Problem ?

idledave · 15-11-2005, 18:10

Hi guys sorry I'm new so this is probably in the wrong section but here goes, Just lately every time I boot up my system tries to connect to the same Ip destination (sorry didn't make a note but its something similar to 192.168.4.100

NS) anyway Zonealarm always intercepts and stops it. Each time a different thing is stated as trying to access, sometimes it say "operating system" or a dll file sometimes a collection of symbols or a cab or prefetch file. anyway the last cab file I noted part of the name and entered it in google and an Adaware or spyware checker site said it related to a hotbar adware that targeted cable users... Not entirely convinced but just annoyed that this zone alarm appears at every boot Ad aware fails to resolve it and the latest definitions on AVG fail to find any virus although 2 appeared recently when installing a game and they affected my system restore.. any ideas please is this a virus, is it adware is it just a small glitch with ntl ? help please....

Mick Fisher · 15-11-2005, 18:46

I thought 192.168.* addresses were for cable modem diagnostic pages. Can't be sure as I have a Terayon and it is not applicable.

Zone Alarm has been and is from time to time a known trouble maker. My advice is to dump it.
Here is a free PFW to replace it. I have used this for years with no problems.
http://www.kerio.com/dwn/kpf2-en-win.exe

If the problem persists try scanning with Counter Spy and/or Webroot Spysweeper. Spybot and Adaware just don't seem to do the business anymore.

HTH

idledave · 15-11-2005, 19:30

thanks for the advice I'll give it a try, I thought there might be a conflict with ZA and Ntl also I will try the different adware snooper, just in case... that might explain the different items trying to connect. Dave

Jon T · 15-11-2005, 20:18

are you sure it's not 194.168.4.100, if so, then it's the address of ntl's secondary DNS sever, somthing which you should deffinatly allow through Zone Alarm.

Hom3r · 15-11-2005, 20:24

192.168.x.x are for local neworks

Hom3r · 15-11-2005, 20:25

If you have a router it could explain the 192.168.4.100 address you are getting

idledave · 15-11-2005, 21:00

THank everyone its all helpful, I think this may be directly connected with my son, he has started using gnucleus, its like ares and locates music videos (and no doubt porn, knowing him) I took the advice from above and downloaded webroots antispy software and although i've used ad aware it found loads of keyloggers, stealth web page recorders, spy software and winad adware.. I'm sure one of these must be responsible and I have deleted them although now after the system locked up and I logged off and on "Operating System" is trying to connect with 64.127.103.41:HTTP, is there a program that can track these IP destinations ? how can I tell whats safe and whats not ?

idledave · 15-11-2005, 21:15

oh by the way I do not use a router, my friend has one and his neighbours laptop can access it... how odd and it is possible that it was 194.168.4.100:dns

idledave · 15-11-2005, 21:41

Oh and also... I have a tendency to have my passwords and usernames in a textfile and I copy and paste them instead of typing them in, can keyloggers/ spyware still work as I'm not actually typing in any information ?

Jon T · 16-11-2005, 07:23

I'd run a program such as webroot spysweeper on your PC, it's a time limited trail, but it'll do for a once only dis-infection, however at 20USD it may be worth buying it, only works out at around £12.

fatnose12 · 16-11-2005, 10:51

If you are looking for a programme to trace IP addresses, I found one some time ago, samespade.org. Maybe this will be of help