Hijack this help

tranmererovers

Unless RIPE really IS your ISP get rid of that entry. RIPE is a well known haven for spyware and malware in general.

Thanks PChelpman. my ISP is Tiscali Broadband and according to the RIPE website http://www.ripe.net/membership/indices/GB.html Tiscali appear to be a member of this site and use their services. So can I leave this entry. I don't wan't to remove something with Hijack This and then find things don't work. Any advice appreciated. Thanks

pchelpman

If your ISP is indeed connected to RIPE then all should be OK. Just bear in mind (a) what I said about the RIPE network and (b) Tiscali don't have best reputation as an ISP anyway.

Just watch out and make sure you are fully kitted out with all the protection you can get!

If you are ever in any doubt about anything ... ask. We're always glad to help if we can.

Wig

Doesn't sound right to me about RIPE Coordination centre.

Go to shields up and find out what your IP address is and compare with the new HJT IP address. Also if your IP adress is changing every time you go online and it changes in HJT too there is no problem in posting those IP addresses here for us to see.

Another way to see your IP address is to download and use TCPview from sysinternals.com, when run yours is the one on the left under local address. When disconnected from the internet TCPview is a good way to see if anyspyware is on your machine talking whilst you don't know about it.

Oh and don't delete that entry until you're really sure it is not meant to be there and you know what it is.

electron_3

Very handy for finding your own IP

http://www.cmyip.com/

MercilessKiller

tranmererovers wrote:

Thanks ELectron, Browntoa and Lob Rockster for your advice. I have checked out the IP addresses (which incidentally have changed since last night) and they all belong to RIPE Network Coordination Centre - have looked in Wikipedia and this seems legit to me (hope you agree) So I am planning to leave well alone.

With regard to XP Antispy, I've googled it and there are lots of entries, any site you would recommend to download.

Also any advice on a firewall??

Thanks in anticipation

Its possible that information is being redirected... so for example when you access a certain ip address, it auto redirects you through a lop.com server thus inflicting you with spyware.. kind of wat a hijacker does!

If you have 2 different ip addresses in that entry, and they change every day, i'd be VERY VERY suspicious

tranmererovers

OK thanks all who have responded - here is todays entry:

O17 - HKLM\System\CCS\Services\Tcpip\..\{DE26AF7F-13AB-4B91-A230-021EC2845B25}: NameServer = 212.74.114.129 212.74.112.66

These are previous entries

O17 - HKLM\System\CCS\Services\Tcpip\..\{DE26AF7F-13AB-4B91-A230-021EC2845B25}: NameServer = 212.74.114.129 212.74.112.66

O17 - HKLM\System\CCS\Services\Tcpip\..\{DE26AF7F-13AB-4B91-A230-021EC2845B25}: NameServer = 80.225.252.58 80.225.252.50


So at least one previous entry is the same as todays! Is that good???

Todays entry does not match my IP address.

Any further suggestions

Ok having logged off broadband and back on, the entry in hijack this is now

O17 - HKLM\System\CCS\Services\Tcpip\..\{DE26AF7F-13AB-4B91-A230-021EC2845B25}: NameServer = 80.225.252.58 80.225.252.50

and my IP address has changed.

Another way to see your IP address is to download and use TCPview from sysinternals.com, when run yours is the one on the left under local address. When disconnected from the internet TCPview is a good way to see if anyspyware is on your machine talking whilst you don't know about it.

Tried this wig but couldn't see my address on here or any other for that matter - online or offline


OK - another update - just tried Mr TranmereRovers computer and he does not have this entry in HJT when online or offline (He has a PC running Windows ME and I have one of the infamous Inspiron 1300 laptops running XP) We don't currently have a router (next challenge) so when OH wants to connect we just disconnect my usb cable and plug it into his.

Getting very suspicious now as it does not appear on his PC......

tranmererovers

Any further thoughts on deleting this entry please

Dack

It's a standard entry for the nameservers you use when connected to the internet.

Tiscali use several cache's and you've connected to different ones when you've logged on:
80.225.252.58 = [ lond-cache-2.ns.uk.tiscali.com ]
212.74.112.66 = [ mk-cache-1.ns.uk.tiscali.com ]

Info found from https://www.samspade.org

At a rough guess you live somewhere between Milton Keynes and London.

You get two values because you always have a primary and secondary DNS (Dynamic Name Server) - and probably have DNS configuration set to "Server assigned nameserver addresses" - the usual.

You cannot delete the entry because it will be recreated the next time you connect (possibly with a different value). It's your nameservers i.e. when you type "www.ripe.net" it lookusup the ip address of that text (193.0.0.214)

As to the ripe.net being a haven for spyware - I'm sure the people who allocate IP addresses for europe i.e. RIPE, would be happy to know that

tranmererovers

Thanks Dack,

At a rough guess you live somewhere between Milton Keynes and London.

Bit further North (about 200 miles or so )

OK - another update - just tried Mr TranmereRovers computer and he does not have this entry in HJT when online or offline

Why does OH pc not have this entry then?

Dack

He's running ME - different OS so different settings for the TCP stack.