I think I have a trojan that I cannot find. The address in the subject line
keeps appearing in the exceptions list of my IE6 SP2 popup settings page. I
can correlate it with a group of pop ups that advertise registry cleaners,
shopping, and adult subjects. When I delete the exception the popups go
away but the exception reappears next bootup. Does anyone know anything
about this address, removal, etc?

Thanks,
Ron Gaynor

"Ron Gaynor" <(E-Mail Removed)> wrote in message
news:OqHB%(E-Mail Removed)...
> I think I have a trojan that I cannot find. The address in the subject
line
> keeps appearing in the exceptions list of my IE6 SP2 popup settings page.
I
> can correlate it with a group of pop ups that advertise registry cleaners,
> shopping, and adult subjects. When I delete the exception the popups go
> away but the exception reappears next bootup. Does anyone know anything
> about this address, removal, etc?
>
> Thanks,
> Ron Gaynor

Search results for: ! NET-69-28-255-0-2

CustName: CHL Inc
Address: 60 East Commerce
City: Spring Valley
StateProv: NY
PostalCode: 10977
Country: US
RegDate: 2004-02-04
Updated: 2004-02-04

NetRange: 69.28.255.0 - 69.28.255.15
CIDR: 69.28.255.0/28
NetName: CHL-14-NOC08-NAT
NetHandle: NET-69-28-255-0-2
Parent: NET-69-28-255-0-1
NetType: Reassigned
Comment: CHL NOC NAT POOL
RegDate: 2004-02-04
Updated: 2004-02-04

TechHandle: CHR3-ARIN
TechName: CHL Technical Administration Role
TechPhone: +1-212-564-3500
TechEmail: (E-Mail Removed)

OrgAbuseHandle: CAR21-ARIN
OrgAbuseName: CHL Abuse Role
OrgAbusePhone: +1-307-638-1836
OrgAbuseEmail: (E-Mail Removed)

OrgNOCHandle: CHR3-ARIN
OrgNOCName: CHL Technical Administration Role
OrgNOCPhone: +1-212-564-3500
OrgNOCEmail: (E-Mail Removed)

OrgTechHandle: CHR3-ARIN
OrgTechName: CHL Technical Administration Role
OrgTechPhone: +1-212-564-3500
OrgTechEmail: (E-Mail Removed)

# ARIN WHOIS database, last updated 2005-04-09 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

If contact information is out of date or incorrect, please
contact (E-Mail Removed). Include all relevant information in your e-mail
and ARIN will investigate the matter.

"Putney Swope" <(E-Mail Removed)> wrote in message
newsTb6e.4613$(E-Mail Removed)...
>
> "Ron Gaynor" <(E-Mail Removed)> wrote in message
> news:OqHB%(E-Mail Removed)...
>> I think I have a trojan that I cannot find. The address in the subject
> line
>> keeps appearing in the exceptions list of my IE6 SP2 popup settings page.
> I
>> can correlate it with a group of pop ups that advertise registry
>> cleaners,
>> shopping, and adult subjects. When I delete the exception the popups go
>> away but the exception reappears next bootup. Does anyone know anything
>> about this address, removal, etc?
>>
>> Thanks,
>> Ron Gaynor
>
> Search results for: ! NET-69-28-255-0-2
>
> CustName: CHL Inc
> Address: 60 East Commerce
> City: Spring Valley
> StateProv: NY
> PostalCode: 10977
> Country: US
> RegDate: 2004-02-04
> Updated: 2004-02-04
>
> NetRange: 69.28.255.0 - 69.28.255.15
> CIDR: 69.28.255.0/28
> NetName: CHL-14-NOC08-NAT
> NetHandle: NET-69-28-255-0-2
> Parent: NET-69-28-255-0-1
> NetType: Reassigned
> Comment: CHL NOC NAT POOL
> RegDate: 2004-02-04
> Updated: 2004-02-04
>
> TechHandle: CHR3-ARIN
> TechName: CHL Technical Administration Role
> TechPhone: +1-212-564-3500
> TechEmail: (E-Mail Removed)
>
> OrgAbuseHandle: CAR21-ARIN
> OrgAbuseName: CHL Abuse Role
> OrgAbusePhone: +1-307-638-1836
> OrgAbuseEmail: (E-Mail Removed)
>
> OrgNOCHandle: CHR3-ARIN
> OrgNOCName: CHL Technical Administration Role
> OrgNOCPhone: +1-212-564-3500
> OrgNOCEmail: (E-Mail Removed)
>
> OrgTechHandle: CHR3-ARIN
> OrgTechName: CHL Technical Administration Role
> OrgTechPhone: +1-212-564-3500
> OrgTechEmail: (E-Mail Removed)
>
> # ARIN WHOIS database, last updated 2005-04-09 19:10
> # Enter ? for additional hints on searching ARIN's WHOIS database.
>
> If contact information is out of date or incorrect, please
> contact (E-Mail Removed). Include all relevant information in your
> e-mail
> and ARIN will investigate the matter.
>
>Thanks but how does that affect me. The address bothering me was
>69.28.210.75.

"Ron Gaynor" wrote:
>I think I have a trojan that I cannot find. The address in the subject line
> keeps appearing in the exceptions list of my IE6 SP2 popup settings page. I
> can correlate it with a group of pop ups that advertise registry cleaners,
> shopping, and adult subjects. When I delete the exception the popups go
> away but the exception reappears next bootup. Does anyone know anything
> about this address, removal, etc?

## Help with Hijackware ##
*All* MVP Sites.
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

MS KB Articles;
Unexplained computer behaviour may be caused by deceptive software.
http://support.microsoft.com/default...b;en-us;827315

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security (AH-VSOP)
__________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)

In article <oTb6e.4613$(E-Mail Removed)>, Putney
Swope says...

> "Ron Gaynor" <(E-Mail Removed)> wrote in message
> news:OqHB%(E-Mail Removed)...

> > I think I have a trojan that I cannot find. The address in the subject
> > line keeps appearing in the exceptions list of my IE6 SP2 popup settings
> > page. I can correlate it with a group of pop ups that advertise registry
> > cleaners, shopping, and adult subjects. When I delete the exception the
> > popups go away but the exception reappears next bootup. Does anyone know
> > anything about this address, removal, etc?

> Search results for: ! NET-69-28-255-0-2

I think the OP wanted some help with a hijack, not information about who was
hosting the possible hijacker.

--
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

"N. Miller" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> I think the OP wanted some help with a hijack, not information about who
was
> hosting the possible hijacker.
>
> --
> Norman

Gotta start somewhere.