The URLs which were accessed during the exploit, most of these are harmless/known normal adware popups:- http://www.infinityads.com/popup.php? http://www.popuptraffic.com/assign.php? http://pagead2.googlesyndication.com/pagead/show_ads.js http://www.iseekstuff.com/lotr/lotr.htm http://u1.extreme-dm.com/i.gif http://pagead2.googlesyndication.com/pagead/ads? http://t0.extreme-dm.com/0.gif? http://pagead2.googlesyndication.com/pagead/ http://media.popuptraffic.com/scripts/popup.php? http://as.casalemedia.com/showad? http://adtrak.net/adjs.php? http://asg02.casalemedia.com/showad? http://adtrak.net/adlog.php? http://www1.multipops.com/loading.php? http://isg04.casalemedia.com/V2/37557/37557/index.html? http://ads.fortunecity.com/RealMedia/ads/adstream_sx.ads/stdinter/c3228d/121359@x31 http://www.iseekstuff.com/css/base.css http://isg04.casalemedia.com/V2/37557/37557/spyware2.gif http://66.70.21.80/scripts/click.php? http://pagead2.googlesyndication.com/pagead/ads? http://www.iseekstuff.com/fantasy/graphic/yellowtitle.gif http://www1.multipops.com/links.php? http://t1.extreme-dm.com/i.gif http://webpdp.gator.com/4/placement/256/ http://i.casalemedia.com/imp.gif? http://66.70.21.80/img/pixel.gif http://t0.extreme-dm.com/0.gif? http://65.17.207.40/framepb_1u.php http://asg02.casalemedia.com/imp.gif? http://asg02.casalemedia.com/pixy.gif http://np.default-homepage-network.com/np1/np1.htm http://np.default-homepage-network.com/np1//NP1.CHM http://np.default-homepage-network.com/np1//np1.exe http://207.44.156.26/~admin3/ron/ron.php? http:/// http://207.44.156.26/~admin3/ron/adsredir.php? http://207.44.156.26/~admin3/ron/adsredir.php? http://np.default-homepage-network.com/np2/np2.htm http://www.cheap-solutions.com/popup.html http://www.news-depot.com/ http://www.vivacorporation.com/VIVAMedicalTranscription.html http://www.deal-dudes.com/dp1.htm http://np.default-homepage-network.com/np2//NP2.CHM http://www.vivacorporation.com/viva.css http://www.cheap-solutions.com/themes/system/images/special.gif http://www.newsindex.com/images/line.jpg http://www.drgigabytes.com/images/dot.gif http://a408.g.akamai.net/f/408/1284/24h/image.netflix.com/NetFlix_Assets/affiliates/banners/a125125A.g http://www.qksz.net/1e-8f7j http://eoffersonline.com/banners/image.asp? http://cpaoffers.com/banner/1432/89&dp%3D0 http://www.news-depot.com//main.chm http://np.default-homepage-network.com/np2//np2.exe http://www.news-depot.com/msits.exe http://www.vivacorporation.com/images/clear.gif http://www.vivacorporation.com/images/viva_top_background.jpg http://67.15.4.62/traff.php http://67.15.4.62/traff.php http://np.default-homepage-network.com/np3/prenp3.htm? http://www.vivacorporation.com/images/viva_logo.gif http://np.default-homepage-network.com/np3/np3.htm http://np.default-homepage-network.com/np3//NP3.CHM http://np.default-homepage-network.com/np3//np3.exe http://www.media-ads.org/pops/Diet/600x400/600x400_11.gif http://www.qksrv.net/image-1239573-10289750 http://www.qksz.net/1e-8ctn http://www.qksrv.net/image-1239573-9955861 http://mirror.qkimg.net/0598/10289750-3 http://mirror.qkimg.net/0533/9955861-7 Below is the contents of the windows which were popped up (the html from the window which linked to the exploit is first):- -------------------- MAIN WINDOW ------------------- http://www.celebritysearchengine.co.uk/fantasy/e/ellemc.htm:- Elle McPherson gallery picture non nudenaked no fakes

Janet Jackson
Angelina Jolie
Usher
Jessica Simpson
Jennifer Lopez
Britney Spears
Beyonce Knowles
OutKast
David Beckham
Christina Aguilera
Eminem
Avril Lavigne
Paris Hilton
Linkin Park
Lindsay Lohan
Cameron Diaz
Hugh Jackman
Emmy Rossum
Kate Beckinsale
Josie Maran

Elle McPherson picture gallery

Other Celeb sites

CelebrityBulletin Board.com

Celebrity Spider
Sexy Babes
Skypo
Star Desire

Webmasters add your site to the list and get tons of traffic

Pictures
Wallpaper
non nude
Photos
mp3
news
celebrity gossip
lingerie
celebrity cosmetic
are all found on this site we have no x rated material or xxx

We try to update every day, if you want to play the celebrity share game go to Fatdog Exchange.com

Sometimes celebrity is a scandal in itself.
Long legs are the hottest issue.

Elle McPherson gallery picture non nudenaked no fakes

A - B - C - D - E - F - G - H - I -K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z

Paris Hilton - Britney Spears - Christina Aguilera - Jennifer Lopez - Orlando Bloom - Beyonce Knowles - Eminem - Hilary Duff - 50 Cent - Jessica Simpson - Courteny Cox - Linkin Park

------------------------------------------------- -------------- WINDOW 1 - NO TITLE --------------

------------------------------------------------- --------------- WINDOW 2 - Warning -------------- Single gif image which said:- Warning - if your computer has been running slower than usual, it may be infected with Adware or Spyware! To scan your computer for such infections, click yes below. YES NO ------------------------------------------------- -------------- WINDOW 3 - NO TITLE -------------- http://207.44.156.26/~admin3/ron/adsredir.php?mid=7597253560&nid=880027734 ... ------------------------------------------------- -------------------- WINDOW 4 ------------------- http://np.default-homepage-network.com/np2/prenp2.htm?from-np1 (black with the text - "Error: Please Close Window") Error:
Please Close Window

------------------------------------------------- -------------------- WINDOW 5 ------------------- (advertisement for web hosting) ... ------------------------------------------------- -------------------- WINDOW 6 ------------------- Windows Media Player ------------------------------------------------- -------------------- WINDOW 7 ------------------- Windows Media Player Error Invalid name: mmsu:///. The file name specified is incorrect. (Error=C00D001C) Invalid name: http:///. The file name specified is incorrect. (Error=C00D002B) Cannot open. Please verify that the path and filename are correct and try again. (Error=C00D002B) ------------------------------------------------- -------------------- WINDOW 8 ------------------- http://np.default-homepage-network.com/np3/prenp3.htm?from-np2 Crashed IE and wants to send error report. AppName: iexplore.exe AppVer: 5.51.4807.2300 ModName: mshtml.dll ModVer: 5.50.4937.800 Offset: 00001f47 Just for completeness here is the default-homepage hijacker which also installed itself:- http://np.default-homepage-network.com/np1/np1.htm http://np.default-homepage-network.com/np1//NP1.CHM http://np.default-homepage-network.com/np1//np1.exe http://np.default-homepage-network.com/np2/np2.htm http://np.default-homepage-network.com/np2//NP2.CHM http://np.default-homepage-network.com/np2//np2.exe http://np.default-homepage-network.com/np3/prenp3.htm? http://np.default-homepage-network.com/np3/np3.htm http://np.default-homepage-network.com/np3//NP3.CHM http://np.default-homepage-network.com/np3//np3.exe >From http://np.default-homepage-network.com/np1/np1.htm:- >From http://np.default-homepage-network.com/np2/np2.htm:- >From http://np.default-homepage-network.com/np3/np3.htm:-