Did you put these in your hosts file?
C:\Windows\System32\drivers\etc\hosts
`127.0.0.1 www01.paypopup.com
`127.0.0.1 www02.paypopup.com
`127.0.0.1 www03.paypopup.com
`127.0.0.1 www04.paypopup.com
`127.0.0.1 www05.paypopup.com
`127.0.0.1 www06.paypopup.com
`127.0.0.1 www07.paypopup.com
`127.0.0.1 www08.paypopup.com
`127.0.0.1 www09.paypopup.com
`127.0.0.1 www10.paypopup.com
`127.0.0.1 count.exitexchange.com
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.
Make sure to close any open browsers. Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about
:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about
:blank
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
Restart and run a new HijackThis scan. Save the log file and run KRC HijackThis Analyzer
http://www.greyknight17.com/spy/KRC%...20Analyzer.zip in the same folder to get the result.txt log. Just post the contents of the result.txt file in your next reply.