Guest Yavuz YILMAZ Posted March 31, 2009 Posted March 31, 2009 Hi when I turn on computer, system try to connect 79.140.80.82 ip. I checked and this ip about RIPE Network Coordination Centre. How can block this. And which process try to connect this ip address thanks Quote
Guest PA Bear [MS MVP] Posted March 31, 2009 Posted March 31, 2009 Please state your full Windows version (e.g., WinXP SP3; Vista SP1) when posting to this newsgroup. There is a very good chance are that you are seeing the affects of a hijackware infection. 1. See if you can download/run the MSRT manually: http://www.microsoft.com/security/malwareremove/default.mspx NB: Rename MRT.EXE to, e.g., SCANNER.EXE before running the tool! 2. Run the Windows Live Safety Center's 'Protection' scan (only!) in Safe Mode with Networking, if need be: http://onecare.live.com/site/en-us/center/howsafe.htm 3. Run a /thorough/ check for hijackware, including posting the requested logs in an appropriate forum, not here. Checking for/Help with Hijackware http://aumha.net/viewtopic.php?f=30&t=4075 http://mvps.org/winhelp2002/unwanted.htm http://inetexplorer.mvps.org/data/prevention.htm http://inetexplorer.mvps.org/tshoot.html http://www.mvps.org/sramesh2k/Malware_Defence.htm http://www.elephantboycomputers.com/page2....emoving_Malware Seek expert assistance in http://spywarehammer.com/simplemachinesfor....php?board=10.0, http://forums.spybot.info/forumdisplay.php?f=22, http://aumha.net/viewforum.php?f=30, or other appropriate forums. If the procedures look too complex - and there is no shame in admitting this isn't your cup of tea - take the machine to a local, reputable and independent (i.e., not BigBoxStoreUSA) computer repair shop. -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ Yavuz YILMAZ wrote:<span style="color:blue"> > when I turn on computer, system try to connect 79.140.80.82 ip. I checked > and this ip about RIPE Network Coordination Centre. How can block this. > And > which process try to connect this ip address </span> Quote
Guest Yavuz YILMAZ Posted April 1, 2009 Posted April 1, 2009 Hi Thanks for response. my system is windows xp service pack 2 and I have mps report and process monitor and I can see nothing these logs. My system is ATM machine It hasn't got a internet connection. But I said , when I turn on computer (I am looking with IP accouting tool) windows try to connect 79.140.80.82 ip address. How can I check which process try to this connection. Thanks "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message news:%233yTwchsJHA.4452@TK2MSFTNGP04.phx.gbl...<span style="color:blue"> > Please state your full Windows version (e.g., WinXP SP3; Vista SP1) when > posting to this newsgroup. > > There is a very good chance are that you are seeing the affects of a > hijackware infection. > > 1. See if you can download/run the MSRT manually: > http://www.microsoft.com/security/malwareremove/default.mspx > > NB: Rename MRT.EXE to, e.g., SCANNER.EXE before running the tool! > > 2. Run the Windows Live Safety Center's 'Protection' scan (only!) in Safe > Mode with Networking, if need be: > http://onecare.live.com/site/en-us/center/howsafe.htm > > 3. Run a /thorough/ check for hijackware, including posting the requested > logs in an appropriate forum, not here. > > Checking for/Help with Hijackware > http://aumha.net/viewtopic.php?f=30&t=4075 > http://mvps.org/winhelp2002/unwanted.htm > http://inetexplorer.mvps.org/data/prevention.htm > http://inetexplorer.mvps.org/tshoot.html > http://www.mvps.org/sramesh2k/Malware_Defence.htm > http://www.elephantboycomputers.com/page2....emoving_Malware > > Seek expert assistance in > http://spywarehammer.com/simplemachinesfor....php?board=10.0, > http://forums.spybot.info/forumdisplay.php?f=22, > http://aumha.net/viewforum.php?f=30, or other appropriate forums. > > If the procedures look too complex - and there is no shame in admitting > this > isn't your cup of tea - take the machine to a local, reputable and > independent (i.e., not BigBoxStoreUSA) computer repair shop. > -- > ~Robear Dyer (PA Bear) > MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 > AumHa VSOP & Admin http://aumha.net > DTS-L http://dts-l.net/ > > Yavuz YILMAZ wrote:<span style="color:green"> >> when I turn on computer, system try to connect 79.140.80.82 ip. I checked >> and this ip about RIPE Network Coordination Centre. How can block this. >> And >> which process try to connect this ip address</span> > </span> Quote
Guest Newell White Posted April 1, 2009 Posted April 1, 2009 "Yavuz YILMAZ" wrote: <span style="color:blue"> > Hi > > Thanks for response. my system is windows xp service pack 2 and I have mps > report and process monitor and I can see nothing these logs. My system is > ATM machine It hasn't got a internet connection. But I said , when I turn on > computer (I am looking with IP accouting tool) windows try to connect > 79.140.80.82 ip address. How can I check which process try to this > connection. > > Thanks > > > "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message > news:%233yTwchsJHA.4452@TK2MSFTNGP04.phx.gbl...<span style="color:green"> > > Please state your full Windows version (e.g., WinXP SP3; Vista SP1) when > > posting to this newsgroup. > > > > There is a very good chance are that you are seeing the affects of a > > hijackware infection. > > > > 1. See if you can download/run the MSRT manually: > > http://www.microsoft.com/security/malwareremove/default.mspx > > > > NB: Rename MRT.EXE to, e.g., SCANNER.EXE before running the tool! > > > > 2. Run the Windows Live Safety Center's 'Protection' scan (only!) in Safe > > Mode with Networking, if need be: > > http://onecare.live.com/site/en-us/center/howsafe.htm > > > > 3. Run a /thorough/ check for hijackware, including posting the requested > > logs in an appropriate forum, not here. > > > > Checking for/Help with Hijackware > > http://aumha.net/viewtopic.php?f=30&t=4075 > > http://mvps.org/winhelp2002/unwanted.htm > > http://inetexplorer.mvps.org/data/prevention.htm > > http://inetexplorer.mvps.org/tshoot.html > > http://www.mvps.org/sramesh2k/Malware_Defence.htm > > http://www.elephantboycomputers.com/page2....emoving_Malware > > > > Seek expert assistance in > > http://spywarehammer.com/simplemachinesfor....php?board=10.0, > > http://forums.spybot.info/forumdisplay.php?f=22, > > http://aumha.net/viewforum.php?f=30, or other appropriate forums. > > > > If the procedures look too complex - and there is no shame in admitting > > this > > isn't your cup of tea - take the machine to a local, reputable and > > independent (i.e., not BigBoxStoreUSA) computer repair shop. > > -- > > ~Robear Dyer (PA Bear) > > MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 > > AumHa VSOP & Admin http://aumha.net > > DTS-L http://dts-l.net/ > > > > Yavuz YILMAZ wrote:<span style="color:darkred"> > >> when I turn on computer, system try to connect 79.140.80.82 ip. I checked > >> and this ip about RIPE Network Coordination Centre. How can block this. > >> And > >> which process try to connect this ip address</span> > > </span> > </span> I don't think you have malware - check RIPE out: http://www.ripe.net/info/ncc/ In particular they run the K-root name server for DNS resolution. Even though your computer is not currently connected to the internet, what do you know of its' history? Are you the first and only owner? Do you have security (or other) software installed which is looking for updates? -- Regards, Newell White Quote
Guest PA Bear [MS MVP] Posted April 1, 2009 Posted April 1, 2009 I should think that microsoft.public.windows.embedded and/or microsoft.public.windows.embedded.pointofservice would be more appropriate newsgroups for your questions. Yavuz YILMAZ wrote:<span style="color:blue"> > Thanks for response. my system is windows xp service pack 2 and I have mps > report and process monitor and I can see nothing these logs. My system is > ATM machine It hasn't got a internet connection. But I said , when I turn > on > computer (I am looking with IP accouting tool) windows try to connect > 79.140.80.82 ip address. How can I check which process try to this > connection. > > Thanks > > > "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message > news:%233yTwchsJHA.4452@TK2MSFTNGP04.phx.gbl...<span style="color:green"> >> Please state your full Windows version (e.g., WinXP SP3; Vista SP1) when >> posting to this newsgroup. >> >> There is a very good chance are that you are seeing the affects of a >> hijackware infection. >> >> 1. See if you can download/run the MSRT manually: >> http://www.microsoft.com/security/malwareremove/default.mspx >> >> NB: Rename MRT.EXE to, e.g., SCANNER.EXE before running the tool! >> >> 2. Run the Windows Live Safety Center's 'Protection' scan (only!) in Safe >> Mode with Networking, if need be: >> http://onecare.live.com/site/en-us/center/howsafe.htm >> >> 3. Run a /thorough/ check for hijackware, including posting the requested >> logs in an appropriate forum, not here. >> >> Checking for/Help with Hijackware >> http://aumha.net/viewtopic.php?f=30&t=4075 >> http://mvps.org/winhelp2002/unwanted.htm >> http://inetexplorer.mvps.org/data/prevention.htm >> http://inetexplorer.mvps.org/tshoot.html >> http://www.mvps.org/sramesh2k/Malware_Defence.htm >> http://www.elephantboycomputers.com/page2....emoving_Malware >> >> Seek expert assistance in >> http://spywarehammer.com/simplemachinesfor....php?board=10.0, >> http://forums.spybot.info/forumdisplay.php?f=22, >> http://aumha.net/viewforum.php?f=30, or other appropriate forums. >> >> If the procedures look too complex - and there is no shame in admitting >> this >> isn't your cup of tea - take the machine to a local, reputable and >> independent (i.e., not BigBoxStoreUSA) computer repair shop. >> -- >> ~Robear Dyer (PA Bear) >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >> AumHa VSOP & Admin http://aumha.net >> DTS-L http://dts-l.net/ >> >> Yavuz YILMAZ wrote:<span style="color:darkred"> >>> when I turn on computer, system try to connect 79.140.80.82 ip. I >>> checked >>> and this ip about RIPE Network Coordination Centre. How can block this. >>> And >>> which process try to connect this ip address </span></span></span> Quote
Guest Yavuz YILMAZ Posted April 3, 2009 Posted April 3, 2009 I resolved this problem. When system turn on try to connect auto.search.msn.com. you can delete this entry from regstry. HKEY_CURRENT_USER\Software\Microsoft\Internet Connection Wizard\shellnext thanks "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message news:Ows5TdwsJHA.1212@TK2MSFTNGP04.phx.gbl...<span style="color:blue"> >I should think that microsoft.public.windows.embedded and/or >microsoft.public.windows.embedded.pointofservice would be more appropriate >newsgroups for your questions. > > Yavuz YILMAZ wrote:<span style="color:green"> >> Thanks for response. my system is windows xp service pack 2 and I have >> mps >> report and process monitor and I can see nothing these logs. My system is >> ATM machine It hasn't got a internet connection. But I said , when I turn >> on >> computer (I am looking with IP accouting tool) windows try to connect >> 79.140.80.82 ip address. How can I check which process try to this >> connection. >> >> Thanks >> >> >> "PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message >> news:%233yTwchsJHA.4452@TK2MSFTNGP04.phx.gbl...<span style="color:darkred"> >>> Please state your full Windows version (e.g., WinXP SP3; Vista SP1) when >>> posting to this newsgroup. >>> >>> There is a very good chance are that you are seeing the affects of a >>> hijackware infection. >>> >>> 1. See if you can download/run the MSRT manually: >>> http://www.microsoft.com/security/malwareremove/default.mspx >>> >>> NB: Rename MRT.EXE to, e.g., SCANNER.EXE before running the tool! >>> >>> 2. Run the Windows Live Safety Center's 'Protection' scan (only!) in >>> Safe >>> Mode with Networking, if need be: >>> http://onecare.live.com/site/en-us/center/howsafe.htm >>> >>> 3. Run a /thorough/ check for hijackware, including posting the >>> requested >>> logs in an appropriate forum, not here. >>> >>> Checking for/Help with Hijackware >>> http://aumha.net/viewtopic.php?f=30&t=4075 >>> http://mvps.org/winhelp2002/unwanted.htm >>> http://inetexplorer.mvps.org/data/prevention.htm >>> http://inetexplorer.mvps.org/tshoot.html >>> http://www.mvps.org/sramesh2k/Malware_Defence.htm >>> http://www.elephantboycomputers.com/page2....emoving_Malware >>> >>> Seek expert assistance in >>> http://spywarehammer.com/simplemachinesfor....php?board=10.0, >>> http://forums.spybot.info/forumdisplay.php?f=22, >>> http://aumha.net/viewforum.php?f=30, or other appropriate forums. >>> >>> If the procedures look too complex - and there is no shame in admitting >>> this >>> isn't your cup of tea - take the machine to a local, reputable and >>> independent (i.e., not BigBoxStoreUSA) computer repair shop. >>> -- >>> ~Robear Dyer (PA Bear) >>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 >>> AumHa VSOP & Admin http://aumha.net >>> DTS-L http://dts-l.net/ >>> >>> Yavuz YILMAZ wrote: >>>> when I turn on computer, system try to connect 79.140.80.82 ip. I >>>> checked >>>> and this ip about RIPE Network Coordination Centre. How can block >>>> this. >>>> And >>>> which process try to connect this ip address</span></span> > </span> Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.