Spybot Info PLEASE!!

[scarecrowdr]

OK, I am Stumped by this Progy.....
Had a Virus called "JS_APPACTXCOMP.A"...Got rid of it but my Web Pages still dont load up first time or I get redX in boxes, I then do a Re-Fresh n it loads....This is Every Page....So I downloaded "SpyBot" and it found a few things n I deleted em...Alls Well till now......I have got a "Common Hijacker:Redirected Host Auto.Search.MSN.com=216.65.3.76
I click on it for Info, Wont Give any Info....I click to Delete n this pops up in German & English=Access is DENIED.......
WHAT is it Please, n is it OK or BAD........ALSO What the Heck is USAGE Tracks & Tracks.uti.....And should I tick all my Programs thats Listed in Usage Tracks.uti PRODUCTS.....
Thanks in Advance......Dennis

[ilona47]

http://www.net-integration.net/forums.html is the site for SPYBOT ...perhaps you can ask questions there.

[jerryctx]

Are you using InCtrl5? I believe Tracks.uti is a sort of log file generated by InCtrl5.

[markp62]

I did a whois using IP Lookup using the IP you supplied and this is what I got:

OrgName: Maxim
OrgID: MAX

NetRange: 216.65.0.0 - 216.65.127.255
CIDR: 216.65.0.0/17
NetName: MAXIM-NETBLK-1
NetHandle: NET-216-65-0-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Allocation
NameServer: PIT.MAXIM.NET
NameServer: PENDULUM.MAXIM.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 1998-09-02
Updated: 2001-06-01

TechHandle: ZZ1355-ARIN
TechName: arin coordinator, arin
TechPhone: +1-800-640-4629
TechEmail: arin-swip@maxim.net

OrgNOCHandle: ZZ1355-ARIN
OrgNOCName: arin coordinator, arin
OrgNOCPhone: +1-800-640-4629
OrgNOCEmail: arin-swip@maxim.net

OrgTechHandle: ZZ1355-ARIN
OrgTechName: arin coordinator, arin
OrgTechPhone: +1-800-640-4629
OrgTechEmail: arin-swip@maxim.net

[scarecrowdr]

Hi markP62, I also did that scan in ZoneAlarm n this is the address I got-----uunet,Alternet - Tech Support, 3060nWilliams Drive, Fairfax, VA22031+1(800)900-0241....

I have also got the Program...HiJack This....n the good person Bellekom M.R is trying to help me on this one as well.....
I have come up with a few HOSTS.SAM & hosts on my comp....Notepad would not or could not find them, but Search came up with them....Not got a Clue what they are or mean......
All I know is that I can't Exit my MSN Messenger n I gota keep refreshing my Pages in IE...So Have I got a Trojan thats HiJacked my MSN Mess., etc., or am I being a little Paranoied....

[Newt]

hosts - a text file that can be populated by ip address & computer name to speed up network/internet searches & connections. Location for the working version of the file will vary according to the OS you use. And not essential if you have another means of matching ip address and computer name available (WINS, DNS, whatever) but can be lots faster than either of those in most cases.

hosts.sam - a template file with examples that you can use to create a proper hosts file on your PC. hosts.sam isn't active and doesn't do anything. Put on the PC by default when you load networking & TCP/IP I think.

You will also probably find lmhosts and lmhosts.sam if you are running a Microsoft OS. Slightly fancier than hosts but not as universal.

[jerryctx]

Using Windows Explorer, navigate to file c:\Windows\Hosts (or use the Search function as you did before).

Left click once on the file, then hold down the Shift key and right click on the file.

Select "Open with" from the drop down menu.

Select "Wordpad" from the list of programs. (The file may be too big for Notepad).

If no sites are listed in the file disregard the rest of this post.

Otherwise, do the sites specify IP address 127.0.0.1 or 0.0.0.0?

If yes, those sites are being blocked. Probably some "adware" program you ran inserted advertising sites (see the Hosts file page on my web site for more info:

http://pcinsecurity.com/b414host.html )

If other IP addresses are listed your virus may have redirected sites (www.sample.com now points to www.porn.com).

Try renaming hosts to hosts.old and see if it helps your problems. Don't delete it until you let us review the contents.

[scarecrowdr]

THANK YOU ALL..........For you're very kind Help.........
A gent helped me out from Spybot.....I did have a hard job trying to follow what to do, but I think I've done it now.....jerryctx---I wish you had come on a few days ago m8....Was easy to follow in the way you put it down....THANKS...I'm crap at Editing things in Notepad n Wordpad cause my Brain stops working, can't comprehend......What I had to do was find----auto.search.msn.com (could not find it) & hosts (found that)then i had to put Quotes around "auto.search.msn.com" and save it....
Not sure if I did it Correctly, but my Pages in IE are now loading up without me clicking Refresh every other page.....
Not sure if anyone else is haveing this prob though.....Not sure if its trojaned or if MSN has done a change to it......
MSNmessenger resides in Taskbar on right whenever i or you use it.....Now I could click on it and sellect EXIT, n Orf it would go....BUT it refuses to Exit now...A window pops up n says either MSN or IE or OE is working in background and can't exit.....Is this happening to any of You out there...Catch Ya Later Folks....Dennis

[markp62]

That is normal behavior for MSN messenger. If you had it running at the same time IE was at the MSN hompage and/or Hotmail or OE open it won't let you exit. A workaround is to close all IE windows and OE, then exit it. It doesn't matter if you just exit the MSN homepage and/or Hotmail, the lock is on.
If you stop it from loading at startup, it sometimes will be started for you.
Two real solutions:
Uninstall MSN messenger.

Or edit the Registry at these keys, if you feel comfortable doing this.

To remove integration from OE, go to this key,

Hkey_Local_Machine\Software\Microsoft\Outlook Express

and create or modify the value below

'Hide Messenger' = 2 [DWORD, looks like 0x00000002 and is in the right pane of Regedit]


To keep it from autostarting:
Hkey_Local_Machine\Software\Policies\Microsoft\Messenger\Client

'PreventAutoRun' = 1 [DWORD, looks like 0x00000001 and is in the right pane of Regedit]
To prevent running at all:
'PreventRun' = 1 [DWORD, looks like 0x00000001 and is in the right pane of Regedit]

A possible third solution I have read about is to rename the folder MSN messenger is located.