us
{BLOCKED}.{BLOCKED}.148.177 me.kaspersky.com
{BLOCKED}.{BLOCKED}.61.228 esp.sophos.com
{BLOCKED}.{BLOCKED}.237.222 ahnlab.com
{BLOCKED}.{BLOCKED}.237.222 cutlines.org
{BLOCKED}.{BLOCKED}.237.222 www.pctools.com
{BLOCKED}.{BLOCKED}.235 antispyware.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.243.97 fortihero.com
{BLOCKED}.{BLOCKED}.243.97 pda.drweb.com
{BLOCKED}.{BLOCKED}.150.17 forospyware.com
{BLOCKED}.{BLOCKED}.149.178 emea.trendmicro.com
{BLOCKED}.{BLOCKED}.157.149 www.seasonsecurity.com
{BLOCKED}.{BLOCKED}.57.99 service1.symantec.com
{BLOCKED}.{BLOCKED}.233.25 wedoantivirus.com
{BLOCKED}.{BLOCKED}.247.114 vicentevirtual.com
{BLOCKED}.{BLOCKED}.240.238 chollian.nprotect.co.kr
{BLOCKED}.{BLOCKED}.79.146 drweb-inside.com
{BLOCKED}.{BLOCKED}.74.16 shield.prevx.com
{BLOCKED}.{BLOCKED}.62.10 www.aladdin.com
{BLOCKED}.{BLOCKED}.243.66 45pounds.com
{BLOCKED}.{BLOCKED}.243.66 download4.emsisoft.com
{BLOCKED}.{BLOCKED}.243.66 www.antiy.net
{BLOCKED}.{BLOCKED}.75.205 www.fortinet.sg
{BLOCKED}.{BLOCKED}.1.73 virusscanonline.net
{BLOCKED}.{BLOCKED}.239.194 buy.bitdefender.com
{BLOCKED}.{BLOCKED}.166.252 spywaredlls.prevx.com
{BLOCKED}.{BLOCKED}.79.115 www.barder.com
{BLOCKED}.{BLOCKED}.79.115 www.ikarus.at
{BLOCKED}.{BLOCKED}.160.27 esecurity.livecall.co.kr
{BLOCKED}.{BLOCKED}.161.190 obscgi.mcafee.com
{BLOCKED}.{BLOCKED}.248.234 mygeekside.com
{BLOCKED}.{BLOCKED}.235.227 www.iseclab.org
{BLOCKED}.{BLOCKED}.154.246 buy.drweb.com
{BLOCKED}.{BLOCKED}.74.241 cou85.com
{BLOCKED}.{BLOCKED}.88.248 sfdoccentral.symantec.com
{BLOCKED}.{BLOCKED}.79.65 blog.trendmicro.com
{BLOCKED}.{BLOCKED}.254.245 cloudprotection.pandasecurity.com
{BLOCKED}.{BLOCKED}.248.115 tr.mcafee.com
{BLOCKED}.{BLOCKED}.167.108 pineleafboys.com
{BLOCKED}.{BLOCKED}.167.108 www.comodo.com
{BLOCKED}.{BLOCKED}.167.108 www.latin-mass-society.org
{BLOCKED}.{BLOCKED}.241.240 support.drweb.com
{BLOCKED}.{BLOCKED}.241.240 www.virus.fi
{BLOCKED}.{BLOCKED}.163.30 antivirus.hispavista.com
{BLOCKED}.{BLOCKED}.162.123 training.trendmicro.com
{BLOCKED}.{BLOCKED}.75.242 buy.bitdefender-es.com
{BLOCKED}.{BLOCKED}.70.112 securitycheck.symantec.com
{BLOCKED}.{BLOCKED}.178.38 new-company.drweb.com
{BLOCKED}.{BLOCKED}.77.244 tw.trendmicro.com
{BLOCKED}.{BLOCKED}.166.33 www.eugrantsadvisor.com
{BLOCKED}.{BLOCKED}.167.34 download535.avast.com
{BLOCKED}.{BLOCKED}.167.34 quickheal.com
{BLOCKED}.{BLOCKED}.160.159 www.contentverification.com
{BLOCKED}.{BLOCKED}.160.159 www3.safenet-inc.com
{BLOCKED}.{BLOCKED}.86.27 onlinecheck.emsisoft.net
{BLOCKED}.{BLOCKED}.86.27 symantec.com
{BLOCKED}.{BLOCKED}.86.27 trackingtheworld.com
{BLOCKED}.{BLOCKED}.248.203 viruschief.com
{BLOCKED}.{BLOCKED}.74.22 seasonsecurity.com
{BLOCKED}.{BLOCKED}.87.217 podcasts.sophos.com
{BLOCKED}.{BLOCKED}.82.154 bobbondart.com
{BLOCKED}.{BLOCKED}.82.154 www.bitdefender.es
{BLOCKED}.{BLOCKED}.156.30 latam.kaspersky.com
{BLOCKED}.{BLOCKED}.251.206 nprotect.seoul.go.kr
{BLOCKED}.{BLOCKED}.2.244 scanner.novirusthanks.org
{BLOCKED}.{BLOCKED}.177.75 basetendencies.com
{BLOCKED}.{BLOCKED}.177.75 onlinecheck.emsisoft.org
{BLOCKED}.{BLOCKED}.177.75 sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.90.32 us.trendmicro.com
{BLOCKED}.{BLOCKED}.252.207 new-estore.drweb.com
{BLOCKED}.{BLOCKED}.252.207 www.fsecure.com
{BLOCKED}.{BLOCKED}.3.82 br.mcafee.com
{BLOCKED}.{BLOCKED}.16.251 www.jotti.org
{BLOCKED}.{BLOCKED}.143.54 au.mcafee.com
{BLOCKED}.{BLOCKED}.68.178 license.drweb.com
{BLOCKED}.{BLOCKED}.161.234 demos.eset.es
{BLOCKED}.{BLOCKED}.5.179 static.yoreparo.com
{BLOCKED}.{BLOCKED}.248.240 feeds.trendmicro.com
{BLOCKED}.{BLOCKED}.174.203 us.bitdefender.com
{BLOCKED}.{BLOCKED}.180.78 brazil.kaspersky.com
{BLOCKED}.{BLOCKED}.87.254 liveprotect.net
{BLOCKED}.{BLOCKED}.182.12 housecall65.trendmicro.com
{BLOCKED}.{BLOCKED}.20.255 www.contentverification.com
{BLOCKED}.{BLOCKED}.20.255 www.f-secure.com
{BLOCKED}.{BLOCKED}.15.125 spywarefiles.prevx.com
{BLOCKED}.{BLOCKED}.8.250 eugrantsadvisor.cz
{BLOCKED}.{BLOCKED}.90.1 www.symantec.com
{BLOCKED}.{BLOCKED}.10.183 avx.rob-have.net
{BLOCKED}.{BLOCKED}.10.183 bugs.clamav.net
{BLOCKED}.{BLOCKED}.3.119 secureme.com
{BLOCKED}.{BLOCKED}.252.244 bitdefender.com
{BLOCKED}.{BLOCKED}.252.244 www.1stavenuelimousines.co.uk
{BLOCKED}.{BLOCKED}.252.244 www.hacksoft.com.pe
{BLOCKED}.{BLOCKED}.16.126 www.fortinet.net
{BLOCKED}.{BLOCKED}.180.47 bitdefenderusa.com
{BLOCKED}.{BLOCKED}.220.97 bcpzonasegura.viabcp.com
{BLOCKED}.{BLOCKED}.220.97 viabcp.com
{BLOCKED}.{BLOCKED}.220.97 www.viabcp.com
{BLOCKED}.{BLOCKED}.255.247 www.fortimail.com
{BLOCKED}.{BLOCKED}.169.204 hauri.co.kr
{BLOCKED}.{BLOCKED}.20.224 halmapr.com
{BLOCKED}.{BLOCKED}.20.224 www.fortinet.com
{BLOCKED}.{BLOCKED}.250.117 br.trendmicro.com
{BLOCKED}.{BLOCKED}.95.167 ealaddin.orgeshop.aladdin.com
{BLOCKED}.{BLOCKED}.101.43 uk.mcafee.com
{BLOCKED}.{BLOCKED}.16.95 www.bitdefender-es.com
{BLOCKED}.{BLOCKED}.16.95 www.wellgousa.com
{BLOCKED}.{BLOCKED}.103.233 apac.trendmicro.com
{BLOCKED}.{BLOCKED}.11.222 marian.symantec.com
{BLOCKED}.{BLOCKED}.112.16 mcafee.com
{BLOCKED}.{BLOCKED}.112.16 www.emsisoft.es
{BLOCKED}.{BLOCKED}.112.16 www.fimasys.com
{BLOCKED}.{BLOCKED}.193.185 shop.hauri.co.kr
{BLOCKED}.{BLOCKED}.187.148 new-partners.drweb.com
{BLOCKED}.{BLOCKED}.193.91 fr.mcafee.com
{BLOCKED}.{BLOCKED}.107.142 www.xmlsoap.org
{BLOCKED}.{BLOCKED}.101.12 store.drweb.com
{BLOCKED}.{BLOCKED}.94.136 kimzimmer.net
{BLOCKED}.{BLOCKED}.94.136 sophos.com
{BLOCKED}.{BLOCKED}.94.136 www.trojaner.info
{BLOCKED}.{BLOCKED}.189.56 jotti.org
{BLOCKED}.{BLOCKED}.108.144 www.avast.com
{BLOCKED}.{BLOCKED}.108.144 www.malwarecity.com
{BLOCKED}.{BLOCKED}.115.19 ikarus.at
{BLOCKED}.{BLOCKED}.28.138 kr.sophos.com
{BLOCKED}.{BLOCKED}.21.195 sandbox.norman.com
{BLOCKED}.{BLOCKED}.8.0 intranet.cidiroax.ipn.mx
{BLOCKED}.{BLOCKED}.103.14 sun.symantec.com
{BLOCKED}.{BLOCKED}.23.8 it.bitdefender.com
{BLOCKED}.{BLOCKED}.97.139 usa.kaspersky.com
{BLOCKED}.{BLOCKED}.192.59 www.nprotect.com.br
{BLOCKED}.{BLOCKED}.163.235 backup.comodo.com
{BLOCKED}.{BLOCKED}.163.235 bitdefender.com
{BLOCKED}.{BLOCKED}.118.185 saverssite.com
{BLOCKED}.{BLOCKED}.118.185 www.buscalo.in
{BLOCKED}.{BLOCKED}.118.185 www.eset.es
{BLOCKED}.{BLOCKED}.31.141 www.trendmicro.com
{BLOCKED}.{BLOCKED}.193.60 fsecure.nlwebyard.com
{BLOCKED}.{BLOCKED}.193.60 www.nsclean.com
{BLOCKED}.{BLOCKED}.206.229 threatinfo.trendmicro.com
{BLOCKED}.{BLOCKED}.11.2 support.rising-global.com
{BLOCKED}.{BLOCKED}.114.56 store.bitdefender.com
{BLOCKED}.{BLOCKED}.29.108 new-solutions.drweb.com
{BLOCKED}.{BLOCKED}.210.233 aladdin.com
{BLOCKED}.{BLOCKED}.210.233 etrr.co.uk
{BLOCKED}.{BLOCKED}.210.233 www.emsisoft.com
{BLOCKED}.{BLOCKED}.24.235 info.prevx.com
{BLOCKED}.{BLOCKED}.193.97 malwarescan.emsisoft.es
{BLOCKED}.{BLOCKED}.193.97 virusbuster.hu
{BLOCKED}.{BLOCKED}.193.97 www.briarhurst.com
{BLOCKED}.{BLOCKED}.200.229 ealaddin.net
{BLOCKED}.{BLOCKED}.206.36 square.bitdefender.com
{BLOCKED}.{BLOCKED}.213.236 www.fortinet.com
{BLOCKED}.{BLOCKED}.189.225 bitdefendertaiwan.com
{BLOCKED}.{BLOCKED}158.106 servicenews.symantec.com
{BLOCKED}.{BLOCKED}.2.88 www.beautybar.com
{BLOCKED}.{BLOCKED}.2.88 www.clamav.net
{BLOCKED}.{BLOCKED}.2.88 www.indielisboa.com
{BLOCKED}.{BLOCKED}.34.20 pandalabs.pandasecurity.com
{BLOCKED}.{BLOCKED}.197.34 de.trendmicro.com
{BLOCKED}.{BLOCKED}.48.27 www.prevx.com
{BLOCKED}.{BLOCKED}.36.21 fortinet.com
{BLOCKED}.{BLOCKED}.36.21 vms.drweb.com
{BLOCKED}.{BLOCKED}.29.77 baristamagazine.com
{BLOCKED}.{BLOCKED}.29.77 www.f-prot.com
{BLOCKED}.{BLOCKED}.29.77 www.zarya.info
{BLOCKED}.{BLOCKED}.110.58 www.globalhauri.com
{BLOCKED}.{BLOCKED}.110.152 go.mcafee.com
{BLOCKED}.{BLOCKED}.130.196 es.answers.yahoo.com
{BLOCKED}.{BLOCKED}.44.154 ru.trendmicro.com
{BLOCKED}.{BLOCKED}.24.15 pedidos.protegerse.com
{BLOCKED}.{BLOCKED}.213.205 bitdefendermalaysia.com
{BLOCKED}.{BLOCKED}.27.18 itw.trendmicro.com
{BLOCKED}.{BLOCKED}.208.75 dell.symantec.com
{BLOCKED}.{BLOCKED}.128.1 free.drweb.com
{BLOCKED}.{BLOCKED}.53.126 bhsbees.com
{BLOCKED}.{BLOCKED}.53.126 www.ca.com
{BLOCKED}.{BLOCKED}.53.126 www.prdouglas.co.uk
{BLOCKED}.{BLOCKED}.48.252 www.sysinternals.com
{BLOCKED}.{BLOCKED}.110.189 auwww.ealaddin.nl
{BLOCKED}.{BLOCKED}.110.189 www.whichssl.com
{BLOCKED}.{BLOCKED}.130.165 www.virscan.org
{BLOCKED}.{BLOCKED}.35.246 cowsmo.com
{BLOCKED}.{BLOCKED}.35.246 prevx.com
{BLOCKED}.{BLOCKED}.35.246 www.emsisoft.org
{BLOCKED}.{BLOCKED}.49.253 www.authentium.com.au
{BLOCKED}.{BLOCKED}.49.253 www.bitdefender.us
{BLOCKED}.{BLOCKED}.225.248 cn.sophos.com
{BLOCKED}.{BLOCKED}.9.32 company.drweb.com
{BLOCKED}.{BLOCKED}.172.207 spycheck.es
{BLOCKED}.{BLOCKED}.31.117 www.bitdefender.com.sg
{BLOCKED}.{BLOCKED}.31.117 www.secondchanceboxer.com
{BLOCKED}.{BLOCKED}.201.236 biz.nprotect.com
{BLOCKED}.{BLOCKED}.215.82 shop.trendmicro.com
{BLOCKED}.{BLOCKED}.127.38 onlinecheck.emsisoft.de
{BLOCKED}.{BLOCKED}.127.38 pctools.com
{BLOCKED}.{BLOCKED}.127.38 www.handwritingforkids.com
{BLOCKED}.{BLOCKED}.134.170 f-secure.frf-secure.hk
{BLOCKED}.{BLOCKED}.134.170 timestamp.wosign.com
{BLOCKED}.{BLOCKED}.208.206 haurijapan.com
{BLOCKED}.{BLOCKED}.40.250 www.hacksoft.pe
{BLOCKED}.{BLOCKED}.209.113 jp.mcafee.com
{BLOCKED}.{BLOCKED}.222.214 virscan.org
{BLOCKED}.{BLOCKED}.143.47 subwiz.trendmicro.com
{BLOCKED}.{BLOCKED}.55.165 sales.bitdefender.com
{BLOCKED}.{BLOCKED}.130.41 www.kaspersky.com
{BLOCKED}.{BLOCKED}.143.209 spycheck.co.uk
{BLOCKED}.{BLOCKED}.50.36 visualtracking.symantec.com
{BLOCKED}.{BLOCKED}.225.217 15660808.co.kr
{BLOCKED}.{BLOCKED}.219.86 comodo.com
{BLOCKED}.{BLOCKED}.219.86 www.emeraldclassic.co.uk
{BLOCKED}.{BLOCKED}.219.86 www.hauri.net
{BLOCKED}.{BLOCKED}.64.43 hacksoft.pe
{BLOCKED}.{BLOCKED}.226.218 f-secure.com
{BLOCKED}.{BLOCKED}.226.218 secure-email.comodo.com
{BLOCKED}{BLOCKED}.40.31 sunbeltsoftware.com
{BLOCKED}{BLOCKED}.146.212 www.exchangeyourcareer.com
{BLOCKED}.{BLOCKED}.221.88 together.pctools.com
{BLOCKED}.{BLOCKED}.147.214 cgi.clamav.net
{BLOCKED}.{BLOCKED}.147.214 grisoft.com
{BLOCKED}.{BLOCKED}.134.207 antiy.net
{BLOCKED}.{BLOCKED}.134.207 ruben.bzin.net
{BLOCKED}.{BLOCKED}.134.207 www.rising-global.com
{BLOCKED}.{BLOCKED}.222.89 www.fortinet.co.il
{BLOCKED}.{BLOCKED}.209.82 alladdin.ru
{BLOCKED}.{BLOCKED}.241.21 norman.com
{BLOCKED}.{BLOCKED}.241.21 vivo-austin.com
{BLOCKED}.{BLOCKED}.241.21 www.emsisoft.fr
{BLOCKED}.{BLOCKED}.122.201 www.removetrojanvirus.org
{BLOCKED}.{BLOCKED}.143.178 threatexpert.com
{BLOCKED}.{BLOCKED}.130.78 bitdefenderguatemala.com
{BLOCKED}.{BLOCKED}.130.78 www.trustlogo.com
{BLOCKED}.{BLOCKED}.238.193 www.norman.com
{BLOCKED}.{BLOCKED}.226.255 pvtc.org
{BLOCKED}.{BLOCKED}.226.255 www.aladdin.com
{BLOCKED}.{BLOCKED}.226.255 www.owen.org
{BLOCKED}.{BLOCKED}.232.130 aladdin.com
{BLOCKED}.{BLOCKED}.57.231 beta.anti-virus.by
{BLOCKED}.{BLOCKED}.51.6 mx.mcafee.com
{BLOCKED}.{BLOCKED}.241.7 la.trendmicro.com
{BLOCKED}.{BLOCKED}.255.216 www.bitdefender.de
{BLOCKED}.{BLOCKED}.255.216 www.deborahshelton.net
{BLOCKED}.{BLOCKED}.80.196 www.novirusthanks.org
{BLOCKED}.{BLOCKED}.175.210 superboy2010.com.au
{BLOCKED}.{BLOCKED}.169.80 www.bitdefender.cl
{BLOCKED}.{BLOCKED}.169.80 www.brightoctober.com
{BLOCKED}.{BLOCKED}.83.199 www.nprotect.co.kr
{BLOCKED}.{BLOCKED}.57.105 schemas.microsoft.com
{BLOCKED}.{BLOCKED}.63.49 www.prevx1.com
{BLOCKED}.{BLOCKED}.91.76 de.mcafee.com
{BLOCKED}.{BLOCKED}.158.237 pg.hauri.net
{BLOCKED}.{BLOCKED}.178.213 education.symantec.com
{BLOCKED}.{BLOCKED}.84.200 frisk-software.com
{BLOCKED}.{BLOCKED}.84.200 internetsecurity.comodo.com
{BLOCKED}.{BLOCKED}.97.45 go.trendmicro.com
{BLOCKED}.{BLOCKED}.9.1 eset.es
{BLOCKED}.{BLOCKED}.9.1 qqjkw.net
{BLOCKED}.{BLOCKED}.9.1 ww.emsisoft.com
{BLOCKED}.{BLOCKED}.172.176 novirusthanks.org
{BLOCKED}.{BLOCKED}.92.78 store.trendmicro.com
{BLOCKED}.{BLOCKED}.5.128 malwarepedia.com
{BLOCKED}.{BLOCKED}.80.72 global.jiangmin.com
{BLOCKED}.{BLOCKED}.174.247 global.nprotect.com
{BLOCKED}.{BLOCKED}.14.5 www4.symantec.com
{BLOCKED}.{BLOCKED}.7.130 firewall.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.101.49 avg.com
{BLOCKED}.{BLOCKED}.101.49 naturesimages.net
{BLOCKED}.{BLOCKED}.101.49 www.symantec.com
{BLOCKED}.{BLOCKED}.0.254 tms.symantec.com
{BLOCKED}.{BLOCKED}.7.36 softfaq.com
{BLOCKED}.{BLOCKED}.182.124 schemas.xmlsoap.org
{BLOCKED}.{BLOCKED}.176.180 i-vault.comodo.com
{BLOCKED}.{BLOCKED}.176.180 www.f-prot.com
{BLOCKED}.{BLOCKED}.96.175 www.eugrantsadvisor.se
{BLOCKED}.{BLOCKED}.171.119 free.pandasecurity.com
{BLOCKED}.{BLOCKED}.83.169 developmentdrums.org
{BLOCKED}.{BLOCKED}.83.169 www.buscafacil.com
{BLOCKED}.{BLOCKED}.83.169 www.nprotect.com
{BLOCKED}.{BLOCKED}.97.176 files.avast.com
{BLOCKED}.{BLOCKED}.97.176 www.malwarecity.fr
{BLOCKED}.{BLOCKED}.104.52 www.fortiid.com
{BLOCKED}.{BLOCKED}.18.104 tempuri.org
{BLOCKED}.{BLOCKED}.12.41 b-have.orgbitdefender-ar.com
{BLOCKED}.{BLOCKED}.12.41 system-cleaner.comodo.com
{BLOCKED}.{BLOCKED}.93.141 www.avhide.com
{BLOCKED}.{BLOCKED}.232.99 bestofewan.com
{BLOCKED}.{BLOCKED}.232.99 onlinecheck.emsisoft.com
{BLOCKED}.{BLOCKED}.232.99 pandasecurity.com
{BLOCKED}.{BLOCKED}.246.106 www.authentium.com
{BLOCKED}.{BLOCKED}.246.106 www.bitdefender.fr
{BLOCKED}.{BLOCKED}.65.50 www.fortinetuk.com
{BLOCKED}.{BLOCKED}.51.43 new-support.drweb.com
{BLOCKED}.{BLOCKED}.145.218 www.tecniservicioslys.com
{BLOCKED}.{BLOCKED}.139.87 www.virustotal.com
{BLOCKED}.{BLOCKED}.188.223 reg-int.nod32-es.com
{BLOCKED}.{BLOCKED}.107.217 ixomodels.com
{BLOCKED}.{BLOCKED}.107.217 www.quickheal.com
{BLOCKED}.{BLOCKED}.107.217 www.tomorrowsedge.net
{BLOCKED}.{BLOCKED}.195.5 newsletters.trendmicro.com
{BLOCKED}.{BLOCKED}.182.93 www.freedrweb.ru
{BLOCKED}.{BLOCKED}.196.100 support.mcafee.com
{BLOCKED}.{BLOCKED}.117.189 avhide.com
{BLOCKED}.{BLOCKED}.104.89 store.de.bitdefender.com
{BLOCKED}.{BLOCKED}.191.226 esupport.trendmicro.com
{BLOCKED}.{BLOCKED}.105.23 symantec.com
{BLOCKED}.{BLOCKED}.199.10 ca.com
{BLOCKED}.{BLOCKED}.199.10 www.anti-trojan.net
{BLOCKED}.{BLOCKED}.199.10 www.avoncourt.com
{BLOCKED}.{BLOCKED}.18.141 customers.drweb.com
{BLOCKED}.{BLOCKED}.113.61 www.virusfreezone.info
{BLOCKED}.{BLOCKED}.182.130 cohartuk.com
{BLOCKED}.{BLOCKED}.182.130 malwarescan.emsisoft.de
{BLOCKED}.{BLOCKED}.182.130 microsoft.com
{BLOCKED}.{BLOCKED}.13.11 free.prevx.com
{BLOCKED}.{BLOCKED}.95.181 www.kioskea.net
{BLOCKED}.{BLOCKED}.195.69 www.bitdefender.com.tw
{BLOCKED}.{BLOCKED}.195.69 www.residentphotography.com
{BLOCKED}.{BLOCKED}.202.13 arwww.fortinet.cz
{BLOCKED}.{BLOCKED}.116.64 www.risingav.com.au
{BLOCKED}.{BLOCKED}.234.101 feeds.sophos.com
{BLOCKED}.{BLOCKED}.159.225 fsc.norman.com
{BLOCKED}.{BLOCKED}.178.1 bitdefenderuruguay.com
{BLOCKED}.{BLOCKED}.23.52 www.nprotect.com
{BLOCKED}.{BLOCKED}.187.135 hostedmailsecur.symantec.com
{BLOCKED}.{BLOCKED}.18.110 www.f-secure.com
{BLOCKED}.{BLOCKED}.18.110 www.gokidding.com
{BLOCKED}.{BLOCKED}.18.110 www.willsee.com
{BLOCKED}.{BLOCKED}.25.54 cai.com
{BLOCKED}.{BLOCKED}.25.54 www.ccssforum.org
{BLOCKED}.{BLOCKED}.38.61 forum.kaspersky.com
{BLOCKED}.{BLOCKED}.202.238 malwarecity.com
{BLOCKED}.{BLOCKED}.204.239 shop.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.42.158 authentium.com
{BLOCKED}.{BLOCKED}.42.158 welkam.co.jp
{BLOCKED}.{BLOCKED}.42.158 www.sophos.com
{BLOCKED}.{BLOCKED}.117.102 info.drweb.com
{BLOCKED}.{BLOCKED}.16.146 www.midescargas.com
{BLOCKED}.{BLOCKED}.123.233 privacy.microsoft.com
{BLOCKED}.{BLOCKED}.24.23 rising-global.com
{BLOCKED}.{BLOCKED}.24.23 scan.anti-trojan.net
{BLOCKED}.{BLOCKED}.24.23 www.2xlgames.com
{BLOCKED}.{BLOCKED}.111.228 timeforyourbusi.pandasecurity.com
{BLOCKED}.{BLOCKED}.119.198 virusscan.jotti.org
{BLOCKED}.{BLOCKED}.38.30 linux.bitdefender.com
{BLOCKED}.{BLOCKED}.113.161 www.apsecure.com
{BLOCKED}.{BLOCKED}.241.232 securityrespons.symantec.com
{BLOCKED}.{BLOCKED}.228.227 buy.bitdefender.de
{BLOCKED}.{BLOCKED}.214.24 tw.sophos.com
{BLOCKED}.{BLOCKED}.20.150 archive.bitdefender.com
{BLOCKED}.{BLOCKED}.20.150 lists.clamav.net
{BLOCKED}.{BLOCKED}.33.63 www.scan4you.net
{BLOCKED}.{BLOCKED}.40.194 midescargas.com
{BLOCKED}.{BLOCKED}.190.13 nprotect.net
{BLOCKED}.{BLOCKED}.129.77 eos.eset.es
{BLOCKED}.{BLOCKED}.29.27 housecall.trendmicro.com
{BLOCKED}.{BLOCKED}.137.209 fortiwifi.com
{BLOCKED}.{BLOCKED}.116.71 www.avg.com
{BLOCKED}.{BLOCKED}.116.71 www.internationalservicecheck.com
{BLOCKED}.{BLOCKED}.116.71 www.stadiumpage.com
{BLOCKED}.{BLOCKED}.123.202 f-secure.nlfsecure.com
{BLOCKED}.{BLOCKED}.123.202 rover800.gaima.co.uk
{BLOCKED}.{BLOCKED}.111.197 exchangeyourcareer.net
{BLOCKED}.{BLOCKED}.132.80 it.trendmicro.com
{BLOCKED}.{BLOCKED}.44.198 antivirus-tools.com
{BLOCKED}.{BLOCKED}.44.198 wwws.clamav.net
{BLOCKED}.{BLOCKED}.119.235 www.hauri.co.kr
{BLOCKED}.{BLOCKED}.140.119 roysephotos.com
{BLOCKED}.{BLOCKED}.140.119 www.avast.com
{BLOCKED}.{BLOCKED}.140.119 www.hackshields.com
{BLOCKED}.{BLOCKED}.215.251 promotions.drweb.com
{BLOCKED}.{BLOCKED}.54.170 tecniservicioslys.com
{BLOCKED}.{BLOCKED}.211.27 www.hauri.net
{BLOCKED}.{BLOCKED}.123.239 kaspersky.com
{BLOCKED}.{BLOCKED}.123.239 mamutu.com
{BLOCKED}.{BLOCKED}.123.239 www.flairweddings.co.uk
{BLOCKED}.{BLOCKED}.142.90 siren24.nprotect.com
{BLOCKED}.{BLOCKED}.80.153 www.eugrantsadvisor.ie
{BLOCKED}.{BLOCKED}.136.246 www.bitdefender.com.au
{BLOCKED}.{BLOCKED}.136.246 www.professorbeyer.com
{BLOCKED}.{BLOCKED}.124.173 www.freerav.com
{BLOCKED}.{BLOCKED}.119.111 www.bit-defender.de
{BLOCKED}.{BLOCKED}.119.111 www.celticmerchant.com
{BLOCKED}.{BLOCKED}.132.211 www.threatexpert.com
{BLOCKED}.{BLOCKED}.32.162 webadmin.norman.no
{BLOCKED}.{BLOCKED}.40.39 networkassociates.nai.com
{BLOCKED}.{BLOCKED}.215.32 ixostore.ixomodels.com
{BLOCKED}.{BLOCKED}.215.32 jiangmin.com
{BLOCKED}.{BLOCKED}.215.32 www.anti-trojan-software.net
{BLOCKED}.{BLOCKED}.222.163 online-backup.comodo.com
{BLOCKED}.{BLOCKED}.222.163 www.netegrity.com
{BLOCKED}.{BLOCKED}.222.238 bancoguayaquil.com
{BLOCKED}.{BLOCKED}.222.238 pichincha.com
{BLOCKED}.{BLOCKED}.222.238 produbanco.com
{BLOCKED}.{BLOCKED}.222.238 www.bancoguayaquil.com
{BLOCKED}.{BLOCKED}.222.238 www.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 www.produbanco.com
{BLOCKED}.{BLOCKED}.222.238 wwwp1.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwwp2.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwwp3.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwwp4.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww01.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww02.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww03.pichincha.com
{BLOCKED}.{BLOCKED}.222.238 wwww04.pichincha.com
{BLOCKED}.{BLOCKED}.47.170 www.jiangmin.com.cn
{BLOCKED}.{BLOCKED}.148.221 www.retento.com
{BLOCKED}.{BLOCKED}.230.40 uk.trendmicro.com
{BLOCKED}.{BLOCKED}.211.159 latin.bitdefender.com
{BLOCKED}.{BLOCKED}.218.34 gdata.es
{BLOCKED}.{BLOCKED}.56.210 register.norman.com
{BLOCKED}.{BLOCKED}.145.93 antivirus.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.51.12 antivir.es
{BLOCKED}.{BLOCKED}.51.12 elblogdemanu.com
{BLOCKED}.{BLOCKED}.51.12 www.prevx.com
{BLOCKED}.{BLOCKED}.206.29 go.symantec.com
{BLOCKED}.{BLOCKED}.57.211 cacomvip.ca.com
{BLOCKED}.{BLOCKED}.57.211 www.comodo.tv
{BLOCKED}.{BLOCKED}.132.87 it.mcafee.com
{BLOCKED}.{BLOCKED}.46.138 encarta.msn.com
{BLOCKED}.{BLOCKED}.213.255 www.spycheck.co.uk
{BLOCKED}.{BLOCKED}.143.91 timestamp.comodoca.com
{BLOCKED}.{BLOCKED}.143.91 www.frisk-software.com
{BLOCKED}.{BLOCKED}.156.191 channelpartner.trendmicro.com
{BLOCKED}.{BLOCKED}.237.104 www.hacksoft.com.pe
{BLOCKED}.{BLOCKED}.68.147 www.antivir.es
{BLOCKED}.{BLOCKED}.68.147 www.jiangmin.com
{BLOCKED}.{BLOCKED}.221.132 www.dr-bull.com
{BLOCKED}.{BLOCKED}.221.132 www.iniciorapido.info
{BLOCKED}.{BLOCKED}.221.132 www.mcafee.com
{BLOCKED}.{BLOCKED}.54.83 fortiprotect.com
{BLOCKED}.{BLOCKED}.235.139 asap.authentium.com
{BLOCKED}.{BLOCKED}.235.139 www.bitdefender.hk
{BLOCKED}.{BLOCKED}.230.172 www.virus.org
{BLOCKED}.{BLOCKED}.156.135 mcafeeretail.com
{BLOCKED}.{BLOCKED}.217.3 lurker.clamav.net
{BLOCKED}.{BLOCKED}.217.3 www.grisoft.com
{BLOCKED}.{BLOCKED}.70.186 descargas.eset.es
{BLOCKED}.{BLOCKED}.57.180 global.ahnlab.com
{BLOCKED}.{BLOCKED}.57.180 isotopecomics.com
{BLOCKED}.{BLOCKED}.57.180 www.authentium.com
{BLOCKED}.{BLOCKED}.132.124 secure.av-desk.com
{BLOCKED}.{BLOCKED}.145.224 wtc.trendmicro.com
{BLOCKED}.{BLOCKED}.146.63 kaspersky.com
{BLOCKED}.{BLOCKED}.53.52 renewals.bitdefender.com
{BLOCKED}.{BLOCKED}.66.152 virus.org
{BLOCKED}.{BLOCKED}.59.89 www.bg.virusblokada.com
{BLOCKED}.{BLOCKED}.229.46 oem.sunbeltsoftware.com
{BLOCKED}.{BLOCKED}.149.228 clamav.net
{BLOCKED}.{BLOCKED}.149.228 dev.depeuter.org
{BLOCKED}.{BLOCKED}.149.228 www.anti-virus.by
{BLOCKED}.{BLOCKED}.156.104 products.drweb.com
{BLOCKED}.{BLOCKED}.243.53 securityrespons.symantec.com
{BLOCKED}.{BLOCKED}.62.23 www.mygeekside.com
{BLOCKED}.{BLOCKED}.64.93 ikarus.at
{BLOCKED}.{BLOCKED}.64.93 www.emsisoft.de
{BLOCKED}.{BLOCKED}.64.93 www.sheffieldmind.co.uk
{BLOCKED}.{BLOCKED}.151.230 soporte.pandasecurity.com
{BLOCKED}.{BLOCKED}.152.231 www.fortinet.ch
{BLOCKED}.{BLOCKED}.77.100 hishomeforchildren.com
{BLOCKED}.{BLOCKED}.77.100 www.bitdefender.co.uk
{BLOCKED}.{BLOCKED}.233.144 www.forospyware.com
{BLOCKED}.{BLOCKED}.248.152 www.aks.com
{BLOCKED}.{BLOCKED}.229.15 nprobeta.norman.com
{BLOCKED}.{BLOCKED}.156.141 www.arpia.be
{BLOCKED}.{BLOCKED}.156.141 www.drweb.com
{BLOCKED}.{BLOCKED}.156.141 www.mountainlakeslodge.com
{BLOCKED}.{BLOCKED}.244.24 jiangmin.com.cn
{BLOCKED}.{BLOCKED}.230.16 idauthority.com
{BLOCKED}.{BLOCKED}.230.16 www.ca.com
{BLOCKED}.{BLOCKED}.152.12 kb.bitdefender.de

Step 7

Search and delete AUTORUN.INF files created by WORM_VBNA.WPB that contain these strings

[ Learn More ]

{garbage}
[autorun]
{garbage}
open=85luFefZ08lzEPQXsS014zzp9LV3F54yhE0zz5k0g\S-1-3-01-4639134501-7494416267-104346834-7052\Ua3kmh73O3jyut4Iok.exe
{garbage}
icon=%SystemRoot%\system32\SHELL32.dll,4
{garbage}
action=Abrir la carpeta para ver los archivos
{garbage}
shell\open=Open
{garbage}
shell\open\command=85luFefZ08lzEPQXsS014zzp9LV3F54yhE0zz5k0g\S-1-3-01-4639134501-7494416267-104346834-7052\Ua3kmh73O3jyut4Iok.exe
{garbage}
shell\open\default=1
{garbage}

Step 8

Scan your computer with your Trend Micro product to delete files detected as WORM_VBNA.WPB. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.

WORM_VBNA.WPB

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

WORM_VBNA.WPB

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific