CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 937
Comments: 25
block bottom
spacer spacer

IP 88.212.221.13

 
Post new topic   Reply to topic       All -> FavForums -> General Site [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Guest

Guest
IP: 68.45.*.*






PostPosted: Tue Jul 03, 2007 4:24 pm    Post subject: IP 88.212.221.13
Reply with quote

I constantly receive messages that connection requests have been blocked from the IP address 88.212.221.13 . I did a whois search, but I do not understand any part of the report. It is very annoying because the message constantly shows up. HELP PLEASE!!

Back to top
PCBruiser

SRT Team Lead
SRT Team Lead
Forums Admin

Joined: May 11, 2005
Posts: 11723

1st Responder Mentors 1st Responders Forums Admin MIRT Moderators Premium Rootkit Experts Security Experts SRT Team CC Committee

PostPosted: Tue Jul 03, 2007 4:34 pm    Post subject:
Reply with quote

88.212.221.13
Host unreachable

88.212.221.0 - 88.212.221.15

7Web network
Russian Federation

WWH NOC
7Web Ltd.
Sergija Radonezhskogo str., 1, build 5
105120 Moscow
Russian Federation
phone: +7 495 7678966
fax: +7 495 5853977

Abuse:
| * Please send abuse reports to abuse@7web.ru * |

WWH NOC
7Web Ltd.
Sergija Radonezhskogo str., 1, build 5
105120 Moscow
Russian Federation
phone: +7 495 7678966
fax: +7 495 5853977

SEMWEB-NET
Source: whois.ripe.net

What this means is that something on your system is requesting a connection with an IP in Russia. If you are located in Russia, this could be your DNS server, although the fact the IP doesn't respond to pings suggests otherwise. The small IP range also suggests that this is not an ISP.

Now, depending on where you are located, that may be either OK, or indicate malware on your system. If you are not located in Russia, or they are not your ISP, then malware is something you should consider as a real possibility.

Assuming you are not located in Russia, I strongly recommend that you follow CastleCops' Malware Removal and Prevention procedure, a system CastleCops devised to enable users to either partially, or fully clean their systems without the direct aid of an expert.

Please read these instructions carefully. You will find the Malware Removal and Prevention Procedure here:

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

If that doesn't fix the problem, then go to this Forum, read the instructions at the top of the page carefully:

CastleCops Link/f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html

Follow these instructions:

CastleCops Link/t102301-Hijackthis_Guidelines_Read_Before_Posting.html

and one of CC's trained 1st Responders or Security Experts will help you.

Note: You must be a CastleCops member to post for help in the HJT forum.


_________________
Don't read? Can't learn!
Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16506

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Wed Jul 04, 2007 3:38 am    Post subject:
Reply with quote

Sam Spade wrote:
07/03/07 23:32:51 IP block 68.45.0.0
Trying 68.45.0.0 at ARIN
Trying 68.45.0 at ARIN
Comcast Cable Communications, Inc. JUMPSTART-1 (NET-68-32-0-0-1)
68.32.0.0 - 68.63.255.255
Comcast Cable Communications, Inc. NJ-SOUTH-2 (NET-68-44-0-0-1)
68.44.0.0 - 68.45.255.255

I.e. you must have malware. Please follow the advice of PCBruiser beginning with http://wiki.castlecops.com/MRP. The procedure will lead you from there, including whether and how to post any HJT logs.

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> General Site All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer