I believe that I have some sort of spyware on my machine but I can’t figure out how 
to get rid of it.  When I am surfing the net every so often instead of going to the 
page that I have chosen, I get a page that has an advertisement on it.  At the top 
right of the screen it says skip ad.  I click on the skip ad and it takes me to where 
I want to go.  Normally I would say that this is just the website, but it has happened 
on 6 different websites and the look of the ad and the URL is always the same.  Here 
is a sample of one of URLs I have seen:

http://dns.sysip.net/services/nslookup/tad/app=PS&v=1.2.8&site=I.ETHOS.LIVE&size=tad&rnd=8591571

&referer-kw=swi%20forums,spyware,thiefware,browser%20hijackers,advertising%20parasites,malware%20removal,

spywareinfo,log,today,pm&referer=http%3A%2F%2Fforums.spywareinfo.com%2F&xinfopsid=0&format=html&orig=http%3A%2F%

2Fforums.spywareinfo.com%2Findex.php%3Fs%3Daee21a09977b94f46500bc2c49728d7a%26act%3DSearch%26f%3D

I did a search on dns.sysip.net and I came up with nothing.  I searched and searched 
for just sysip and I can’t find anything.  The scary thing about this is it seems 
to be saving all of my pages that I have been to.  If I look at my internet history 
it has a folder for dns.sysip and when I hover over some of the pages it lists the 
pages I have been to even if I didn’t get the advertisement page.  

It isn’t a popup, it’s just a web page redirect that I get sent to before I can get 
to the page I requested.  If I wait a few seconds it automatically redirects me. 
 I have run spybot, adaware, Microsoft defender, yahoo spyware and Ewido anti malware. 
 They all say I am clean.  I have installed and running Norton which runs every night 
and has no virus history.  I have all MS updates installed on my 2K box.

Any ideas?

Tip: Run a free scan for common Windows errors ad

re: http://dns.sysip.net/services/nslookup/tad Advertisment page redirect Thursday, May 11, 2006 at 4:27 am Posted by phantom (5587 messages posted) go to this web site and down load and install their hosts file and see if that does it. http://www.mvps.org/winhelp2002/hosts.htm On Wednesday, May 10, 2006 at 8:42 pm, John wrote: >I believe that I have some sort of spyware on my machine but I can’t figure out how >to get rid of it. When I am surfing the net every so often instead of going to the >page that I have chosen, I get a page that has an advertisement on it. At the top >right of the screen it says skip ad. I click on the skip ad and it takes me to where >I want to go. Normally I would say that this is just the website, but it has happened >on 6 different websites and the look of the ad and the URL is always the same. Here >is a sample of one of URLs I have seen: > >http://dns.sysip.net/services/nslookup/tad/app=PS&v=1.2.8&site=I.ETHOS.LIVE&size=tad&rnd=8591571 > >&referer-kw=swi%20forums,spyware,thiefware,browser%20hijackers,advertising%20parasites,malware%20removal, > >spywareinfo,log,today,pm&referer=http%3A%2F%2Fforums.spywareinfo.com%2F&xinfopsid=0&format=html&orig=http%3A%2F% > >2Fforums.spywareinfo.com%2Findex.php%3Fs%3Daee21a09977b94f46500bc2c49728d7a%26act%3DSearch%26f%3D > >I did a search on dns.sysip.net and I came up with nothing. I searched and searched >for just sysip and I can’t find anything. The scary thing about this is it seems >to be saving all of my pages that I have been to. If I look at my internet history >it has a folder for dns.sysip and when I hover over some of the pages it lists the >pages I have been to even if I didn’t get the advertisement page. > >It isn’t a popup, it’s just a web page redirect that I get sent to before I can get >to the page I requested. If I wait a few seconds it automatically redirects me. > I have run spybot, adaware, Microsoft defender, yahoo spyware and Ewido anti malware. > They all say I am clean. I have installed and running Norton which runs every night >and has no virus history. I have all MS updates installed on my 2K box. > >Any ideas? > [Reply or follow-up to this message] re: http://dns.sysip.net/services/nslookup/tad Advertisment page redirect Thursday, May 11, 2006 at 6:52 am Posted by Larry (1327 messages posted) Sounds like you have a variation of a browser hijacker. Have you installed and run Spybot Search & Destroy and Lavasoft Ad-Aware?. If not I'd reccomend going first to ewido.net and running their free online scanner, it should find the pest and eliminate it (and probably will find more as well). Then install Spybot and Ad-Aware and update and run them as well. Your machine should be squeaky clean by then. Lastly, I would reccomend going to javacoolsoftware.com and installing both SpywareBlaster and SpywareGuard. Both are small "passive" programs that don't conflict and work in different ways to block crapware from installing itself on your machine to begin with. Much easier to block it than remove it. Another thing to consider trying along with and not in replacement of Spybot, Ad-Aware, and SpywareBlaster, is Microsost's Windows Defender (Beta 2). The only caveat I'll mention with it is that while it's SUPPOSED to work with Win2k/2003 and XP, I've had it install and run correctly on several XP machines but fail to install on two different 2k systems but haven't bothered to track down why yet. If you get it to install and run on your's you can eliminate SpywareGuard as Defender incorporates the same functionality of SG. Get Defender here: http://www.microsoft.com/downloads/details.aspx?FamilyID=435bfce7-da2b-4a6a-afa4-f7f14e605a0d&DisplayLang=en Let us know how you make out! Larry On Wednesday, May 10, 2006 at 8:42 pm, John wrote: >I believe that I have some sort of spyware on my machine but I can’t figure out how >to get rid of it. When I am surfing the net every so often instead of going to the >page that I have chosen, I get a page that has an advertisement on it. At the top >right of the screen it says skip ad. I click on the skip ad and it takes me to where >I want to go. Normally I would say that this is just the website, but it has happened >on 6 different websites and the look of the ad and the URL is always the same. Here >is a sample of one of URLs I have seen: > >http://dns.sysip.net/services/nslookup/tad/app=PS&v=1.2.8&site=I.ETHOS.LIVE&size=tad&rnd=8591571 > >&referer-kw=swi%20forums,spyware,thiefware,browser%20hijackers,advertising%20parasites,malware%20removal, > >spywareinfo,log,today,pm&referer=http%3A%2F%2Fforums.spywareinfo.com%2F&xinfopsid=0&format=html&orig=http%3A%2F% > >2Fforums.spywareinfo.com%2Findex.php%3Fs%3Daee21a09977b94f46500bc2c49728d7a%26act%3DSearch%26f%3D > >I did a search on dns.sysip.net and I came up with nothing. I searched and searched >for just sysip and I can’t find anything. The scary thing about this is it seems >to be saving all of my pages that I have been to. If I look at my internet history >it has a folder for dns.sysip and when I hover over some of the pages it lists the >pages I have been to even if I didn’t get the advertisement page. > >It isn’t a popup, it’s just a web page redirect that I get sent to before I can get >to the page I requested. If I wait a few seconds it automatically redirects me. > I have run spybot, adaware, Microsoft defender, yahoo spyware and Ewido anti malware. > They all say I am clean. I have installed and running Norton which runs every night >and has no virus history. I have all MS updates installed on my 2K box. > >Any ideas? > [Reply or follow-up to this message] re: http://dns.sysip.net/services/nslookup/tad Advertisment page redirect Tuesday, May 23, 2006 at 5:36 am Posted by hristo (1 messages posted) How can you catch dns.sysip.net It seems it hijacks the housecall.trendmicro.com address on some dns servers and installs itself instead of trendmicro's free spyware scanner: http://dns.sysip.net/services/nslookup/tad/app=PS&v=1.2.8&site=I.ETHOS.LIVE&size=tad&rnd=42646&referer-kw=free%20online%20virus,online%20virus%20scan,housecall,trend%20micro,scan%20pc,desktop,email,protection,scanning,agreement&referer=http%3A%2F%2Fhousecall.trendmicro.com%2F&xinfopsid=0&format=html&orig=http%3A%2F%2Fwww.trendmicro.com%2Fhc_intro%2Fdefault.asp Beware when using the link from the first reply in the forum from an dns.sysip.net infected computer: http://www.mvps.org/winhelp2002/hosts.htm It seems dns.sysip.net hijacks this link as well. On Wednesday, May 10, 2006 at 8:42 pm, John wrote: >I believe that I have some sort of spyware on my machine but I can’t figure out how >to get rid of it. When I am surfing the net every so often instead of going to the >page that I have chosen, I get a page that has an advertisement on it. At the top >right of the screen it says skip ad. I click on the skip ad and it takes me to where >I want to go. Normally I would say that this is just the website, but it has happened >on 6 different websites and the look of the ad and the URL is always the same. Here >is a sample of one of URLs I have seen: > >http://dns.sysip.net/services/nslookup/tad/app=PS&v=1.2.8&site=I.ETHOS.LIVE&size=tad&rnd=8591571 > >&referer-kw=swi%20forums,spyware,thiefware,browser%20hijackers,advertising%20parasites,malware%20removal, > >spywareinfo,log,today,pm&referer=http%3A%2F%2Fforums.spywareinfo.com%2F&xinfopsid=0&format=html&orig=http%3A%2F% > >2Fforums.spywareinfo.com%2Findex.php%3Fs%3Daee21a09977b94f46500bc2c49728d7a%26act%3DSearch%26f%3D > >I did a search on dns.sysip.net and I came up with nothing. I searched and searched >for just sysip and I can’t find anything. The scary thing about this is it seems >to be saving all of my pages that I have been to. If I look at my internet history >it has a folder for dns.sysip and when I hover over some of the pages it lists the >pages I have been to even if I didn’t get the advertisement page. > >It isn’t a popup, it’s just a web page redirect that I get sent to before I can get >to the page I requested. If I wait a few seconds it automatically redirects me. > I have run spybot, adaware, Microsoft defender, yahoo spyware and Ewido anti malware. > They all say I am clean. I have installed and running Norton which runs every night >and has no virus history. I have all MS updates installed on my 2K box. > >Any ideas? > [Reply or follow-up to this message] re: http://dns.sysip.net/services/nslookup/tad Advertisment page redirect Thursday, June 5, 2008 at 3:56 am Posted by Hank (1 messages posted) If you ever wondered what this was all about there is a leaked BT document which explains what happened during the 2006 trials where javascript was injected into user browsing streams. The following article analyses the document: http://digg.com/tech_news/BT_commite...acts_in_8_days Whilst the document can be viewed here: http://www.wikileaks.org/wiki/Britis...idation_report [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows 2000 Discussion Forum