browser hijack - need HJT help

Discussion in 'Malware Help (A Specialist Will Reply)' started by joshmcdan, Aug 22, 2006.

  1. joshmcdan

    joshmcdan Private E-2

    Hello,
    I have been fighting a browser hijack for a few weeks now. It has taken over hotmail and sends me to a fake hotmail page. I work alot on fed.gov pages and it now sends me to a fake fed.ex page. I went through all of the steps that you listed before posting. I ran Ccleaner, Microsoft Malicious Software Removal, Spybot, etc. I have attached the hijackthis and the runkey and newfiles log files. Please help!

    I run Windows XP with Intel celeron CPU (2400 mhz) and 256 mb memory
     

    Attached Files:

    joshmcdan, Aug 22, 2006
    #1
  2. joshmcdan

    joshmcdan Private E-2

    Also, Here is the log files from the bitdefender and panda scans.

    I hope I have given you all the information you need.

    thanks.
     

    Attached Files:

    joshmcdan, Aug 22, 2006
    #2
  3. joshmcdan

    joshmcdan Private E-2

    :confused: Hello. Did I not provide something you needed to look at the problem? Please help!
     
    joshmcdan, Aug 23, 2006
    #3
  4. joshmcdan

    joshmcdan Private E-2

    I don't want to be a pest, but could someone take a look at my logs...

    thanks
     
    joshmcdan, Aug 23, 2006
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No! The problem is that each time you posted you moved yourself to the bottom of the work queue. We work from oldest to newest order. When you bump, you become newest thus losing your place in the queue.

    The moral. Be patient and don't bump.

    The READ & RUN ME specifically instructs you not to run this:
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

    Please disable it now.

    What the heck is the below and why is it necessary to run at startup?
    O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b

    I assume it is this: http://www.bleepingcomputer.com/startups/Hello.exe-4046.html

    Why would you always want this to be running?????

    Do you recognize the below as being valid?
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Benchmark.local
    O17 - HKLM\Software\..\Telephony: DomainName = Benchmark.local
    O17 - HKLM\System\CCS\Services\Tcpip\..\{93955E1A-3EF0-4E0A-B6E6-C6FEAD96C663}: NameServer = 12.127.16.69,12.10.250.111
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Benchmark.local
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = benchmark.local
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = benchmark.local

    Did you install and do you use the below?
    C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
     
    Last edited: Aug 23, 2006
    chaslang, Aug 23, 2006
    #5
  6. joshmcdan

    joshmcdan Private E-2

    Thanks Chaslang,

    Sorry about bumping - I didn't know.

    PHP:
    The READ & RUN ME specifically instructs you not to run this:
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

    Please disable it now    .
    I didn't do anything to disable Teatime before I ran HJT, but when I just when in to do it - the box was not checked and the SDHelper box was checked. Do I need to do something else to turn it off?


    PHP:
    What the heck is the below and why is it necessary to run at startup?
    O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b

    I assume it is this    : http://www.bleepingcomputer.com/startups/Hello.exe-4046.html

    Why would you always want this to be running?????
    That is one of those picture sharing program things that I downloaded one time to look at someone's pics. I didn't know it was running all the time - pretty clueless, huh?

    PHP:
    Do you recognize the below as being valid?
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Benchmark.local
    O17     - HKLM\Software\..\Telephony: DomainName = Benchmark.local
    O17     - HKLM\System\CCS\Services\Tcpip\..\{93955E1A-3EF0-4E0A-B6E6-C6FEAD96C663}: NameServer = 12.127.16.69,12.10.250.111
    O17     - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Benchmark.local
    O17     - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = benchmark.local
    O17     - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = benchmark.local
    Benchmark is the company I work for so most of those are probably OK, but the middle one without benchmark I do not know.

    Also, I had the weather channel thing on there, but that has been unistalled.

    Thanks for your help
     
    joshmcdan, Aug 23, 2006
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    But are those Ip addresses (12.127.16.69,12.10.250.111 ) part of your network range at work.

    Do you mean yu just now uninstalled it? I saw it in your logs.
     
    chaslang, Aug 23, 2006
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Here is how to

    Disable Spybot's TeaTimer
    • Run Spybot and click Mode
    • Select Advanced Mode.
    • Then click Tools and select Resident.
    • Now in the right window pane, uncheck TeaTimer.
    • Also while this is open, in the left column now select IE Tweaks
    • and then in the right pane make sure all the Miscellaneous locks are unchecked.
    • Now quit Spybot!
    But if your's is showing not checked, something is broken. It may require and uninstall, reboot, delete the c:\program files\spybot search & destroy folder. And then a reinstall and do enable Teatimer during the install.

    However I'm not sure your problems are malware. You may need to do the below.

    First delete this file (use safe mode if necessary):
    C:\Program Files\Windows Media Player\wmplayer.exe.tmp

    Tell me if the below files exist:
    C:\windows\system32\hdpux.exe
    C:\windows\system32\sqrza.exe
    C:\wmp.exe
    C:\windows\wmp.exe


    Now I would first make sure you have local copies of the installation files for Windows Defender and your Symantec software.
    Then I would just uninstall SpywareGuard, Windows Defender, and Symantec. The reboot and then reset web settings (described below). Flush DNS cache. (also shown below).

    Then reinstall Windows Defender and Symantec. Now reconnect to the internet and see what happens.

    Reset Web Settings:
    1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
    Note for IE 7 users: You need to select Internet Options then the Advanced tab and then Reset Internet Explorer Settings!

    Flush the DNS Cache
    Click Start, Run, and enter ipconfig /flushdns and click OK.
     
    Last edited: Aug 23, 2006
    chaslang, Aug 23, 2006
    #8
  9. joshmcdan

    joshmcdan Private E-2

    I am not connected to the network so I am not sure. I will have to get back to you on that tommorrow.

    I uninstalled during the Read and Run reboots since it slows down start-up, but it was probably in there for a few of the runs.

    I found a wmplayer.exe, but not wmplayer.exe.tmp. Should I delete the first one anyway.

    I didn't find any of those files.

    Also, I checked all of the teatime functions that you listed and it appeared to be disabled. I will reinstall it.

    I will do reset the web settings and flush the dnscache after I hear back from you on what I should do with wmplayer.exe.

    Thanks.
     
    joshmcdan, Aug 23, 2006
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Attach a new log from ShowNew.


    No! That is Windows Media Player.
     
    chaslang, Aug 23, 2006
    #10
  11. joshmcdan

    joshmcdan Private E-2

    Here is the new log from ShowNew...
     

    Attached Files:

    joshmcdan, Aug 23, 2006
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! The weather stuff is gone. You need to do the other stuff suggested in message # 8.
     
    chaslang, Aug 23, 2006
    #12
  13. joshmcdan

    joshmcdan Private E-2

    OK. I did the following.

    -Uninstalled Windows Defender, Spy-bot, and symantec.

    -I did the Web reset and DNS Cache flush.

    -I rebooted and reinstalled Windows Defender, spy-bot, and symantec.

    -Windows Defender could not connect to update. I followed the troubleshooting tip, but that didn't seem to help either. Symantec also would not connect to LiveUpdate (It wouldn't before I uninstalled it either).

    -I reinstalled Spy-bot and the default setting was with Teatime disabled. I also checked the IE Tweaks functions and they were not checked either.

    -It is still doing all of the weird browser stuff - fake hotmail, etc. I went ahead and assumed that you would want another HJT log (I know assuming is dangerous). So, here you go.
     

    Attached Files:

    joshmcdan, Aug 24, 2006
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Download HOSTER and then follow the below steps.
    • Unzip Hoster to a convenient folder such as C:\Hoster
    • Run Hoster.exe, click Restore Original Hosts and then click OK.
    • Click the X to exit the program
    Now we are going to try three addresses in your browser and I want to see where they take you.

    1) Now open an IE browser window and enter the below into the address bar:

    www.hotmail.com

    Post back here exactly where you wind up going.

    2) Then enter the below in the address bar

    http://login.live.com/login.srf?id=...tw=0&fs=1&fsa=1&fsat=1296000&lc=1033&_lang=EN

    Now where did you go!

    3) Now enter the below in the address bar:

    216.74.180.189

    Now where did you go?
     
    chaslang, Aug 24, 2006
    #14
  15. joshmcdan

    joshmcdan Private E-2

    When I typed in www.hotmail.com - it took me to the fake hotmail page. I attached a screenshot of it, if that helps.

    On the other two addresses, it took me to the normal hotmail sign in page, but when I typed in my email and password it took me to the fake hotmail page shown in the picture.

    Thanks.
     

    Attached Files:

    joshmcdan, Aug 24, 2006
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I need the address of where it is taking you. That snapshot is not legible.

    What is the text in the Address Bar?

    Did you run Hoster and was it run before trying those steps?
     
    chaslang, Aug 24, 2006
    #16
  17. joshmcdan

    joshmcdan Private E-2

    joshmcdan, Aug 24, 2006
    #17
  18. joshmcdan

    joshmcdan Private E-2

    The text in the address bar is the addresses I put in the previous reply, but at the top of the screen on the blue explorer bar it says - hotmail messenger smiley instant messaging at hotmail.com - Microsoft Internet Explorer

    Yes, I did run Hoster before running those steps.
     
    joshmcdan, Aug 24, 2006
    #18
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    But what is in the Address Bar after the top Blue bar of the IE window changes to show that text.

    Is the stuff coming up something like you get when you click any of the below?

    http://www.optinemail4u.com/search/instant/messaging/hotmail/hotmail.htm

    http://www.cheapest-long-distance-rate.com/buy/cheapest/long/distance/buddy_profile.htm
     
    Last edited: Aug 26, 2006
    chaslang, Aug 25, 2006
    #19
  20. joshmcdan

    joshmcdan Private E-2

    Those two links took me to pages that were exactly like what I am seeing.

    The address bar just says www.hotmail.com though.
     
    joshmcdan, Aug 25, 2006
    #20
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Download the below but do not install yet:

    ZoneAlarmFree

    Also download this Disable/Remove Windows Messenger and run it now to remove Windows Messenger.


    If you do not need to keep that Picasa 2 software uninstall it. If you still want to use it let's at least stop from loading at startup along with a few other items. So run HijackThis and select the below lines and fix them
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
    O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveca12.custhelp.com/7530-b327h/rnl/java/RntX.cab


    Then uninstall Windows Defender and your Symantec software and leave them uninstallled.

    Now install ZoneAlarmFree. It will probably tell you to reboot after it finishes with the install. Reboot. After reboot do the below and use EXACTLY what I suggest for a home page.


    Now we need to Reset Web Settings:
    1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
    Then get a new HJT log and attach it. Also attach new logs from GetRunKey and ShowNew.

    Also tell me what happens when you try to go to hotmail.
     
    Last edited: Aug 26, 2006
    chaslang, Aug 26, 2006
    #21
  22. joshmcdan

    joshmcdan Private E-2

    Attached Files:

    joshmcdan, Aug 27, 2006
    #22
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not sure what that link is that you posted but when I click it, it brings me right back here to this forum and this thread. However note that the first part is a valid Microsoft URL
    Code:
    [B]Domain[/B] : BY113FD.BAY113.HOTMAIL.MSN.COM
[B]IP address[/B]   : [URL="http://cqcounter.com/whois/?query=65.54.168.250"][COLOR=#000099]65.54.168.250[/COLOR][/URL]
[B]ISP          :[/B] Microsoft Corp
[B]Organization :[/B] Microsoft Corp
[B]Location     :[/B] [IMG]http://img.cqcounter.com/flags/us.gif[/IMG] US, United States

    You never answered my question in message # 7 about those IP addresses!

    If it is not recognized, have HJT fix the below line:
    O17 - HKLM\System\CCS\Services\Tcpip\..\{93955E1A-3EF0-4E0A-B6E6-C6FEAD96C663}: NameServer = 12.127.16.69,12.10.250.111


    Do you use a cable or DSL modem? Also do you use a router? If you answer yes, please power cycyle the modem and/or router?

    Then now that we still have Windows Defender and Symantec uninstalled, run Hoster again (see msg # 14) and also run the below again:

    Flush the DNS Cache
    Click Start, Run, and enter ipconfig /flushdns and click OK.


    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Locate and delete the below files:
    C:\1a6dc899-2d3d-4d22-b5d9-5e52eb4621ab.cab
    C:\a654dc26-b921-43ea-bc1d-8c2e100a01f8.cab
    C:\WINDOWS\system32\ssmute.ini

    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\Documents and Settings\jmcdaniel\Local Settings\Temp\


    Now please download DelDomains and unzip it to your desktop. Do not run it yet.

    Find the files from deldomains.zip on your Desktop and RightClick on the deldomains.inf file and select Install.

    (Please note if you have Spybot S&D installed you will need to "Immunize" again because deldomains will remove all of the sites Spybot adds.)

    Now reboot your PC and tell me where things stand.
     
    Last edited: Aug 28, 2006
    chaslang, Aug 28, 2006
    #23
  24. joshmcdan

    joshmcdan Private E-2

    The IP address was not part of the work network, but it is likely mine - i deleted it and lost internet access. I restored it and it came back.

    I ran all of the procedures (power cycled modem, hoster, flush the dns cache, fixme.reg, deleted files, and installed deldomains.inf) you suggested and things are better. When I clicked on hotmail it took me to the regular log in page rather than the fake page. But as soon as I tried to log on it redirected me to the fake page again. Some of the other sites are better though. News sites like cnn.com and yahoo.com were distorted and the formatting was all off. Those are back to normal.
     
    joshmcdan, Aug 28, 2006
    #24
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I do not see any problems! If you are being redirected to BY113FD.BAY113.HOTMAIL.MSN.COM, this is Microsoft as I stated in my previous message.

    Have you tried just using another browser like Mozilla FireFox
     
    chaslang, Aug 29, 2006
    #25
  26. joshmcdan

    joshmcdan Private E-2

    OK. I installed Firefox and so far so good. Thanks. I will go ahead and reinstall my AV software and Windows defender. Is there anything I should do?

    Your help is definitely appreciated.
     
    joshmcdan, Aug 29, 2006
    #26
  27. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Yes your final steps are below.

    If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
    chaslang, Aug 29, 2006
    #27
  28. joshmcdan

    joshmcdan Private E-2

    Well, I spoke too soon. Firefox worked OK most of the day. Then it came back after I did the system restore routine. Hotmail now goes to a site with the Hotmail addess in the addess bar, but it is a fake directNIC site. A few other sites were redirected as well, but most are OK. It is weird - it just takes over specific sites like .gov and .edu sites, but leaves other ones OK. I did some googling and there seems to be some connections between these fake directNIC sites and a cybersquatter with a bunch of names like kenyatech.com, kentech.com, intercosmos media group, spiral matrix, and orion web. I don't know. Any ideas of more steps I can try?
     
    joshmcdan, Aug 29, 2006
    #28
  29. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    First a question! Did you reinstall Symantec and now the problem is back? I have read complaints from a few users on the internet talking about the same problems as you are having and they said that it was related to a proxy from Norton Internet Security!

    Is AT&T World Net your ISP?

    Can you connect to the Internet when you boot in safe mode? If so, does the problem you are having occur in safe mode?

    Exactly how do you connect to the internet (DSL, CABLE, private LAN, dial-up)?

    Does the problem occur at work, at home, or both?

    Each time you believe you are being redirected, save and attach the URL or the site you going to.
     
    Last edited: Aug 30, 2006
    chaslang, Aug 30, 2006
    #29
  30. joshmcdan

    joshmcdan Private E-2

    Yes, the problems did start after I did system restore and reinstalled symantec. Should I go through the procedures again and install some of the other AV software that is listed in the how to prevent posting?

    ATT world net is not my ISP and I have DSL.

    The problems are only on my work computer (I have an office by myself and my company is in another state). I have a Mac at home.

    One thing that might be important - on one of the redirect pages there is a clickable link 'Why am I seeing this page' When you scroll over it an email address comes up - info@whois-help.info


    Here is the url for the hotmail page - http://by113fd.bay113.hotmail.msn.c...231f0b6640a194473af3b7629817642522de114ba73f6


    This is new. When I go to cnn.com it is normal for a few seconds and I am redirected to this address http://bannerfarm.ace.advertising.com/
     
    joshmcdan, Aug 30, 2006
    #30
  31. joshmcdan

    joshmcdan Private E-2

    One more thing.. When Firefox was running clean for a while before I did the system restore and reinstalled symantec there were some weird things going on. I would load a page and it would appear to be fully loaded, but down at the bottom it was say Loading... www.domainsponsor.com. I don't know if it is relevant, but I am just trying to think of any clue possible.
     
    joshmcdan, Aug 30, 2006
    #31
  32. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes let's do the following and in the order written:

    • download this AVG Free Edition - do not install yet
    • disconnect from the internet by unplugging your cable
    • uninstall Symantec
    • reboot and delete any left over Symantec folders in C:\Program Files and also in C:\Program Files\Common Files.
    • install AVG
    • reconnect to the internet and get updates for AVG
    • run a full scan with AVG (save a log if anything is found)
    • toggle System Restore again (i.e, disable, reboot, enable).
    Now Reset Web Settings (see msg #21) , flush the DNS cache (see msg #8), and attach a new HJT log. Let me know your status.
     
    chaslang, Aug 31, 2006
    #32
  33. joshmcdan

    joshmcdan Private E-2

    Ok I ran through al the procedures above and no change. And some pages are even a little worse. Hotmail still goes to the same directNIC page (screenshot attached) and the address is still: http://by113fd.bay113.hotmail.msn.c...231f0b6640a194473af3b7629817642522de114ba73f6

    CNN is all messed up, but where images usually are there are these weird ad banners - see screenshot

    When I did a search on bannerfarm ace advertising I found this from eTrust software - http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453075744

    HJT log is also attached.

    Thanks.
     

    Attached Files:

    joshmcdan, Aug 31, 2006
    #33
  34. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not sure what that first link is that you posted in message # 33 is but when I click it, I come right back here to this forum and this thread. I would have to say you did not attach the full URL properly. That is what it looks like to me. The URL does not match your snapshot. However if I paste in the full URL into my browser, I do goto a valid hotmail web page.

    Back in message # 30 you said these two things:
    The first would appear to be incorrect. The below O17 line indicates AT&T Worldnet

    O17 - HKLM\System\CCS\Services\Tcpip\..\{93955E1A-3EF0-4E0A-B6E6-C6FEAD96C663}: NameServer = 12.127.16.69,12.10.250.111



    And are you saying in the second statement that you are woorking from home and are not at some company's site?
    If you are working from home, why do you need the below. I would fix them and see what happens:
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Benchmark.local
    O17 - HKLM\Software\..\Telephony: DomainName = Benchmark.local
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Benchmark.local
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = benchmark.local
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = benchmark.local


    You said you power cycled your DSL modem earlier in this thread, but you never said whether you use a router inbetween your DSL modem and PC?


    Now download Blacklight Beta
    • Download blbeta.exe and save it to the Desktop.
    • Once saved... double click blbeta.exe to install the program.
    • Click accept agreement and Click scan
      This app too may fire off a warning from antivirus. Let the driver load.
      Wait for it to finish.
    • If it displays any items...don't do anything with them yet. Just hit exit (close)
    • It will drop a log on Desktop that starts with fsbl....big number
    Please post contents of the BlackLight log.
     
    Last edited: Sep 1, 2006
    chaslang, Sep 1, 2006
    #34
  35. joshmcdan

    joshmcdan Private E-2

    CDMS - the organization listed under the second IP address in my ISP. I called them and they said that as far as they know they are not connected to AT&T world net services. They are checking on that though. I will get back to you on that one.

    I deleted all of the Benchmark entries, but that didn't seem to do anything.

    Powercycling the modem - I just thought that was shutting down the computer and disconnecting the dsl cable for a minute or so. I am not sure what you mean by a router - do you mean wireless router? If so, no I don't have one. I just connect directly to the dsl outlet in the wall. Sorry for lack of technical knowledge.

    I have attached the Backlight log
     

    Attached Files:

    joshmcdan, Sep 1, 2006
    #35
  36. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    They may lease the DSL lines thru AT&T.

    No! Power cycling the modem means to actually shut off the power to the DSL modem and then turn it back on after a minute.
     
    chaslang, Sep 2, 2006
    #36
  37. joshmcdan

    joshmcdan Private E-2

    OK, so if my modem is internal - how do turn the power off to it other than just shutting down the power for the whole unit?

    Is it time to look into getting a hold of all the disks to reformat?
     
    joshmcdan, Sep 4, 2006
    #37
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! That's ddifferent! Shutting down you PC does power cycle the DSL modem since it is internal.

    Other than verfying that you ISP is not redirecting you some how, I have nothing else for you to try (unless you have another PC you could connect just to test what happens). If the other PC did the same thing, I would then say the problem is with your ISP.
     
    chaslang, Sep 5, 2006
    #38

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds