[nirofo]

Hi Saphire

This is what is displayed when the web page address is accessed.

[goog-black-url 1.8576 update]
+http://www.sjmanhole.com/.secureserv....org/login.htm c
-http://cari.diyzone.net/icons/pp/login.html
+http://200.67.222.214/00med/img/ccd....gon/index.html c
+http://202.64.93.106/www.paypal.com/...login-run2652/ c
+http://203.101.67.147/.secure.region...Visa/index.htm c
+http://203.177.52.70/www.regions.com...user&pass.html c
+http://209.197.151.46/~josh/sitekey/...file/step1.htm c
+http://211.222.16.52:84/www.ebay.com/ c
+http://211.96.149.51/usage/secure.re...ogon/index.htm c
+http://218.247.5.46/.www.paypal.com/...ypal/index.php c
+http://256k.org/service.capitalone.com/oas/login.htm c
+http://62.167.10.183:16080/ c
+http://63.247.75.211/phplive/web/onl...ices/login.htm c
+http://64.143.174.64/main.php c
+http://d192-24-111-218.try.wideopenw...me=p/index.php c
+http://libertytidings.info/_files/ht...l.dorigine_or/ c
+http://suncorp.com.au.suncorp_id.bre...nfo/start.htm/ c
+http://www.53.com.bankingportal.id39...onf/script.php c
+http://www.53.com.bankingportal.id97...end.info/conf/ c
+http://www.behealthier.com/media/www....au/logon.html c
+http://www.feuerwehr-elbenberg.com/L...esmar/main.htm c
+http://www.gomagma.nl/onlineid-sessi...date/step1.htm c
+http://www.googlezh.com/ c
+http://www.kunstwereld.nl/afb/update...he%20West.html c
+http://www.pen.nl/ubb/update.htm c
+http://www.postbank.de.-snm-76790411...end.info/pbde/ c
+http://www.postbank.de.privat.app51g...rm/welcome.do/ c
+http://www.volksbank.de.vr-web.netwo.../anmelden.cgi/ c
+http://www.volksbank.de.vr-web.netwo.../anmelden.cgi/ c
-http://amazinglifegames.org/eAuction/www.bankofamerica.com/bankofamericacongratultion/new-bank-2007/signon/onlinebankingthankyou/index.html
-http://www.bankofamerica.com.onlinebankingid9304011.poyap e.co.nz/session.cgi/
-http://www.volksbank.de.networld.onlineid306184486.poyape .co.nz/kunde.htm
-http://www.volksbank.de.networld.onlineid54709.poyape.co. nz/kunde.htm
-http://www.volksbank.de.networld.onlineid66499.poyape.co. nz/kunde.htm
-http://www.volksbank.de.networld.onlineid786830.poyape.co .nz/kunde.htm
-http://www.volksbank.de.networld.onlineid92696.poyape.co. nz/kunde.htm/fr1.htm
-http://www.volksbank.de.networld.onlineid993887.poyape.co .nz/kunde.htm/
+http://sv1.melbhosting.com.au/~forcast/index.html c
+http://www.53.com.bankingportal.id38...i3or.biz/conf/ c
+http://www.53.com.bankingportal.id7135393075.o0site.biz c
+http://www.53.com.bankingportal.id77...i3or.biz/conf/ c
+http://www.53.com.bankingportal.id77...onf/script.php c
+http://www.corbeau.ch/bankofamerica/ c
+http://www.volksbank.de.vr-web.netwo...m/anmelden.cgi c
+http://www.volksbank.de.vr-web.netwo...m/anmelden.cgi c
+http://www.volksbank.de.vr-web.netwo.../anmelden.cgi/ c
-http://200.110.75.30/icons/%20/eb/eBayISAPI.dllSignIn-ssPageName-hhsin.php
-http://24.94.243.27:82/www.paypal.com/cgi-bin/webscr=home=p/index.php
-http://66.226.238.59:84/pp/login.html
-http://login.myspace.com-index.cfm2fuseaction.frasespararecordar.com/process8MyToken-c076f3c5-9878-4f0e-9b51-f05d1f8aa6a9.php
-http://www.53.com.businessandcorporate.umgar.at/customerdata/
-http://www.volksbank.de.networld.onlineid252267675.umgar. at/kunde.htm/fr1.htm
-http://www.volksbank.de.networld.onlineid974424.umgar.at/kunde.htm
+http://dellandmeonline.com/onlineid-...date/index.htm c
+http://nnnnnuhuk.makingtourismwork.eu/.%20/index.html c
+http://www.germanguns.com/cart/image...ce-online-ssl/ c
+http://www.homediaries.com/.%20/sign...UsingSSL=.html c
+http://www.messblack.com/addons/mess.../Sign%20In.php c
+http://www.muzicano.com/uploads/rest...pdates-paypal/ c
-http://kickingsawdust.org/novacam/http:/www.sparkasse.de/
-http://www.htvestfold.org/cutenews/_vti_cnf/www.ebay.com/signin.ebay.com.ws.eBayISAPI.dllSignIn&co_partnerI d=2&pUserId=&siteid=0&pageType=&pa1=&i1=&bshowgif= &UsingSSL.html
-http://www.volksbank.de.networld.onlineid5724891446.alltd irect.info/kunde.htm/
+http://1051134647:16080/ c
+http://200.67.73.220/.web/pnc/index.html c
+http://200.86.128.197/~paypal/secure/index.php c
+http://grace.ac.th/edit/www.paypal.c...Pal/index1.htm c
+http://item250076880855.pop3.ru/ISAP...&errmsg=9.html c
+http://kokok.makingtourismwork.eu/.%20/index.html c
+http://libertytidings.info/_files/ht...-bin/rbaccess/ c
+http://members.lycos.co.uk/my78/msn.php c
+http://www.53.com.bankingportal.id17...0site.biz/conf c
+http://www.53.com.bankingportal.id40...site.biz/conf/ c
+http://www.53.com.bankingportal.id62...micf.info/conf c
+http://www.ebank-egg.co.uk/wellsfargo/update/index.htm c
+http://www.postbank.de.-snm-05234710...0site.biz/pbde c
+http://www.postbank.de.-snm-36995558-.o0site.biz/pbde c
+http://www.volksbank.de.vr-web.netwo.../anmelden.cgi/ c
+http://www.volksbank.de.vr-web.netwo.../anmelden.cgi/ c
+http://www.volksbank.de.vr-web.netwo.../anmelden.cgi/ c
-http://staeudle.com/unavailable/
-http://www.53.com.bankingportal.id96591161090.poyape.co.n z/conf/
-http://www.bankofamerica.com.onlinebankingid212520868.poy ape.co.nz/session.cgi
-http://www.bankofamerica.com.onlinebankingid260614983.poy ape.co.nz/session.cgi
-http://www.volksbank.de.networld.onlineid274857.poyape.co .nz/kunde.htm/
+http://www.bnkofamerica.us/ c
+http://www.volksbank.de.networld.onl....net/kunde.htm c
+http://www.volksbank.de.networld.onl...de.htm/fr1.htm c
+http://www.volksbank.de.vr-web.netwo.../anmelden.cgi/ c
+http://www.volksbank.de.vr-web.netwo.../anmelden.cgi/ c
+http://www.volksbank.de.vr-web.netwo...m/anmelden.cgi c
+http://www.volksbank.de.vr-web.netwo.../anmelden.cgi/ c
-http://203.115.117.51/.paypal.com/login-run.html
-http://mail.constructoranacional.com.co/.paypal.com/cgi-bin/webscr/cmd_login/128bit_ssl-secure_account-verify/login.htm
-http://www.al-khawarizmi.com/img/cgi.ebay.com/ws/ebayisapi_dllsignin&co_partnerid=2/ebayisapi_dllsignin&co_partnerid=2/
-http://www.volksbank.de.networld.onlineid7044689.eztland. biz/kunde.htm/fr1.htm

Looks to me like it's trying to invoke some sort of E Banking, there's mention of PayPal, Visa and various world bank web addresses.

NOT SURE WHAT ALL THIS MEANS, IN YOUR SHOES I WOULD DO A COMPLETE SYSTEM WIPE AND REINSTALL> MAKE SURE YOU BACK UP YOUR PERSONAL FILES AND PHOTO'S FIRST !!

nirofo.