TROJ_DLOADE.IV

January 02, 2013
 ALIASES:

TrojanDownloader:Win32/Horst.gen (Microsoft); Downloader-BOW (McAfee); Downloader.Trojan (Symantec); Trojan.Win32.Generic!BT (Sunbelt); Trojan.Horst.YF (FSecure)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It disables Task Manager, Registry Editor, and Folder Options.

  TECHNICAL DETAILS

File Size:

81,920 bytes

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

01 Jan 2013

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

  • %Application Data%\MICROS~1\mqtgsvc.exe
  • %Application Data%\MICROS~1\mstinit.exe
  • %User Temp%\clipsrv.exe
  • %Windows%\cmstp.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Windows% is the Windows folder, which is usually C:\Windows.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Policies\Explorer\Run

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
MqtgSVC = "%Application Data%\MICROS~1\mqtgsvc.exe /waitservice"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
load = "%Windows%\cmstp.exe"

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
MstInit = "%Application Data%\MICROS~1\mstinit.exe /waitservice"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
ClipSrv = "%User Temp%\clipsrv.exe /waitservice"

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://www.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://www.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://www.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://www1.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://www1.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://www1.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://www2.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://www2.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://www2.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwln.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwst.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwjk.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaa.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaa.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaa.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwab.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwab.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwab.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwac.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwac.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwac.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwad.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwad.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwad.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwae.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwae.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwae.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaf.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaf.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaf.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwag.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwag.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwag.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwah.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwah.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwah.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwai.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwai.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwai.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaj.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaj.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaj.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwak.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwak.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwak.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwal.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwal.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwal.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwam.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwam.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwam.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwan.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwan.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwan.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwao.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwao.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwao.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwap.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwap.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwap.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaq.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaq.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaq.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwar.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwar.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwar.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwas.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwas.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwas.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwat.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwat.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwat.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwau.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwau.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwau.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwav.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwav.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwav.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaw.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaw.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaw.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwax.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwax.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwax.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwway.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwway.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwway.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaz.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaz.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwaz.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwba.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwba.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwba.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbb.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbb.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbb.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbc.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbc.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbc.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbd.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbd.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbd.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbe.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbe.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbe.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbf.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbf.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbf.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbg.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbg.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbg.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbh.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbh.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbh.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbi.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbi.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbi.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbj.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbj.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbj.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbk.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbk.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbk.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbl.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbl.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbl.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbm.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbm.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbm.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbn.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbn.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbn.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbo.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbo.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbo.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbp.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbp.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbp.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbq.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbq.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbq.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbr.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbr.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbr.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbs.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbs.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbs.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbt.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbt.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbt.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbu.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbu.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbu.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbv.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbv.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbv.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbw.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbw.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbw.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbx.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbx.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbx.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwby.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwby.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwby.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbz.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbz.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwbz.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwca.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwca.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwca.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcb.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcb.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcb.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcc.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcc.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcc.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcd.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcd.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcd.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwce.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwce.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwce.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcf.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcf.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcf.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcg.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcg.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcg.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwch.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwch.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwch.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwci.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwci.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwci.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcj.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcj.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcj.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwck.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwck.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwck.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcl.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcl.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcl.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcm.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcm.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcm.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcn.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcn.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcn.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwco.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwco.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwco.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcp.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcp.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcp.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcq.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcq.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcq.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcr.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcr.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcr.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcs.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcs.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcs.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwct.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwct.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwct.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcu.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcu.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcu.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcv.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcv.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcv.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcw.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcw.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcw.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcx.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcx.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcx.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcy.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcy.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcy.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcz.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcz.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwcz.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwda.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwda.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwda.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdb.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdb.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdb.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdc.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdc.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdc.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdd.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdd.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdd.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwde.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwde.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwde.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdf.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdf.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdf.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdg.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdg.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdg.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdh.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdh.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdh.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdi.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdi.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdi.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdj.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdj.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdj.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdk.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdk.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdk.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdl.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdl.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdl.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdm.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdm.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdm.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdn.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdn.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdn.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdo.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdo.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdo.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdp.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdp.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdp.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdq.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdq.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdq.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdr.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdr.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdr.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwds.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwds.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwds.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdt.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdt.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdt.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdu.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdu.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdu.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdv.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdv.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdv.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdw.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdw.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdw.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdx.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdx.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdx.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdy.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdy.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdy.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdz.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdz.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwdz.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwea.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwea.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwea.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweb.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweb.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweb.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwec.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwec.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwec.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwed.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwed.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwed.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwee.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwee.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwee.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwef.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwef.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwef.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweg.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweg.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweg.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweh.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweh.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweh.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwei.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwei.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwei.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwej.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwej.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwej.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwek.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwek.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwek.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwel.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwel.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwel.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwem.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwem.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwem.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwen.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwen.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwen.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweo.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweo.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweo.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwep.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwep.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwep.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweq.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweq.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweq.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwer.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwer.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwer.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwes.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwes.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwes.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwet.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwet.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwet.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweu.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweu.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwweu.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwev.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwev.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwev.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwew.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwew.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwew.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwex.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwex.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwex.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwey.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwey.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwey.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwez.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwez.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwez.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfa.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfa.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfa.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfb.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfb.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfb.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfc.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfc.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfc.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfd.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfd.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfd.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfe.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfe.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfe.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwff.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwff.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwff.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfg.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfg.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfg.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfh.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfh.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfh.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfi.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfi.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfi.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfj.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfj.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfj.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfk.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfk.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfk.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfl.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfl.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfl.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfm.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfm.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfm.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfn.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfn.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfn.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfo.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfo.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfo.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfp.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfp.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfp.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfq.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfq.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfq.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfr.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfr.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfr.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfs.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfs.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfs.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwft.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwft.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwft.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfu.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfu.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfu.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfv.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfv.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfv.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfw.{BLOCKED}er.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfw.{BLOCKED}un.com/img/gt.cgi?s=1756172240&r=jcaa
  • http://wwwfw.{BLOCKED}gon.com/img/gt.cgi?s=1756172240&r=jcaa

This report is generated via an automated analysis system.

  SOLUTION

Minimum Scan Engine:

9.300

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Enable Registry Editor, Task Manager, and Folder options

[ Learn More ]
By doing this step, you also enable other applications/programs disabled by this malware/grayware/spyware.

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • Run
  • In HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • Run
  • In HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • Run

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
    • MqtgSVC = "%Application Data%\MICROS~1\mqtgsvc.exe /waitservice"

Step 5

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
    • load = "%Windows%\cmstp.exe"

Step 6

Scan your computer with your Trend Micro product to delete files detected as TROJ_DLOADE.IV. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.