|
Posted by Moe Trin on June 6, 2005, 11:27 am
If you were Registered and logged in, you could reply and use other advanced thread options
In the Usenet newsgroup comp.security.misc, in article
>The Proxomitron reports that it has blocked the following addresses.
Why is software that you installed trying to connect to those addresses?
>Using "whois" I came up with the following:
>
>Abovenet Communications, Inc ABOVENET-6 (NET-208-184-0-0-1)
> 208.184.0.0 - 208.185.255.255
>EZULA/KABANGA MFN-B423-208-185-211-64-27 (NET-208-185-211-64-1)
> 208.185.211.64 - 208.185.211.95
>
>United Layer, Inc. UNITEDLAYER-1 (NET-209-237-224-0-1)
> 209.237.224.0 - 209.237.255.255
>Alexa Internet ALEXA-INTERNET (NET-209-237-237-0-1)
> 209.237.237.0 - 209.237.238.255
>
>Would this show an infection or trojan?
Someone with the handle of "Yosponge" posts a list of sites and addresses
to be concerned with. See the Usenet newsgroup 'alt.privacy.spyware' and
http://www.geocities.com/yosponge/blockips.txt. The 208.185.211.64/27
and 209.237.237.0/23 address ranges show up on the lists.
>I've run a scan using AdAware and Spyblaster and neither show any spyware
>present, yet Proxomitorn keeps stopping access to these sites.
One would normally ask why you installed whatever software it is that
contains this malware, but it's your computer, not mine. Some software
you thought was interesting, or that some web site offered to install
for you is (as usual) infected. Happens all the time, which is why there
is a huge market for anti-malware products.
>Anyone got any suggestions?
alt.privacy.spyware
Old guy
| 
XML site map