------meanwhile, a couple hours later-----------

Sony's thread about PCAudi and War's explanation were a wake up call for me. In going thru the paces, I installed x-NetStat 5.1 and found a curious connection from the other pc on my LAN.

Hostname: moscow.eau.wi.charter.com

This didn't show up in Sygate (latest version, set to DLL Authentification, but showed up in x-NetStat with the IP of the other pc on this LAN.

I ran AdAware, Trojan Remove, Kaspersky AV 5 and nothing showed up. Finally I did a search of the registry with Registry Crawler and found moscow.eau, etc. two places in the Registry along with some other moscow things.

At that point I deleted all the cookies in IE6 (there were a lot)and then the registry entries disappeared. I don't know what to make of it.

Anyway, things are tighter here now, thanks to the Sony's thread.

I found the same entry on my pc (see screenshot)

The weird thing is that show my internal IP with that host name!!!

I need to ivestigate this , now you got me worried

If you find more information please let me know it's time to bed here so I will have to do my homework tomorrow morning about moscow.eau.wi.charter.com

Sony

Wow. Really weird. Your screen shot is exactly like mine.

I thougtht it gone after a total cookie and registy clean up, but this evening that same thing logged on. With x-NetSTat I was able to kick it off, but Sygate isn't doing anything.

The saga continues.

:)

Try Ethereal for more info. ;)

BTW:

Oh nice. IIS 5.0. hehe You know what that means. :P

I still don't get why my internal IP is associate with that domain ?

oh wtf yeah i was not even paying attendtion lol

Is that not your host name?

If it is then it just got it by resolving your internet ip address (Reverse DNS) and just told u your lan ip address instead.

If not then some program is messing with your dns server and assigning a host name to your lan ip for whatever reason. Or you isp did or whatever...

war:No. What does it mean? (Is it a microsoft server that is hacked by deafult?)

What is a reasonable explanation to the "moscow" part of the ip? Is that one of the web sites that is hosted by charter.com? I noticed that moscow demands a login to their website.

This thread is too confusing to me. The only conclusion I have done so far is that I should have a separate box for my www adventures. There I should start fresh every session by using a ghosted image of a clean install. Or a deep freezed version. Gonna check theese options. A separate box may be just the right thing, then I can have my computer where I really work clean and nice.
This is getting crazy. Do I want to live in such a world? Of course I do (the option seems boring) but I don't really want to spend half of my time to different security precautions.

Thanks to all that contributed here,

I found the moscow thing on there again a bit ago.

There are quite a few articles around about IIS. I don't understand this problem yet. :(

oh my bad...i was just kidding...i just men IIS is a pos and there are so many security issues....thats all... srry for the confusion...

lol

Um yeah I would say that a charter isp ip address....is that your ISP?

if not yeah something is going on...

Um moscow.eau.wi.charter.com?

Site does not even exist it seems? At least not http.