houseisland
January 6th, 2006, 03:20 PM
I am fairly careful with my system. I have anti-virus software and keep it up-to-date. I scan regularly with a variety of anti-spyware programs.
But but but ...... I began to suspect that something was not right with my machine -- weird little things, mild instability. For example, DNS Stuff accused me of having some prefetching software installed and wouldn't let me into the site unless I clicked the reload button several time. There was no prefetching software. The list of weird little things is way too long.......
Nothing showed up in any scans, so I downloaded Linksys's log viewer so that I could watch activity on my router.
I began to notice a pattern. Everytime IE or Firefox was started up there would be a connection to an IP address in the 209.249.114.14 to 209.249.114.150 range. Sometimes they would be resolved to names, these including images.amazon.com, pages.ebay.ca, www.ebay.ca, etc. All of theses addresses ultimately resolve to Akamai.com. There were also entries for this IP range in the router logs at night when my computer was not being used, these happening every few hours or so. Whatever the source, it was something that ZoneAlarm was allowing out.
Anyway ... after trying a variety of things to track down the source of this traffic, including port monitoring with ActivePorts (not successful), I went to good old Trend Micro's House Call. And it picked off an instance of unvise32.exe, which it labled Trak_SE.77236.
The unusual port traffic is now gone, for the moment anyway.
Looking through the registry for remnants of this infection, I find traces in the uninstall settings in the following keys:
1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Active Ports
2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Hollywood FX 4.6
3. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Pinnacle Hollywood FX Pack - ATI FX
This is not a smoking gun, however. Unvise32.exe is MindVision's uninstaller. It is possible that it was coopted by some unknown third party. But it does seem to me that "the weird little things" started after I installed ATI's OEM Pinnacle software -- not conclusive though. ActivePorts was not installed until after the problem started, so I think SmartLine is off the hook here.
Anyway, there was infrequent traffic to one more IP address: 207.172.128.222. I can find out little about this address except that it is in Baltimore, that it is residential dynamic or dynamic/static, that it belongs to the RCN Corporation, and that they have got themselves on SORBS' and NJABL's bad boy lists.
Oh the shame...... :eek:
But but but ...... I began to suspect that something was not right with my machine -- weird little things, mild instability. For example, DNS Stuff accused me of having some prefetching software installed and wouldn't let me into the site unless I clicked the reload button several time. There was no prefetching software. The list of weird little things is way too long.......
Nothing showed up in any scans, so I downloaded Linksys's log viewer so that I could watch activity on my router.
I began to notice a pattern. Everytime IE or Firefox was started up there would be a connection to an IP address in the 209.249.114.14 to 209.249.114.150 range. Sometimes they would be resolved to names, these including images.amazon.com, pages.ebay.ca, www.ebay.ca, etc. All of theses addresses ultimately resolve to Akamai.com. There were also entries for this IP range in the router logs at night when my computer was not being used, these happening every few hours or so. Whatever the source, it was something that ZoneAlarm was allowing out.
Anyway ... after trying a variety of things to track down the source of this traffic, including port monitoring with ActivePorts (not successful), I went to good old Trend Micro's House Call. And it picked off an instance of unvise32.exe, which it labled Trak_SE.77236.
The unusual port traffic is now gone, for the moment anyway.
Looking through the registry for remnants of this infection, I find traces in the uninstall settings in the following keys:
1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Active Ports
2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Hollywood FX 4.6
3. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Pinnacle Hollywood FX Pack - ATI FX
This is not a smoking gun, however. Unvise32.exe is MindVision's uninstaller. It is possible that it was coopted by some unknown third party. But it does seem to me that "the weird little things" started after I installed ATI's OEM Pinnacle software -- not conclusive though. ActivePorts was not installed until after the problem started, so I think SmartLine is off the hook here.
Anyway, there was infrequent traffic to one more IP address: 207.172.128.222. I can find out little about this address except that it is in Baltimore, that it is residential dynamic or dynamic/static, that it belongs to the RCN Corporation, and that they have got themselves on SORBS' and NJABL's bad boy lists.
Oh the shame...... :eek: