Talk about going above and beyond ...
thanks!The IP #s I have are:
Quickly looking at these:
220.127.116.11 = canadian file server used for futureshop.ca to digitaltrends.com to various legit ad servers and a quantcast tracker. See http://www.statsreview.com/podcasts.digitaltrends.com
18.104.22.168 = google or yo-in-f104.google.com which is okay and is probably a file server (not a web site for the browser just a site to supply files to the browser)
22.214.171.124 = google or yo-in-f100.google.com which is also okay and is probably a file server (not a web site for the browser just a site to supply files to the browser)
But the most questionable one that sticks out is the goodsearch.com address which is 126.96.36.199.
Good search is an 'invisible' toolbar or .dll added to the Internet Explorer.
Probably not installed by yourself or really wanted - it is probably spyware.
Any chance you have noticed altered search results or unusual ads added to searches or strange popups and banners in the browser???
In any event, this is probably a form of spyware reporting back to it's home servers all of your browsing and searches, even if it is not altering your web experiences.
188.8.131.52 = some file server at level 3. I can't get any satisfaction as to exactly what.
184.108.40.206 = also very vague. The closest thing is the http://onsamehost.com/220.127.116.11/ and this still does not give me any definites as to the actual host site involved. Maybe ok.
Whosis at verisign informed the registration was about to expire very soon without any details.
18.104.22.168 = unknown.scnet.net (really too vague) which is really a site by the host company " Server Central Network" or http://www.servercentral.net/ which is a server that provides even file distribution over the web.
Next step is remove the possiblely installed goodsearch junk from the browser and the windows. it is more than likely not wanted or appreciated.
Go here and get the HJT tool:
Follow the instructions first instructions and then create a startup log and paste this log into the next post.
DO NOT DO ANY checks and DO NOT DO any 'Fix checked" options.
Just create the startup log in the HJT, and open it with the notepad and copy and paste into the next post.