Ghost Broadband connection on Wan Miniport(PPPoE)

11 Aug 2006 8:13 AM

fmajor7

I would really appreciate if someone can help me with this strange
problem I have developed. I have four PCs at home all using a US
Robotics Router to connect to the Internet. One is Win XP with SP1 me)
and the others are XP with SP2. We all use static IP-addresses and Mac
address security. Recently we had a SYN-attack which paralysed our
Internet connection. I have now included a 64-bit web-key and twigged
the registry to limit SYN conection.
Suddenly I noticed that I have inherited this strange Dial up
Connection called "ENTER" which was using my LAN card. Since I never
use the LAN card, I disabled it and that Dial Up Conncetion called
"ENTER" went away - but only for a short while. It reappeared once
again as "ENTER" but this time it is trying to use teh Broadband
Connection on a WAN Minipoort(PPPoE). I have disabled and firewalled it
but on and off it tries to "connect" using a telephone number "5". When
its trying to connect, the internet connection stops. When I cancel the
connection it retries the connection a few times and finally I can
continue. The biggest problem is that my internet speed has gone dpwn
and I can't "delete" this connection at all. Strangely it has created
two DNS addresses it wants to use - 62.232.158.84 and 64.156.31.63
which do not exist.
What kind of bug/virus/trojan is this ? Anybody seen this ?
Please help !!!

F.Major

11 Aug 2006 9:13 AM

Ian

This address belongs to http://www.aissys.com and is within Pipex UK
IP-range. It seems to be a hosting company, so the culprit might be one of
its clients rather than aissys itself.

My thoughts are that either there is an old ADSL dialler on the computer, or
perhaps you've picked-up a 'porn dialler' of some sort. A bit of googling
suggests that aissys.com provide DNS hosting and are a favorite of porn
webmasters, so that would figure.

Suggest checking with Ad-Aware, Hijack This, etc.

13 Aug 2006 7:34 PM

fmajor7

Hi Ian,

Many thanks for your reply. Yes, I did run HiJack This and also
Ad-Aware but the entry for the connection is still there. I can't seem
to be able to delete it.
The only good news is that its not trying to redial much anymore.
I am still looking around for a permanent cure but as yet haven't found
any new hints.

Cheers.

Major

Ian wrote:
Show quoteHide quote

> This address belongs to http://www.aissys.com and is within Pipex UK
> IP-range. It seems to be a hosting company, so the culprit might be one of
> its clients rather than aissys itself.
>
> My thoughts are that either there is an old ADSL dialler on the computer, or
> perhaps you've picked-up a 'porn dialler' of some sort. A bit of googling
> suggests that aissys.com provide DNS hosting and are a favorite of porn
> webmasters, so that would figure.
>
> Suggest checking with Ad-Aware, Hijack This, etc.