every time I click on a link the computer goes to this IP::: http://81.211.105.10/(thing I am searching for)

I have to click the original link about four times to get to the website I want, I cleared all my cookies and I still get this problem, any ideas? this problem is extremely anoying

uve been hacked.

and......... what do I do?

?????

This hack has somehow been written to your Registry. Run Regedit. Search (find) for the website # in your post. Write over that number with a page you want to go to. Remember--Always back up a Registry (export)before editing and make exact notes on what you deleted and added with their locations.

is there a regrestry cleaner somwhere?

First of all, there are registry cleaners (search in google), but it won't do this job.
To solve your problem you must go to Regedit MANUALLY and search for the site, but without http://. Probably you'll find it as http://whatyousearchedfor. Go to that key and just clean that leaving http:// intact; press F3 and continue searching and deleting until it finishes.
After that update your windows with those critical errors (it helps), install an anti-virus, firewall and install Lavasoft Ad-Aware 6 without forgetting the updates for this three too.

I really think this will solve your problem, it solved mine

By the way, also make a search in your registry for wmmse.com, if you find delete it (don't go to the site just find and delete it from registry).

Good Luck !!

Search for a file called hosts. it should be in your sys32 folder or a sub dir from there. deleate that file and reboot. windows will recreate it. that should fix it for you.

Before you do anything, tell us the website the browser hijacker you downloaded somewhere is taking you to. Then we can figure out which anti-spyware program can clean it. Do you have spybpt Search and Destroy? If so open the advanced program from the start menu, then click on the "Excludes" button and go to the Hijackers.sbi tab. If it's listed there Spybot can clean the program. If not check the All Products tab. Then go to the tools button and click on startup items. If it's listed there you can remove it and it's registry by highlighting it and hitting the delete tab. If you don't have Spybot S&D you should.

any luck?

it is always http://81.211.105.10/(thing I am searching for)

Where there is a will there is a way. That IP address is in St' Petersberg Russia.. netname "SOVINTEL-ICSTM2 Damned man is the Russian Secret Service after you? Did you tell a Rushky joke or what? AH HA HA HA HA HA HA! Sorry I couldn't resist. Here is the info on the IP.



Trying whois -h whois.arin.net 81.211.105.10
Error - couldn't connect to server

Trying whois -h whois.arin.net 81.211.105.10

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: Singel 258
Address: 1016 AB
City: Amsterdam
StateProv:
PostalCode:
Country: NL

ReferralServer: whois://whois.ripe.net

NetRange: 81.0.0.0 - 81.255.255.255
CIDR: 81.0.0.0/8
NetName: 81-RIPE
NetHandle: NET-81-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS.RIPE.NET
NameServer: NS3.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: AUTH62.NS.UU.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate:
Updated: 2003-09-19

OrgTechHandle: RIPE-NCC-ARIN
OrgTechName: RIPE NCC Hostmaster
OrgTechPhone: +31 20 535 4444
OrgTechEmail: search-ripe-ncc-not-arin@ripe.net

# ARIN WHOIS database, last updated 2004-02-01 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.


Trying whois -h whois.ripe.net 81.211.105.10
% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html

inetnum: 81.211.105.0 - 81.211.105.255
netname: SOVINTEL-ICSTM2
descr: ICS TM, JSC
descr: 70 Bolshoy pr. V.O.
descr: 199002 St.-Petersburg
country: RU
admin-c: PSA13-RIPE
tech-c: PSA13-RIPE
status: ASSIGNED PA
notify: dnsmaster@ilca.ru
mnt-by: SOVINTEL-MNT
changed: marty@sovintel.ru 20031203
source: RIPE

route: 81.211.105.0/24
descr: SOVINTEL-ICSTM2
origin: AS16354
mnt-by: SOVINTEL-MNT
changed: marty@sovintel.ru 20031203
source: RIPE

person: Prasolov S A
address: ICS TM
address: 70 Bolshoy pr. V.O.
address: 199002 St.-Petersburg
address: Russia
phone: +7 812 3291492
fax-no: +7 812 3222242
e-mail: dnsmaster@ilca.ru
nic-hdl: PSA13-RIPE
notify: dnsmaster@ilca.ru
mnt-by: SOVINTEL-MNT
changed: marty@sovintel.ru 20031203
source: RIPE


Don't you all love these russian hackers. Better watch out Jay, with the Patriot Act and all, the CRAB junta may have you locked up at Guantanimo as an enemy combatant for communicating with foreign agents. P.S. Just kidding about secret service. SOVINTEL is the russian phone company This IP is the address for a European Search service and data base. I don't know why it's directing you, unless you gave the wrong address or I am missing something. Anyway here's the info.

did you try nuking the hosts file?

Jay, you might have a bug, I got it once, did the same thing but to a different site. Do a search for cw shredder, download and run it, it should fix it for you. Regular bugs killers like spybot s&d won't even find it.

Hey man. Back the hell off the Russians.

Did you think my post was made up? That's the real deal bubba.

have you downloaded some software that could possibly be a virus?

Have you tried to use system restore?

I hope this doesnt come out butchered.



| 0 | | 212.254.207.15 | noc.bboxbbs.ch Buemplizer Box |
1 | | 212.254.207.1 | router-bb-bern2.bboxbbs.ch | Bern, Switzerland | | Buemplizer Box
| 2 | | 212.254.206.1 | router-bb-bern1.bboxbbs.ch | Bern, Switzerland | +01:00 | 19 | x- | Buemplizer Box |
| 3 | | 212.254.255.130 | be-core-02.tiscali.ch | ?(Switzerland)| 138 | -----x---- | DataComm (Schweiz) AG |
| 4 | | 212.254.255.214 | glatt-core-02-se12-0-0.tiscali.ch | ?(Switzerland) | +01:00 | 28 | -x | DataComm (Schweiz) AG |
| 5 | | 213.200.70.41 | so-3-0-0.zur10.ip.tiscali.net | - | | 12 | x- | Tiscali International Network B.V. |
| 6 | | 213.200.81.233 | so-0-0-0.fra40.ip.tiscali.net | Frankfurt, Germany | +01:00 | 17 | x | Tiscali International Network B.V. |
| 7 | | 146.188.50.73 | pos3-3.br2.fft1.alter.net | Frankfurt, Germany | +01:00 | 10 | x | RIPE Network Coordination Centre RIPE-ERX-146-188-0-0 |
| 8 | | 146.188.6.113 | so-0-2-0.tr2.fft1.alter.net | Frankfurt, Germany | +01:00 | 10 | x | RIPE Network Coordination Centre RIPE-ERX-146-188-0-0 |
| 9 | | 146.188.7.33 | so-6-0-0.tr2.stk2.alter.net | Stockholm, Sweden | +01:00 | 40 | x- | RIPE Network Coordination Centre RIPE-ERX-146-188-0-0 |
| 10 | | 146.188.11.237 | ge-0-3-0.xr1.stk3.alter.net | Stockholm, Sweden | +01:00 | 41 | x- | RIPE Network Coordination Centre RIPE-ERX-146-188-0-0 |
| 11 | | 146.188.7.78 | pos1-0.gw9.stk3.alter.net | Stockholm, Sweden | +01:00 | 40 | x | RIPE Network Coordination Centre RIPE-ERX-146-188-0-0 |
| 12 | | 146.188.65.38 | sovintel-gw.customer.alter.net | - | | 68 | x | RIPE Network Coordination Centre RIPE-ERX-146-188-0-0 |
| 13 | | 194.186.157.218 | cisco1.spb.gldn.net | - | | 71 | -x | Sovam Teleport |
| 14 | | 194.67.7.178 | cat6500-g-1-1.spb.gldn.net | - | | 70 | x | Teleross |
| 15 | | 194.186.103.134 | iks-gw.spb.gldn.net | - | | 71 | -x | Sovam Teleport |
| 16 | 20 | 193.125.201.49 | c-49-africa-md-satelite1.realsearch.ws | ?(Russia)
|| ? | | 81.211.105.10 | - | ?(Russia) | | | | ICS TM, JSC |
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

thanks! CW Shreader worked ! thanks!

Jay, glad I could help, happy surfing!