IE keeps trying to access unknown IP address... 1

[SQLBI]

HELP... every time i try to browse the net, or do anything in IE, i get a login box to a server at 213.146.149.149...

God only knows what this is for and i can't get rid of it!

To my knowledge this has started doing this today but why i don't know. Spyware and Virus scans pick up nothing.

Anyone got any tips as i'm completely scuppered on this one.

Thanks in advance.



Cheers,
Leigh

"Give a man a fish and he can feed himself for a day..."
Give him the means to catch his own fish and he can really annoy his girlfriend by spending all his spare time fishing!

Join the PAC -

http://www.pacgb.co.uk/

 

[SQLBI]

Not sure if its related but in event viewer, the only thing i can find which i've not seen before is

"Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted.
Enrollment will not be performed."

And

"Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted."

But these errors don't reoccur when the login prompt appears...


Cheers,
Leigh

"Give a man a fish and he can feed himself for a day..."
Give him the means to catch his own fish and he can really annoy his girlfriend by spending all his spare time fishing!

Join the PAC -

http://www.pacgb.co.uk/

 

[sostek]

The following sites are useful for doing IP to registered owners lookups.

http://www.arin.net

- for all North/South American IP addresses

http://www.apnic.net

- for all Pacific Rim and Asian IP addresses

http://www.ripe.net

- for all European IP addresses

Be aware that each will tell you what site holds the particular record. They just won't forward you there.

For example, I used Arin's site to lookup that IP and it said it was on RIPE. So going to RIPE and using their WhoIs tool netted me the following:

inetnum: 213.146.148.0 - 213.146.151.255
netname: NET-UK-LN1-HOST1
descr: InTechnology Hosting allocation
country: GB
admin-c: SC5875-RIPE
tech-c: SC5875-RIPE
status: ASSIGNED PA "status:" definitions
mnt-by: VDATA-MNT
source: RIPE # Filtered

person: Stuart Cheshire
address: Intechnology Plc
address: Central House
address: Beckwith Knowle
address: Harrogate, HG3 1UG
address: GB
phone: +44 (0)845 1207070
e-mail: stuart.cheshire@intechnology.co.uk
nic-hdl: SC5875-RIPE
remarks: ########################################################
remarks: Abuse reports to abuse@intechnology.co.uk
remarks: No action is taken on abuse reports sent to RIPE admins.
remarks: Many Thanks
remarks: ########################################################
source: RIPE # Filtered

% Information related to 'SC5875-RIPE'

route: 213.146.128.0/19
descr: Intechnology Plc
origin: AS13009
mnt-by: VDATA-MNT
source: RIPE # Filtered

The rest is up to you. First, block that IP address at a firewall, be it software or hardware.

Next, update IE and patch. Make sure no proxying is being turned on, etc.

 

[SQLBI]

I'm not sure what was happeing but after i rebooted my system, i still received the prompt, until i restatrted MS outlook. Then all of a suddenit stopped.

Thanks for your help anyway, the urls will certainly come in hande in the future.


Cheers,
Leigh

"Give a man a fish and he can feed himself for a day..."
Give him the means to catch his own fish and he can really annoy his girlfriend by spending all his spare time fishing!

Join the PAC -

http://www.pacgb.co.uk/