Results 1 to 5 of 5

Thread: google trojan

  1. #1
    Chame1eon's Avatar Super Freak
    Join Date
    Nov 2003
    Posts
    283
    Maybe a year ago in the ebaums world forums I saw a post about someone who was taken to adult freind finder every few times he went to ebaums world via the google link. I googled ebaums world and maybe every 5th time i clicked the link i was taken to someipaddress/aff which took me to something resembling the adult freind finder adds you see on some web pages.
    When i went back to the forum his post was deleted. So i made one and that was deleted. I kind of forgot about it untill recently while looking for more information about this fine product.
    Maybe every 5th time I click on the link I'm taken to http://85.255.117.**,
    frequently, but not always http://85.255.117.36/riff_last.bin where nod32 blocks a download of a variant of Win32/TrojanDownloader.Ani.Gen trojan.
    Sometime times there is a different form of malware.
    That ip adress is on a list of false dns servers.
    this is the adress maxthon saved when i closed the browser:
    http://85.255.117.36/ind.htm?src=28&...rt=80&suri=%2F
    If I type Ebaumsworld.com into the address bar I am always taken to one of thier address eg 8.7.232.0.
    When I first discovered this i scanned with nod32 adaware symantec security check , houscall, spybot and hijack this.
    My pc has no symptoms of a malware infection.
    This has apperently been going on for a while.
    I don't understand why I am taken to a completely different ip address from google than I am if I jsut type the adress.
    Any ideas?
    I only licked you for the salt

  2. Internet, Programming and Graphics   -   #2
    slim150's Avatar Poster
    Join Date
    Aug 2003
    Age
    40
    Posts
    449
    Is there anything suspicious in your hosts file? The location of this file is: C:\WINDOWS\system32\drivers\etc and open it in notepad.

    If you aren't sure you can paste the contents here.


    Also you can download a the program hijackthis and run it
    http://www.download.com/Trend-Micro-...ml?tag=lst-0-8

    That should create a logfile you can paste that here too.
    Also you theres a website that can analyze that logfile for you here:
    http://www.hijackthis.de/
    Just paste the log into that site.
    "Their most trivial action may mean volumes, or their most extraordinary conduct may depend upon a hairpin or a pair of curling-tongs" - Holmes


  3. Internet, Programming and Graphics   -   #3
    Chame1eon's Avatar Super Freak
    Join Date
    Nov 2003
    Posts
    283
    There is nothing in my hosts file, and I tried hijack this. I don't think there is anything on my pc, which just makes this weirder.
    I only licked you for the salt

  4. Internet, Programming and Graphics   -   #4
    Poster BT Rep: +1
    Join Date
    Apr 2007
    Posts
    65
    What about trying a free scan from Spyware Doctor?

  5. Internet, Programming and Graphics   -   #5
    Chame1eon's Avatar Super Freak
    Join Date
    Nov 2003
    Posts
    283
    Do i have to install it?
    I only licked you for the salt

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •