Hijacked Browser, please help

Discussion in 'adware, spyware & hijack cleaning' started by Hogarth2, May 24, 2004.

Thread Status:
Not open for further replies.
  1. Hogarth2

    Hogarth2 Registered Member

    Joined:
    Apr 29, 2004
    Posts:
    7
    Here is my log:

    Logfile of HijackThis v1.97.7
    Scan saved at 9:14:06 AM, on 5/24/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\ATI2EVAE.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\MIXER.EXE
    C:\PROGRAM FILES\ASUS\PROBE\ASUSPROB.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\PROGRAM FILES\SHARP\SHARPDESK\SHARPTRAY.EXE
    C:\PALM\ALARMAPP.EXE
    C:\PALM\HOTSYNC.EXE
    C:\WESYNC\WESYNC.EXE
    C:\WINZIP\WZQKPICK.EXE
    C:\PROGRAM FILES\SHARP\SHARPDESK\SDFTP.EXE
    C:\ACROBAT 5.0\DISTILLR\ACROTRAY.EXE
    C:\PROGRAM FILES\OPENOFFICE.ORG1.0.1\PROGRAM\SOFFICE.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\DOWNLOAD\HIJACKTHIS.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
    O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [nil] C:\WINDOWS\nil.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evae.exe
    O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
    O4 - HKCU\..\Run: [SharpTray] "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
    O4 - HKCU\..\Run: [msmc] C:\WINDOWS\SYSTEM\msgked.exe
    O4 - HKLM\..\RunOnce: [Ad-aware] "C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\AD-AWARE.EXE" "+b1"
    O4 - Startup: CorelCENTRAL 10.lnk = C:\Program Files\Corel\WordPerfect Office 2002\Programs\CCWin10.exe
    O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
    O4 - Startup: WeSync.lnk = C:\WeSync\wesync.exe
    O4 - Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
    O4 - Startup: Start Network Scanner Tool.lnk = C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
    O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.0.1\program\quickstart.exe
    O4 - Startup: Acrobat Assistant.lnk = C:\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Alarm Manager.LNK = ..\..\..\..\..\Palm\AlarmApp.exe
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37918.243287037
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.com/games/popcaploader_v5.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.196.0.38,151.196.0.39
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,429
    Location:
    Netherlands
    Hi Hogarth2,

    Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

    O4 - HKLM\..\Run: [nil] C:\WINDOWS\nil.exe

    O4 - HKCU\..\Run: [msmc] C:\WINDOWS\SYSTEM\msgked.exe

    Then reboot and delete:
    C:\WINDOWS\SYSTEM\msgked.exe

    Could you mail C:\WINDOWS\nil.exe to the address in my profile

    Regards,

    Pieter
     
  3. Hogarth2

    Hogarth2 Registered Member

    Joined:
    Apr 29, 2004
    Posts:
    7
    Pieter,

    Oddly, I cannot find nil.exe on my hard drive, though I should be able to see all hidden files. Am I missing something?

    Hogarth
     
  4. Hogarth2

    Hogarth2 Registered Member

    Joined:
    Apr 29, 2004
    Posts:
    7
    Pieter,

    Sorry to bother you again, but I am still having problems. When I type a search in google, yahoo, etc, I get redirected to some spyware's site. Log below.


    Hogarth2

    Logfile of HijackThis v1.97.7
    Scan saved at 1:01:35 PM, on 5/24/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\ATI2EVAE.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\MIXER.EXE
    C:\PROGRAM FILES\ASUS\PROBE\ASUSPROB.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\PROGRAM FILES\SHARP\SHARPDESK\SHARPTRAY.EXE
    C:\PALM\ALARMAPP.EXE
    C:\PALM\HOTSYNC.EXE
    C:\WESYNC\WESYNC.EXE
    C:\WINZIP\WZQKPICK.EXE
    C:\PROGRAM FILES\SHARP\SHARPDESK\SDFTP.EXE
    C:\ACROBAT 5.0\DISTILLR\ACROTRAY.EXE
    C:\PROGRAM FILES\OPENOFFICE.ORG1.0.1\PROGRAM\SOFFICE.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\DOWNLOAD\HIJACKTHIS.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
    O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evae.exe
    O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
    O4 - HKCU\..\Run: [SharpTray] "C:\Program Files\Sharp\Sharpdesk\SharpTray.exe"
    O4 - Startup: CorelCENTRAL 10.lnk = C:\Program Files\Corel\WordPerfect Office 2002\Programs\CCWin10.exe
    O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
    O4 - Startup: WeSync.lnk = C:\WeSync\wesync.exe
    O4 - Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
    O4 - Startup: Start Network Scanner Tool.lnk = C:\Program Files\Sharp\Sharpdesk\sdFTP.exe
    O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.0.1\program\quickstart.exe
    O4 - Startup: Acrobat Assistant.lnk = C:\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Alarm Manager.LNK = ..\..\..\..\..\Palm\AlarmApp.exe
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37918.243287037
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.com/games/popcaploader_v5.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.196.0.38,151.196.0.39
     
  5. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,429
    Location:
    Netherlands
    Hi Hogarth2,

    Can you tell me which site you are being hijacked to?
    There is nothing left in your log and that information might give me a clue what to investigate next.

    Regards,

    Pieter
     
  6. Hogarth2

    Hogarth2 Registered Member

    Joined:
    Apr 29, 2004
    Posts:
    7
    Pieter,

    If I go to google and seartch "fark," this is the address in my toolbar: http://www.google.com/search?hl=en&ie=UTF-8&q=fark

    Rather than showing my search results, I get:

    1. a page full of advertising listings (Html source Code posted below); and

    2. a pop under advertising (a) FREE 2020Search Toolbar; and (2) Free WebSearch Tools

    Note, if I click on the second page of search results, I am sent to my search results: http://www.google.com/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=0&sa=N

    Any thoughts? Thank you again.


    Hogarth2




    source HTML:


    <html><head><meta HTTP-EQUIV="content-type" CONTENT="text/html; charset=UTF-8"><title>Google Search: fark </title><style><!--
    body,td,div,.p,a{font-family:arial,sans-serif }
    div,td{color:#000}
    .f,.fl:link{color:#6f6f6f}
    a:link,.w,a.w:link,.w a:link{color:#00c}
    a:visited,.fl:visited{color:#551a8b}
    a:active,.fl:active{color:#f00}
    .t a:link,.t a:active,.t a:visited,.t{color:#000}
    .t{background-color:#e5ecf9}
    .k{background-color:#36c}
    .j{width:33em}
    .h{color:#36c}
    .i,.i:link{color:#a90a08}
    .a,.a:link{color:#008000}
    .z{display:none}
    div.n {margin-top: 1ex}
    .n a{font-size:10pt; color:#000}
    .n .i{font-size:10pt; font-weight:bold}
    .q a:visited,.q a:link,.q a:active,.q {color: #00c; }
    .b{font-size: 12pt; color:#00c; font-weight:bold}
    .ch{cursor:pointer;cursor:hand}
    .e{margin-top: .75em; margin-bottom: .75em}
    .g{margin-top: 1em; margin-bottom: 1em}
    //-->
    </style>
    <script>
    <!--
    function ss(w){window.status=w;return true;}
    function cs(){window.status='';}
    function clk(n,el) {if(document.images){(new Image()).src="/url?sa=T&start="+n+"&url="+escape(el.href);}return true;}
    //-->
    </script>
    <script>
    <!--
    function ga(o,e){if (document.getElementById){a=o.id.substring(1); p = "";r = "";g = e.target;if (g) { t = g.id;f = g.parentNode;if (f) {p = f.id;h = f.parentNode;if (h) r = h.id;}} else{h = e.srcElement;f = h.parentNode;if (f) p = f.id;t = h.id;}if (t==a || p==a || r==a) return true;location.href=document.getElementById(a).href}}
    //-->
    </script>
    </head><body bgcolor=#ffffff onLoad="document.gs.reset()" topmargin=2 marginheight=2><table border=0 cellpadding=0 cellspacing=0><tr><td valign=top><a href=http://www.google.com/webhp?hl=en><img src=images/logo_sm.gif width=150 height=55 alt="Go to Google Home" border=0 vspace=12></a></td><td>&nbsp;&nbsp;</td><td valign=top><table cellpadding=0 cellspacing=0 border=0><tr><td colspan=2 height=14 valign=bottom><script><!--
    function qs(el) {if (window.RegExp && window.encodeURIComponent) {var qe=encodeURIComponent(document.gs.q.value);if (el.href.indexOf("q=")!=-1) {el.href=el.href.replace(new RegExp("q=[^&$]*"),"q="+qe);} else {el.href+="&q="+qe;}}return 1;}
    // -->
    </script><table border=0 cellpadding=4 cellspacing=0><tr><td class=q><font size=-1><font color=#000000><b>Web</b></font>&nbsp;&nbsp;&nbsp;&nbsp;<a id=t1a class=q href="http://images.google.com/images?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wi" onClick="return qs(this);">Images</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=t2a class=q href="http://groups.google.com/groups?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wg" onClick="return qs(this);">Groups</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=t4a class=q href="http://news.google.com/news?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wn" onClick="return qs(this);">News</a>&nbsp;&nbsp;&nbsp;&nbsp;<a id=t5a class=q href="http://froogle.google.com/froogle?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wf" onClick="return qs(this);">Froogle</a><sup><a href="http://froogle.google.com/froogle?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&sa=N&tab=wf" style="text-decoration:none;" onclick="return qs(this);"><font color=red>New!</font></a></sup>&nbsp;&nbsp;&nbsp;&nbsp;</font><font size=-1><b><a href="/options/" class=q>more&nbsp;&raquo;</a></b></font></td></tr></table></td></tr><tr><td nowrap><form name=gs method=GET action=/search><input type=hidden name=hl value="en"><input type=hidden name=lr value=""><input type=hidden name=ie value="UTF-8"><input type=hidden name=c2coff value=1><input type=text name=q size=41 maxlength=2048 value="fark"><font size=-1> <input type=submit name="btnG" value="Search"><span id=hf></span></font></td><td nowrap><font size=-2>&nbsp;&nbsp;<a href=/advanced_search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1>Advanced Search</a><br>&nbsp;&nbsp;<a href=/preferences?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1>Preferences</a>&nbsp;&nbsp;&nbsp;&nbsp;</font></td></tr></table><table cellpadding=0 cellspacing=0 border=0><tr><td><font size=-1></font></td></tr><tr><td height=7><img width=1 height=1 alt=""></td></tr></table></td></tr></form></table>
    <style><!--
    .fl:link{color:#7777CC}
    -->
    </style>
    <table width=100% border=0 cellpadding=0 cellspacing=0><tr><td bgcolor=#3366cc><img width=1 height=1 alt=""></td></tr></table><table width=100% border=0 cellpadding=0 cellspacing=0 bgcolor=#e5ecf9><tr><td bgcolor=#e5ecf9 nowrap><font size=+1>&nbsp;<b>Web</b></font>&nbsp;</td><td bgcolor=#e5ecf9 align=right nowrap><font size=-1 color=#000000>Results <b>1</b> - <b>10</b> of about <b>1,370,000</b> for <b><b>fark</b></b>. (<b>0.73</b> seconds)&nbsp;</font></td></tr></table><p><font color=#cc0000 class=p>Did you mean: </font><a href=/search?hl=en&ie=UTF-8&c2coff=1&q=dark&spell=1 class=p><b><i>dark</i></b></a>&nbsp;&nbsp;<br><div> <br><a href="http://www.searchassistant.net/rd.php?affiliate=cm1&Terms=fark&b=%200.05&abctime=1085430059&id=441&hash=22df76356e8882cfc41bc6a7b3dc3526" onmouseover="window.status='http://service.bfast.com';return true;" onmouseout="window.status=' ';return true;">Find fark at SMARTpages.com - Online Yellow Pages</a><br>Find local business listings for fark at SMARTpages.com, the online yellow pages directory of SBC Communications. SMARTpages also offers city guides, shopping guides, white pages and more.<br><br><a href="http://www.searchassistant.net/rd.php?affiliate=cm1&Terms=fark&t=uggc%3A%2F%2Fhf05.kzyfrnepu.svaqjung.pbz%2Fova%2Fsvaqjung.qyy%3Fpyvpxguebhtu%40l%5E82089%40k%5EvL6nD99uyp6fUWgIAneyQVeH7yFyvB2mP4cdD2STUObGQ2c%3B94Q8RgCovXbHOh2N4CYiAMdgPp4WQVzYlqegvhy9rprQPdEboCkCg9xhZgMxUVKpyqQoD6r7NPyTfXrtteYUAvSjDgyx4zd0tdxVg4yePzSDogI2A4lvVT%24%247&b=%200.00&e=SvaqJung&abctime=1085430059&hash=69cd412988ab2ad8356a1f63e4b59ca7" onmouseover="window.status='http://www.qksrv.net';return true;" onmouseout="window.status=' ';return true;">EBay.com - Save Money and Buy Fark On Ebay!</a><br>Find Fark and anything you are looking for on Ebay. Opening an account is free. Bidding is free. Try it today.<br><div class=n><table border=0 cellpadding=0 width=1% cellspacing=0 align=center><tr align=center valign=top><td valign=bottom nowrap><font size=-1>Result&nbsp;Page:&nbsp;</font><td><img src=/nav_first.gif width=18 height=26 alt=""><br><td><img src=/nav_current.gif width=16 height=26 alt=""><br><span class=i>1</span><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=0&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>2</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=20&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>3</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=30&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>4</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=40&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>5</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=50&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>6</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=60&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>7</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=70&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>8</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=80&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>9</a><td><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=90&sa=N><img src=/nav_page.gif width=16 height=26 alt="" border=0><br>10</a><td nowrap><a href=/search?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&start=0&sa=N><img src=/nav_next.gif width=100 height=26 alt="" border=0><br><span class=b>Next</span></a></table></div><center>
    <br clear=all><br><table cellspacing=0 cellpadding=0 border=0 width="100%"><tr><td class=k><img height=1 alt="" width=1></td></tr><tr><td align=center bgcolor=#e5ecf9>&nbsp;<br><table border=0 cellpadding=0 cellspacing=0 align=center><form method=GET action=/search><tr><td nowrap>
    <font size=-1><input type=text name=q size=31 maxlength=2048 value="fark"> <input type=submit name=btnG VALUE="Search"><input type=hidden name=hl value="en"><input type=hidden name=lr value=""><input type=hidden name=ie value="UTF-8"><input type=hidden name=c2coff value=1></font></td></tr></form></table><br><font size=-1><a href=/swr?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1&swrnum=1370000>Search&nbsp;within&nbsp;results</a> | <a href=/language_tools?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1>Language Tools</a> | <a href=/help/>Search&nbsp;Tips</a> | <a href=/quality_form?q=fark&hl=en&lr=&ie=UTF-8&c2coff=1 target=_blank>Dissatisfied? Help us improve</a></font><br><br></td></tr><tr><td class=k><img height=1 alt="" width=1></td></tr></table></center><center><p><hr class=z><table width=100% cellpadding=2 cellspacing=0 border=0><tr><td align=center><font size=-1><a href="http://www.google.com/">Google&nbsp;Home</a> - <a href="/ads/">Advertising&nbsp;Programs</a> - <a href="/services/">Business&nbsp;Solutions</a> - <a href=/about.html>About Google</a></font></table><br><font size=-1 class=p>&copy;2004 Google</font></center><script language=javascript>function run(){newwindow=window.open('','test','width=500,height=400,scrollbars=yes,resizable=yes,toolbar=yes');newwindow.close();newwindow=window.open('','test','width=500,height=400,scrollbars=yes,resizable=yes,toolbar=yes');newwindow.document.open();newwindow.document.write('<br><a href="http://cassandra.searchassistant.net/servlet/link?link=P_MzMzMzMzMAAAABAAAWYQAAAAAAAAAAAA4yMDIwc2VhcmNoLmNvbQE4o4imwpG6AARmYXJrAAAACT-EeuFHrhR7AAAAAPy4rFj1P4zMzQADeG1sAQpodHRwOi8vcGFydG5lcnMubXlnZWVrLmNvbS9wcmVzdWx0cy5qc3A_cGFydG5lcmlkPTk4NTI4JnZlbmRvcklkPTgyMjEyJnR5cGU9NSZjb2RlPTEmcmF0ZT01NDMzNjIzNjImY3I9NTQzMzYyMzYyJmRvbWFpbj13d3cuMjAyMHNlYXJjaC5jb20mcXVlcnk9MTA4NTQzMDA1MjQxMCUzQSUzQTY4LjE2My43My4yMzUlM0ElM0FmYXJrJnVybD1odHRwJTNBJTJGJTJGd3d3LjIwMjBzZWFyY2guY29tJTJGdG9vbGJhciUyRmluc3RhbGwuaHRtbCUzRktleXdvcmRzJTNEZmFyawAAAAAAAAA_8zMzMzMzMw.." onmouseover="window.status=\'2020search.com\';return true;" onmouseout="window.status=\' \';return true;">Find fark Using the FREE 2020Search Toolbar!</a><br>Having trouble finding fark? Get the 2020Search toolbar and say "good-bye" to those annoying pop-ups. Many other useful features such as: text highlighter, multi-search engine, drag & drop, e-mail results and more!<br><br><a href="http://cassandra.searchassistant.net/servlet/link?link=P_MzMzMzMzMAAAABAAAWYQAAAAAAAAAAABZkb3dubG9hZC53ZWJzZWFyY2guY29tATijiKbCkboABGZhcmsAAAAJP4R64UeuFHsAAAAA_LisWPVADMzNAAN4bWwBOGh0dHA6Ly9wYXJ0bmVycy5teWdlZWsuY29tL3ByZXN1bHRzLmpzcD9wYXJ0bmVyaWQ9OTg1MjgmdmVuZG9ySWQ9ODI1MTUmdHlwZT01JmNvZGU9MSZyYXRlPTQ4MzY2NDM2MiZjcj00ODM2NjQzNjImZG9tYWluPWRvd25sb2FkLndlYnNlYXJjaC5jb20mcXVlcnk9MTA4NTQzMDA1MjQxMCUzQSUzQTY4LjE2My43My4yMzUlM0ElM0FmYXJrJnVybD1odHRwJTNBJTJGJTJGZG93bmxvYWQud2Vic2VhcmNoLmNvbSUyRmluc3RhbGwlMkZ0Yl9sYW5kaW5nX3NlYXJjaC5hc3B4JTNGaWQlM0Q1MDAxOSUyNnElM0RmYXJrJTI2c2UlM0RXJTI2Y2IlM0Q1MDAxOQAAAAAAAAA_8zMzMzMzMw.." onmouseover="window.status=\'download.websearch.com\';return true;" onmouseout="window.status=\' \';return true;">Find fark with Free WebSearch Tools</a><br>Click here to download WebSearch Tools and search 15 engines for fark at once now with FREE Pop-up Blocker, Yellow/White Pages, Free Games, Maps, Skins, Cursors and more!<br>');newwindow.document.close();newwindow.document.title='fark';newwindow.blur();window.focus();}run();</script></body></html>
     
  7. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,429
    Location:
    Netherlands
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.