Copyright 1999 - 2006, Sandra Hardmeier, All Rights Reserved Worldwide
Last updated 20/08/2006

Trojan.  Information can be found here: http://www3.ca.com/virusinfo/virus.aspx?ID=11890

It gets worse... a later version can send you to any of the following sites, and probably more, using the HOSTS file - removal instructions here http://www3.ca.com/virusinfo/virus.aspx?ID=35069

To avoid such problems in the future PLEASE update Internet Explorer - http://support.microsoft.com/support/kb/articles/Q275/6/09.ASP

PLEASE, do not try to visit any of the sites below. They are included only to allow those poor souls who are stuck with the virus to find a fix via Google.

the.sextracker.com, lobby.sexlist.com, in.paycounter.com, adv.sexcounter.com, rd1.hitbox.com, refer.ccbill.com, www.ccbill.com, select.2000charge.com, secure.2000charge.com, www.signup.globill-systems.com, secure.visionbill.net, www.dibill.com, secure.dpbill.com, secure.dutchbilling.com, secure.pswbilling.com, www.maximumcash.com, www.adultrevenueservice.com, www.eroticacash.com, www.oxcash.com, track.oxcash.com, potd.oxcash.com, clicks2.oxcash.com, www.webmastersmakemoney.com, clicks.nastydollars.com, www.lightspeedcash.com, db.fetishcash.com, ctc.amateurpages.com, www2.karupspc.com, www.iteens.com, click.payserve.com, vip.mtree.com, c.fsx.com, adultfriendfinder.com, network.nocreditcard.com, php.offshoreclicks.com, links.lifetimebucks.com, cgi.gammae.com, click.passiondollars.com, www.fatpockets.com, link.siccash.com, www.clickcash.com, www.scoreland.com, www.makingitpay.com, www.hpic.com, referral.topbucks.com, partner.globill-systems.com, www.pornstardollars.com, traffic.acpay.com, www.cashforlink.com, clickcash.webpower.com, www.dollars4babes.com, www.sexfantasyzone.com, www.twistyscash.com, www.freeticketcash.com, www.hawgscash.com, www.freeezinebucks.com, www.nastydollars.com, www.deluxepass.com, clicks.oxcash.com, ww2.amateur-pages.com, stats.allliquid.com, secure1.websitebilling.com, www.adultmovienetwork.com, www.totally4freecash.com, network.nocreditcard.com, php.offshoreclicks.com, www.nocreditcard.com, media.fastclick.net, clicks.uni-cash.com, www.clubpix.com, programs.wegcash.com, in.cybererotica.com, www.cybererotica.com, cybererotica.com, dollartraffic.com, www.xxxesscash.com, www.maturemoney.com, www.xpays.com, www.trueclicks.com, www.sexhit.com, www.blacksonblondes.com, partners.hotgold.com, www.thecashzone.com, db.smutcash.com, www.eroticcash.com, home.vividvip.com, www.stiffycash.com, gotd.stiffycash.com, cash.helmy.com, adultmegacash.com, amc2.adultmegacash.com, www.candidclicks.com, clicks.filthyclicks.com, www.eazybucks.com, www.bigpay.com, www.fatclicks.com, stats1.pussypayments.com, www.adultbucks.com, www.babylon-x.com, www.dollartraffic.com, www.tv69.com, ww2.amateur-pages.com, ctc.japanesegirls.com, www.entertainmentcash.com, www.mtreexxx.net, join.pibcash.com, www.n69.com, www.intergal.com, www2.seductiveamateurs.com, porndollar.com, www.porndollar.com, www.pillscash.com, cart.penispill.com, www.pillsmoney.com, www.pillmedics.com, www.big-penis.com, www.pluspills1.com, www.morepenis.com, www.1shoppingcart.com, www.herbalo.com, www.penilesecrets.com, www.penispill.com, penismedical.net, www.penismedical.net, www.herbalbucks.com, www.vigrx.com, www.rsac.org, www.netnanny.com, www.cyberpatrol.com, www.safesurf.com, www.asacp.org, www.icra.org, www.cybersitter.com, www.surfwatch.com

Version B targets the following URLs:

auto.search.msn.com; secure.visionbill.net; potd.oxcash.com; www.danni.com; network.nocreditcard.com; php.offshoreclicks.com; links.lifetimebucks.com; cgi.gammae.com; click.passiondollars.com; www.fatpockets.com; network.nocreditcard.com; clicks.filthyclicks.com; www.herbalo.com; www.herbalbucks.com; www.netnanny.com; www.cyberpatrol.com; www.safesurf.com; www.spyglass.com; www.asacp.org; www.icra.org;   www.cybersitter.com;   www.surfwatch.com