Websites redirected by www.jupk.com

[wmg100]

When I type in most web addresses I am redirected to some porn site or other which is different each time. However at the bottom left it always shows www.jupk.com for a while before opening the site. The address in the address bar stays as the one you were trying to access.

I was hoping someone might be able to help me. I have run spyware doctor, ad-aware, avast and spybot search and destroy. None of them can find anything. I use firefox with zone alarms firewall, so I don't know how this happened in the first place.

Any help and suggestions will be gratefully recieved.

[JamieBeeston]

Have a read here.

www.daniweb.com/techtalkforums/post278557.html

Seems like it might be your Router they've compromised and played around with it's DNS server settings.

Enjoy.

J

[wmg100]

Sounds like this is going to be fun

What is a DNS server? do I need to contact my ISP? If that is the case then i'm truly buggared as I'm with tiscali and from past experience the indian lady on the end of the phone wont have the foggiest what I'm talking about.

[JamieBeeston]

DNS just translates www.website.com into 10.0.0.2 (an IP address) which is how the internet works.

From the sounds of that article, you maybe have a weak / default password on your ADSL router and they have simply replaced your DNS server.

Easy way to check

Start
run
cmd

ipconfig /all

and paste your results here.

J

[oggs]

JB to the rescue

[wmg100]

Thanks for your help, this is what it says:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:Documents and SettingsWilliam Gaskell>ipconfig/all

Windows IP Configuration

Host Name . . . . . . . . . . . . : william-bw8j14q
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : SiS 900-Based PCI Fast Ethernet Adap
ter
Physical Address. . . . . . . . . : 00-0B-6A-4F-74-9F

PPP adapter Tiscali Broadband:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
Physical Address. . . . . . . . . : 00-53-45-00-00-00
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 88.106.169.245
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 88.106.169.245

[JamieBeeston]

hehe there should be a line, just after the very bottom which maybe you've missed off

Default Gateway . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
192.168.0.2

something like that

it's only really the DNS Servers line i'm interested in

J

[wmg100]

I'm afraid that's all there is. I just did select all, copy, paste. I've had a scan through and it hasn't missed anything.

[simpo two]

This is what I have too! On its way to gathi.com etc I see 'jupk' appear briefly, and then a search engine page (this time it's babochki.net)

At the same time, I can no longer connect to my e-mail account. I use Mailwasher Pro and for a few seconds, instead of connecting to where it normally connects, I see it's trying to go to 64-28-178-8-rev.cemel.net

Checking my e-mail account options, all seems normal.

Hope this helps someone come up with a solution!

NB: I did the DNS test and can't copy/paste the results - was going to post an image but I can't use FTP either...

So we have:
Physical address 00-53-45-00-00-00
Dhcp enabled No
IP Address 213.162.106.145
Subnet mask 255.255.255.255
Default gateway 213.162.106.145
DNS Servers 85.255.113.130
85.255.112.79

Edited by simpo two on Thursday 30th November 14:20

[Plotloss]

c:\windows\system32\drivers\etc\hosts

Whats in there?

(drag it into notepad and copy and paste the contents in a new post)

[simpo two]

Plotloss said:

c:windowssystem32driversetchosts

Whats in there?

Not meaning to hijack this thread (doh, no pun intended!) but as we seem to have the same problem, here's mine:

hosts said:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

# Start of entries inserted by Spybot - Search & Destroy
# End of entries inserted by Spybot - Search & Destroy

[wmg100]

Plotloss said:

c:windowssystem32driversetchosts

Whats in there?

(drag it into notepad and copy and paste the contents in a new post)

localhost 127.0.0.1

[simpo two]

postmaster is hijacked too, so I can't even check mail there. Thank god PH still works!

Curiously, I get a timeout if I try www.123reg.co.uk, which happens to be my host... any connection?

[wmg100]

simpo two said:

Not meaning to hijack this thread (doh, no pun intended!) but as we seem to have the same problem, here's mine:

No worries, just hope we can manage to get it sorted. I hadn't checked before you posted but I can't access my email either.

[wmg100]

Don't know if it's any help but the email error message is as follows:

The server responded with an error. Account: 'Bill Gaskell', Server: 'pop.tiscali.co.uk', Protocol: POP3, Server Response: '-ERR Cannot connect to POP server 69.50.176.202 (69.50.176.202:110), connect error 10061', Port: 110, Secure(SSL): No, Server Error: 0x800CCC90, Error Number: 0x800CCC90

[Plotloss]

Well neither of you have been host hijacked, which is something.

127.0.0.1 is the standard IP loopback entry so no worries there.

[JamieBeeston]

simpo two said:

DNS Servers 85.255.113.130
85.255.112.79

inetnum: 85.255.112.0 - 85.255.127.255
netname: inhoster
descr: Inhoster hosting company
descr: OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine


any reason you'd have a Ukrainian DNS server?

If not, both of you do the following

Start
Settings
Control Panel
Network Connection

Right click on which ever connection you use to get your Internet (Local Area Network, or Wireless Network etc)
Properties
In the middle box, scroll down until you see :Internet Protocol (TCP/IP)
Double Click that.
At the bottom, ensure 'use the following DNS server address' is checked
then delete whatever you have in there at present and use
80.253.108.12
leave the second box blank

hit ok
hit ok

close all of your web browsers / email clients

Start
run
cmd
ipconfig /flushdns

now try again and see what happens.

J

[m12_nathan]

Change your mail passwords too if you've been attempting to connect to a different mail server with your credentials!

[wmg100]

JB you are a star!

It's all working fine again now.

Thanks very much for your help

[simpo two]

wmg100 said:

JB you are a star!

It's all working fine again now.

Thanks very much for your help

Ditto here Please purchase a pint of fine ale and send the bil to me!