what's this antrexhost??

hello pplz.

lately[been a while now]... according to my fw traffic log, explorer.exe is trying to connect to antrexhost.com [80.86.190.22]
I don't remember seeing this before... I googled "antrexhost" & it came up nothing.

I did a whois on greektools[someone posted this link a while back in one of the previous threads]
& the result is...

Results:
% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Note: the default output of the RIPE Whois server
% is changed. Your tools may need to be adjusted. See
% http://www.ripe.net/db/news/abuse-pr...-20050331.html
% for more details.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '80.86.190.0 - 80.86.191.255'

inetnum: 80.86.190.0 - 80.86.191.255
netname: LNC-AIHS-NET-GMBH2
descr: AIHS.Net GmbH
country: DE
admin-c: ST1583-RIPE
tech-c: ST1583-RIPE
status: ASSIGNED PA
mnt-by: LNC-MNT
mnt-lower: LNC-MNT
source: RIPE # Filtered

person: Sergej Teverovski
address: Hanauerlandstrasse 312a, DE-60314 Frankfurt am Main
phone: +49 69 426 03 877
fax-no: +49 69 - 941 46 746
abuse-mailbox: [email protected]
nic-hdl: ST1583-RIPE
mnt-by: LNC-MNT
source: RIPE # Filtered

% Information related to '80.86.160.0/19AS13237'

route: 80.86.160.0/19
descr: Lambdanet Operations - German region
origin: AS13237
mnt-by: LNC-MNT
source: RIPE # Filtered


... I'm getting paranoid heh-heh. not to mention the fact that when I opened up IE just now, just a simple webpage without too many pictures... the memory usage in the task manager kept on increasing.

:eek:

what's going on??

Your IE home page has been hijacked and you probably have some other issues. I recommend that you reboot to SafeMode with Networking (Press F8 while rebooting and select SafeMode with Networking from menu). Run an AV scan (you do have an anti-virus program, right?), and a spyware scan (Google SpyBot, download, install, update and run it).

Get Hijackthis (www.merijn.org) and run it. If you feel comfortable with this, post the hijackthis results here so the experts here can look it over to help you nail the baddies.

[edit]
Yeah, fixed URL. Sorry
[/edit]

Quote:

---

I opened up IE just now, just a simple webpage without too many pictures...

---

Now.. You just opened the link in IE or you [b]Just opened IE, and your normal webpage gave the prob[b], or when you opened IE the link opened automaticly

So your firewal.. Software or hardware? if software in your gateway PC..or your workstation?

And the program that is trying to access the site is EXPLORER.EXE? not IEXPLORE.EXE one is your windows core the other is your browser..

HAve you checked running processes on your PC's? (AKA : rapier57's advice of HJT scan, other tools here.. processview, tcpview but these give you a relitivly live view.)

HAve you considered giving Rootkit revealer a burl on your machines..

personally I would have TCPVIEW running and looking for system traffic..

Quote:

---

Now.. You just opened the link in IE or you Just opened IE, and your normal webpage gave the prob[b], or [b]when you opened IE the link opened automaticly

---

I meant when I open up IE... not "opened the link in IE" ... whatever websites I go to, it takes up alot of memory usage. I hope that made sense.

Quote:

---

So your firewal.. Software or hardware? if software in your gateway PC..or your workstation?

---

umm, it's a software firewall... Sygate personal firewall.. ¬ ¬ I'm afraid I do not understand "in your gateway PC.. "? please pardon me.

Quote:

---

And the program that is trying to access the site is EXPLORER.EXE? not IEXPLORE.EXE one is your windows core the other is your browser..

---

I'd print screened these particular traffic.... here are the 2 links. http://img.photobucket.com/albums/v2.../boringppl.jpg

and...
http://img.photobucket.com/albums/v2...boringppl2.jpg

looks like they have different hostnames too? O.o

I'd also done a virus scan with avg 7.1 professional trial version ¬ ¬
no virus found. also run adaware & spybot... adaware didn't turn up anything critical.. just the MRU list..[negligible objects]... & spybot turned up directhit & something-avenue. Sorry, forgot to write down the 2 spywares.

lastly, here's the hijackthis result....

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.racewarkingdoms.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.0.0
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Microsoftkeysds] lass32.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Microsoft PCI Manager] mspci.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\RunServices: [Microsoftkeysds] lass32.exe
O4 - HKLM\..\RunServices: [Microsoft PCI Manager] mspci.exe
O4 - HKLM\..\RunServices: [Microsoft Windows System] a.exe
O4 - HKCU\..\Run: [Microsoftkeysds] lass32.exe
O4 - HKCU\..\Run: [Sygate Personal Port] crss.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall Start] servic.exe
O4 - HKCU\..\Run: [Microsoft PCI Manager] mspci.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [Microsoft PCI Manager] mspci.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1120877852091
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europ...vex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

[edit]
i've not heard of rootkit revealer before so no, i havent tried it.
[/edit]

I believe you're 0wn3d my friend..

Quote:

---

O4 - HKLM\..\Run: [Microsoftkeysds] lass32.exe

O4 - HKLM\..\Run: [Microsoft PCI Manager] mspci.exe

O4 - HKLM\..\RunServices: [Microsoftkeysds] lass32.exe
O4 - HKLM\..\RunServices: [Microsoft PCI Manager] mspci.exe
O4 - HKLM\..\RunServices: [Microsoft Windows System] a.exe
O4 - HKCU\..\Run: [Microsoftkeysds] lass32.exe

O4 - HKCU\..\Run: [Microsoft PCI Manager] mspci.exe

O4 - HKCU\..\RunServices: [Microsoft PCI Manager] mspci.exe

---

Look up SDBot..

umm... (just to make sure)do I click on "fix" on hijackthis?
i've also looked up on sdbot, and from symantec website, it adds those aforementioned values to the registry keys.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Quote:

---

Originally posted here by tragicallyhip
umm... (just to make sure)do I click on "fix" on hijackthis?

---

You could try it.. But if SDBot is active these values might automagicly reappear.. I suggest downloading Stinger (McAfee) or one of the Symantec removal tools.. Boot to safe mode and run them..

Quote:

---

Name: microsoftkeysds
Filename: lass32.exe
Command: Unknown at this time.
Description: Added by a variant of the WIN32.RBOT WORM!
File Location: Unknown
Startup Type: This startup entry is started automatically from a Run, RunOnce, RunServices, or RunServicesOnce entry in the registry.
HijackThis Category: O4 Entry
Removal Instructions: How to remove a Trojan, Virus, Worm, or other Malware

---

Download the following:

Sysclean.com from this link: http://www.trendmicro.com/download/dcs.asp

LPTxxx.zip - the virus pattern file: http://www.trendmicro.com/download/viruspattern.asp

Save both in the same folder on your desktop: unzip the the pattern file.. be surethese files and the SYSCLEAN.COM are in the sime folder.

RESTART your PC in SafeMode
Open the folder you saved Sysclean and the Pattern files.

Run - Sysclean.. and wait..

This is the first stage of the cleanup....
..

One word of caution.. Be safest if any programs that your advised to download do so from a clean machine.. and burn these to a CD..DONT USE A USB DRIVE.. unless you have set it to READ ONLY..

pwned...

http://www.hijackthis.de/ ... use this site to analyze you hijackthis logs

As you already know, you've got several exes that are known bots. What you haven't mentioned is if your firewall is allowing this traffic. This simple fact will reveal if you're truly owned or if you host just has the infections but cannot communicate back to the C&C server. Obviously if they can't talk back to the C&C, the criticality of this incident is reduced greatly.

--TH13

I've tried using Sysclean but there wasn't any virus found. is it normal for the sysclean log to show that ... e.g., Could not set file for reading on "C:\Windows\Prefetch\....." access is denied.
or "an error occured while scanning file... access is denied."?

and also, i'd like to further add on that on May 22nd [i know the date 'cause avg test result logs it], when I brought up task manager, I saw a.exe running. I checked my firewall log, it was trying to connect to an irc server. the traffic was blocked by my fw. suspicious about that, I went to download avg to scan my comp. sure enough, avg found a "trojan horse IRC/backdoor.sdbot.rox". & avg deleted that sdbot.
just thought i should mention that.



& I clicked on "fix" for hijackthis[referring to previous posts].
even though I've "fixed" those entries, explorer.exe is still trying to connect to antrexhost.


& meh, now my fw has an error... whenever i start up my comp, it says

Sygate Agent Firewall has encountered a problem and needs to close. We are sorry for the inconvenience
szAppName : Smc.exe szAppVer : 5.6.0.2808 szModName : trident.dll
szModVer : 5.5.0.0 offset : 0007394a

I havent tried logging to the net with my desktop since then.

looks like I need to get a new freeware fw now....
:rolleyes:

Hmmm, a.exe? That one's been around for a few years now. Been there, done that.

http://www.symantec.com/avcenter/[email protected]

Some stuff in your Prefetch folder's going to be normal, though it builds up over time. It's safe to delete everything in it.

http://www.jsifaq.com/SUBL/tip5800/rh5826.htm

It might be a good idea to run Ccleaner on your PC to clear out all the temp files (incl. the prefetch). Just google "ccleaner.exe" and "download" to find it.

I used to use Sygate's firewall on my W2K boxes and had a similar issue to yours once. Try reinstalling Sygate to see if that corrects that problem.

Here is a link to a guide in how to remove Trojans/Viruses/Worms or other Malware..

Bleeping Computer

Luck ;)

Just a thought, did you run your scans in safe mode?

Also, try getting Spybot Search & Destroy, updating it, running it in safe mode, then using the tools under advanced startup mode to look at what BHOs, Hosts file contents and the like you have.

Other potentially useful tools are EWIDO and A-Squared. Remember to update and run them in safe mode.

:)

Nihil: yupyup, all in safe mode. also, I used the tools under advanced mode [scanned in safe mode] ... then under the System startup tab, there's this info.... Key: HK_CU: Run... Value: Sygate Personal Firewall Start.... Cmd line: servic.exe...

when I clicked on the right hand tab to get more information[there are 2]it says:
"Database status: Not required - virus, spyware, malware or other resource hog.
Value: Sygate personal firewall start
Filename: services32.exe
Description: added by the RBOT-MB worm."

another one is...
"Database status: Not required - virus, spyware, malware or other resource hog.
Value: Sygate personal firewall start
Filename: servic.exe
Description: added by the RBOT-RY worm."

there wasnt anything under 'Hosts File" except for localhost.
under "BHOs", there were just AcroIEHelper.ocx, SDHelper.dll, & ssv.dll.

so there werent any glaring obviousness other than the servic.exe thingy.

I've downloaded autoruns from the "bleeping computer" link... & I think it's going to take me a few days to decide what looks malicious, etc.
[edit: to add on a few]
But... I've just run it once... and under "logon" tab, there's also Sygate Personal Port.... and Image Path says "File not found: crss.exe

a google search brought me to http://de.trendmicro-europe.com/ente...e=WORM_RBOT.WX

& whatever it is listed down there rings true. :/

to change 'em back to the original value, do I right click & click on modify?
/edit

Hi

GO to this site and download CCLeaner and install

Next read this article on How to Disable System Restore disable your System Restore

boot into safe mode,
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

Run Ccleaner...Guide do your Anti Virus scans....

Run your HJT program and have it fix the following:

O4 - HKLM\..\Run: [Microsoftkeysds] lass32.exe
O4 - HKLM\..\RunServices: [Microsoftkeysds] lass32.exe
O4 - HKLM\..\Run: [Microsoft PCI Manager] mspci.exe
O4 - HKLM\..\RunServices: [Microsoft Windows System] a.exe
O4 - HKCU\..\Run: [Microsoftkeysds] lass32.exe
O4 - HKCU\..\Run: [Microsoft PCI Manager] mspci.exe
O4 - HKCU\..\RunServices: [Microsoft PCI Manager] mspci.exe


Reboot into normal and run another HJT log and post it here..

Quote:

---

Originally posted here by brokencrow
... Some stuff in your Prefetch folder's going to be normal, though it builds up over time. It's safe to delete everything in it. ...

---

From what I've read about the prefetch folder, is it is safe to delete everything except the layout.ini file. It can be a real pain to get the prefetch system working again if that is deleted.

downloaded the ccleaner, and followed the guide.

might I add that I fixed those entries a while back on Hijackthis so... this time round, there werent any of those entries when I did a scan in safe mode.

anyway, here's the new log

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.racewarkingdoms.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1120877852091
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europ...vex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{82218235-3AAA-405E-BAC8-644A0B4497B2}: NameServer =
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hi

Looks fairly clean, I would have HJT fix these, unless you are familiar with them.

O17 - HKLM\System\CCS\Services\Tcpip\..\{82218235-3AAA-405E-BAC8-644A0B4497B2}: NameServer =

Quote:

---

O17 - Lop.com domain hijacks


What it looks like:

O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = W21944.find-quick.com
O17 - HKLM\Software\..\Telephony: DomainName = W21944.find-quick.com

O17 - HKLM\System\CCS\Services\Tcpip\..\{D196AB38-4D1F-45C1-9108-46D367F19F7E}: Domain = W21944.find-quick.com

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = gla.ac.uk

O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.57.146.14,69.57.147.175

What to do:
If the domain is not from your ISP or company network, have HijackThis fix it. The same goes for the 'SearchList' entries.
For the 'NameServer' (DNS servers) entries, Google for the IP or IPs and it will be easy to see if they are good or bad.

---

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

Quote:

---

O18 - Extra protocols and protocol hijackers


What it looks like:

O18 - Protocol: relatedlinks - {5AB65DD4-01FB-44D5-9537-3767AB80F790} - C:\PROGRA~1\COMMON~1\MSIETS\msielink.dll
O18 - Protocol: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82}
O18 - Protocol hijack: http - {66993893-61B8-47DC-B10D-21E0C86DD9C8}

What to do:
Only a few hijackers show up here. The known baddies are 'cn' (CommonName), 'ayb' (Lop.com) and 'relatedlinks' (Huntbar), you should have HijackThis fix those.
Other things that show up are either not confirmed safe yet, or are hijacked (i.e. the CLSID has been changed) by spyware. In the last case, have HijackThis fix it.

---

The quoted information is from Merjin's HJT tutorial...worth a read:

HJT Tutorial


How is everything running now?

A little late
but others may be reading and be in a similar situation

Go here
follow the instructions
give yourself a fighting chance in this world of hurt we now inhabit

[me ends morbid whinging]

hihi.

Quote:

---

How is everything running now?

---

Hmm, Im not sure... 2 IE windows open & the memory usage slowly shoot up to 105, 000++ k.... & slowly on the increase.

... is it normal for Windows Explorer still trying to connect to antrexhost?? :confused:

Quote:

---

Originally posted here by tragicallyhip
hihi.



Hmm, Im not sure... 2 IE windows open & the memory usage slowly shoot up to 105, 000++ k.... & slowly on the increase.

... is it normal for Windows Explorer still trying to connect to antrexhost?? :confused:

---

Hi

Are you using a router?

Some more info on the IP just before 80.86.160.22 (217.71.105.94) gives me this:

inetnum: 217.71.105.0 - 217.71.105.255
netname: EU-LAMBDANET-CORE-DE-P2P
descr: P2P between German Routers
descr: LambdaNet Communications Deutschland AG
country: DE
admin-c: LNC-RIPE
tech-c: LNC-RIPE
status: ASSIGNED PA
mnt-by: LNC-MNT
mnt-lower: LNC-MNT
source: RIPE # Filtered

role: LAMBDANET REGISTRY
address: LambdaNet Communications Deutschland AG
address: Guenther-Wagner-Allee 13
address: 30177 Hannover
e-mail: [email protected]
remarks: +---------------------------------------------------+
remarks: | Operational issues 24x7: nmc_at_lambdanet.net |
remarks: | Abuse and spam: abuse_at_lambdanet.net |
remarks: | Routing, IP requests: routing_at_lambdanet.net |
remarks: | Peering requests: http://peering.lambdanet.net |
remarks: +---------------------------------------------------+
admin-c: MSK-RIPE
tech-c: KKK-RIPE
tech-c: MSK-RIPE
tech-c: CST-RIPE
nic-hdl: LNC-RIPE
e-mail: [email protected]
mnt-by: LNC-MNT
source: RIPE # Filtered

% Information related to '217.71.96.0/20AS13237'

route: 217.71.96.0/20
descr: LambdaNet Backbone
origin: AS13237
mnt-by: LNC-MNT
source: RIPE # Filtered

What version of XP are you running and what service pack is it? SP1 or SP2...also what version of IE are you using, usually in the HJT log headings you will see your PC's config and this is part of the log...

Other then that antrexhost.exe is not showing up anywhere else on the net. Is lambdanet your ISP, maybe check with them.?

hihi.
somtimes, I use siemens speedstream router, & sometimes I use a modem - to the same ISP.

Quote:

---

What version of XP are you running and what service pack is it? SP1 or SP2...also what version of IE are you using

---

Im using XP pro... just XP... no SP1 nor SP2. & im using IE version 6.

Quote:

---

Other then that antrexhost.exe is not showing up anywhere else on the net. Is lambdanet your ISP, maybe check with them.?

---

when I googled "antrexhost" it showed up www[dot]antrexhost[dot]com... when I clicked on it... it was a blank page. my ISP is singnet.
hmm, well, when I connect on my laptop, explorer.exe doesn't ask for permission to connect to antrexhost.

Quote:

---

Originally posted here by tragicallyhip
Im using XP pro... just XP... no SP1 nor SP2. & im using IE version 6.

---

No wonder you're 0wn3d! Install SP2 asap.. Then run Windows Update, there are a lot of post SP2 patches...

heh, well, microsoft doesnt allow me to update to sp2 :D

im not using a genuine v. im saving money to get a genuine one, soon. hopefully. ahem.

Quote:

---

Originally posted here by tragicallyhip
Im using XP pro... just XP... no SP1 nor SP2. & im using IE version 6.

---

If I am reading this right...you have neither SP1 or SP2?...OMG when was the last time you actually checked for updates, I would be willing to bet that you had some URL Redirects in your HOSTS file and these probably corrupted your Windows Automatic Updates from phoning home...like SirDice say's, you need to get patched, but because your registry is probably a quagmire, do a reinstall, before this I would suggest you get the SP2 Slipstreaming Windows

Then with the firewall active, get the rest of the updates pronto and then read this: How Did I Get Infected?

Edit: I should have known better.... :mad:

Well...sometimes the fastest easiest way to fix this,....is to backup your data and reinstall.

and if you want a free OS....there are plenty of options out there.... :rolleyes:

MLF

yessir!
thanks everyone for the time in replying & the useful links.....