Help unknown spyware 66.118.169.7

[Tim Smith]

In article <blm4ou$4ll$1@bagan.srce.hr>, Albert_Hall wrote:
> I was wrond, the problem is still present, don't know what to do???

Isn't there anything for Windows that can tell you *what* is trying to make
that connection? I'd expect some of the firewall products to be able to do
that.

It would be fairly easy for anyone who knows how to write Windows LSPs to
write one that watches for connections to a specific IP address or range of
IP addresses, and then reports what task is trying to make that connection,
so I'd be very surprised if there isn't something free out there to do this
already.

--
Evidence Eliminator is worthless. See evidence-eliminator-sucks.com
--Tim Smith

[Jay T. Blocksom]

On Tue, 30 Sep 2003 20:30:03 +0200, in <alt.privacy.spyware>, "Albert_Hall"
<dcosic@net.hr> wrote:
>
> Hy, I have ad-aware and SpyBot installed, and I updated them regulary.
> But i keep getting messages that IE is trying to connect to
> 66.118.169.xxx. X-es are different 7, 11, 10... Can somebody help me this
> is annoying, it's happening every minute or so.
[snip]

It is a reasonably decent bet that your system has been turned into a
"zombie host" by some of the known hardcore proxy-hijackers/spammers who
find a comfy pink home at <sagonet.com>:

<http://groups.google.com/groups?selm=vjgdh9bqsinnf1%40corp.supernews.com>
<http://groups.google.com/groups?selm=vjo9fc4dc8gub0%40corp.supernews.com>
<http://groups.google.com/groups?selm=vk8qq3gi1grd36%40corp.supernews.com>
<http://groups.google.com/groups?selm=vkrbhsicn48va8%40corp.supernews.com>

If this is the case, you need to do a *thorough* audit of everything
installed on your system, and especially all processes which are exzcecuting
after a clean re-boot. Better yet, wipe the disk and do a proper ground-up
re-install of the OS and *only* those apps which are both necessary and
non-hazardous (this leaves out MSIE, of course) from known-good media. The
utilities you find here:

<http://www.litepc.com/>
<http://www.litepc.com/ieradicator.html>

will help ease that task immensely.

> Tnx, and sorry if my english is bad. I'm from a non english speaking
> region.
>

No problem -- I understood you just fine.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -