Frustrated by Windows Explorer wanting to connect out

[Spy vs Spy]

Every few seconds, my Kerio Personal Firewall pops up a message saying
'Window Explorer' from my computer wants to connect to 207.36.117.38, port
80

After I click on 'Deny' a few minutes, the box 'Windows Explorer has
generated error blah blah' comes up after which the Quick Launch bar
becomes unusable for a while.

I have turned off Windows AutoUpdates but the issue persists.

Any idea why it wants to connect to that IP address ? How can I stop it
from wanting to connect to any external site ?

Is it really Windows Explorer or some other application masquerading like
Windows Explorer ?

Thanks.

[siljaline]

"Spy vs Spy" <aJB@jbk.jk> wrote:
> Every few seconds, my Kerio Personal Firewall pops up a message saying
> 'Window Explorer' from my computer wants to connect to 207.36.117.38, port
> 80
>
> After I click on 'Deny' a few minutes, the box 'Windows Explorer has
> generated error blah blah' comes up after which the Quick Launch bar
> becomes unusable for a while.
>
> I have turned off Windows AutoUpdates but the issue persists.
>
> Any idea why it wants to connect to that IP address ? How can I stop it
> from wanting to connect to any external site ?
>
> Is it really Windows Explorer or some other application masquerading like
> Windows Explorer ?
>
> Thanks.

You've got something "phoning home"
IP you posted resolves to this:

OrgName: CyberGate, Inc.
OrgID: CYBG
Address: 3250 W. Commercial Blvd. Suite 200
City: Ft. Lauderdale
StateProv: FL
PostalCode: 33309
Country: US

NetRange: 207.36.0.0 - 207.36.255.255
CIDR: 207.36.0.0/16
NetName: GATE-CIDR-2
NetHandle: NET-207-36-0-0-1
Parent: NET-207-0-0-0-0
NetType: Direct Allocation
NameServer: NS.VALUEWEB.NET
NameServer: NS2.VALUEWEB.NET
Comment:
RegDate: 1996-01-23
Updated: 2000-11-28

TechHandle: CN313-ARIN
TechName: Network Administrator, CyberGate Network
TechPhone: +1-954-334-8080
TechEmail: netadm@valueweb.net

If you have not run an Ad-aware or SpyBot scan - do so immediately.
Ad-aware here: http://ftp.pcworld.com/pub/new/priva...ty/aaw6181.exe
SpyBot here: http://spybot.eon.net.au/files/spybotsd_mainapp.exe

In the meantime, Block that connect out request -

HTH

--

siljaline

"Arguing with anonymous strangers on the Internet is a sucker's game
because they almost always turn out to be -- or to be indistinguishable from
-- self-righteous sixteen-year-olds possessing infinite amounts of free time."
- Neil Stephenson, _Cryptonomicon_

[siljaline]

"Spy vs Spy" <hjf@hg.com> wrote:

> Ran both. Removed about 50 items.
>
> As soon as I open up a browser, the connect out attempts start all over
> again.
>
> Permanently "Denying" these attempts sends the mischievous program into
> some kind of loop that makes my "Quick Launch" bar almost unusable.
>
> Help !

When Ad-aware and SpyBot don't pick up the *complete* hijack, run Hijack This.
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

<snip> credit due
Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Click: "Save Log" (generates: "hijackthis.log")

Next, go to: http://www.spywareinfo.com/forums/

Sign in, go to the "Spyware and Hijackware Removal" section.
Press "New Topic", copy and paste hijackthis.log into your new message.
</snip>

HTH & Please post back with your findings...


--

siljaline

"Arguing with anonymous strangers on the Internet is a sucker's game
because they almost always turn out to be -- or to be indistinguishable from
-- self-righteous sixteen-year-olds possessing infinite amounts of free time."
- Neil Stephenson, _Cryptonomicon_

[Jay T. Blocksom]

On Thu, 28 Aug 2003 10:49:52 -0500, in <alt.privacy.spyware>, Spy vs Spy
<hjf@hg.com> wrote:
>
[snip]
>
> Ran both. Removed about 50 items.
>
> As soon as I open up a browser, the connect out attempts start all over
> again.
>
[snip]

A. - What browser?

B. - Do you have a "home page" (other than "blank:" or local file) set in
that browser?

> Permanently "Denying" these attempts sends the mischievous program into
> some kind of loop that makes my "Quick Launch" bar almost unusable.
>
[snip]

*What* "quick launch" bar?

Beyond that, it sounds like you've stil got at least one parasite installed
and executing.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -