I thought i knew alot, but every now and them i get stumpped and this one has me paranoid.
recently my internet connection has slowed or in some cases stopped, its not my ISP, i'v asked and i think i'm the victim of some sort of snooper or some dormant trogan or virus.
when i open up my browser - Mozilla firefox Ver 1.0- at the bottom of the screen there is a status bar that tells you the pages that open and sometimes the URL that the info is comming form, but lately, every web site that i go to tells me " transfering info from 127.0.0.1" Where is that? and who the hell is that? I know my IP address and DNS is not that and the router that i use is not that IP address or its DNS or subnet mask, i'v never heard of that IP address and i have no clue to who it is or what they want.
I have Zone alarm as a firewall, ADSL modem, motorola router, OS Win98SE
if you need more info no prob, except for shoe size, where i'm having thanks giving, thats a whole other story.

urmod4u

127.0.0.1 is a "loopback" IP address. It is not associated with any hardware or network. Its purpose is mainly for testing and does not go out of your own machine (i.e.: 127.0.0.1 is a local host in your own PC - mozilla seems to use it).
==>>> Be sure to specify to "no proxy" in your browser's settings, or if you have to, specify "No Proxy" for: localhost, 127.0.0.1
.

murph

Some time ago I inadvertently downloaded some sort of trojan type thing that added a whack of entries to my "HOSTS" file. Basically, there were approximately 200 entries for various security sites e.g. Lavasoft was in there.
It added a 127.*.*.* address against that site so if I tried to browse to that site, I got an error message saying page not found etc. I use XP and IE for my web browser. The system checks this file first to see if the requested page is listed with its IP address. Because this file told my system to go to say 127.0.0.5 (for example) for www.lavasoft.de, obviously, the page could not be found as it was pointing back to me (see prev post.)
I'm not that au fait with Windows 98, but it might be worth looking at as from what you are saying, this seems to be what similar to what I was experiencing.
I know very little about Windows 98 as I said, but on XP, this file is in C:\Windows\system32\Drivers\ETC\HOSTS - if you find a file like this, right click on it and open with notepad. It should read as:

127.0.0.1 localhost

or something similar - just for a bit of added info, if there is any text in between a #, then don't be alarmed as that is just a comment and doesn't alter what you system does.

urmod4u

Just wondering, did you, by any means, get rid of that Trojan? Because of course, this is the first thing to do.
Next, you can remove by simple editing all entries except the "localhost" one.
BTW: check if you find the HOSTS.BAK file, and have a look at its contents.

murph

Yes, the trojan was gone before I did any of that other stuff. I have since upped my security but at the time, I found it by using the free virus scanner on Symantec's website. I then did a search on Symantec with the name of the trojan in order to obtain removal details.
Most of these things add entries to your registry which is why people often complain about re-occuring problems; e.g. they only look at removing the symptoms i.e. altering your homepage back, getting rid of HOSTS file entries or deleting any sites from the favourites. Obviously, one needs to eradicate the source before doing any of these other things therefore, you will with many trojans, unless someone has written a removal application, need to delve into your registry to delete the offending keys.

fredg

HI,
There are 2 great, free, programs to rid your computer of Trojans, spyware/advertising ware.
Any of these could cause your surfing to stop.

You can get them at:

http://www.security-related.com/download2.htm
Download: SpyBot Search & Destroy; 1.3

AdAware at:
www.lavasoftusa.com
Download: AdAware_SE

I also use Win98SE, and both the above work great...
Best wishes,
fredg

urmod4u

Magicpoo, are you using any form of virus-scanner? You did not mention it. And today, it's indispensable. Adaware and Spybot are very good, but are not focused on viruses or trojans. You need an antivirus program in addition.

MagikPoo

ok heres the shiznit, i already do ad-aware and spybot S&D two great programs that i also recommend thank you fredg, i did what you said urmod4u and yep everything is good,
Murph got me a littel paranoid but id use the above programs and there was no significant problems, Oh and Murph local host = 127.0.0.1 so thats cool, then i went to trendmicro.com to do a online virus check no probelms so i down loaded pc-cillin and and found a java script virus no problem i got it removed. But had to get rid of it becuse it confilicted with zonealarme, so right now i have no virus checker. I know, i know, its like running around with no pants on, burrr!

Any help on a good free antivirus program just for now?

i still get it but less frequently, is there any free tutorials about this kind of thing?

and i'm now off to Symantec's web site for a free virus checking, thank you murph.

urmod4u

See:
http://free.grisoft.com/freeweb.php
for a free virusscanner (AVG virusscanner from GRISOFT)

murph

There's a pretty cool site that you may or may not be aware of - http://www.auditmypc.com/
Have a look and see if it helps. I found it pretty ok for some stuff and as a good start before trying more technical sites etc. There are a few different scans it can perform including a full on port scan, anti-virus scan and a firewall checker.
Incidentally, I failed to mention before - some ISP's use a cache server to serve you your web pages and some of these online scanners will not pick up your IP address, only the IP of the cache server. Check that the IP being scanned is yours...