cxaaaa.cn

Discussion in 'malware problems & news' started by Moh2mmed, Jan 20, 2009.

Thread Status:
Not open for further replies.
  1. Moh2mmed

    Moh2mmed Registered Member

    Joined:
    Oct 18, 2008
    Posts:
    7
    1- hi dun know wt's is this sh*t , i am on a wireless lan , and i am usin Ad Block Plus .. It's Blocks Something called "cxaaaa . cn" in every site i visit i c this , it's un allowed from ad block plus , but alot of sites pages wont load after this happend , i was usin KIS 2009 , Now iam usin Avira Antivir Premium + Windows Firewall , Anybody know wt is that ?, am i infected ?? is there a cure ... for now and for future , plz some 1 help , tnx :) .
    i have knew somethin maybe it will help in this , when i unplug the switch wire from router , everything works good ... is it kinda of rerouting for the router ?

    2- BTW , iam using Vista x64 SP1 , I also need a help for a good security setup for Vista X64 (SandBoxie ,OA Firewall) Doesn' Work ... I use computer for playin games , watchin movies , browsing , downloading ... any idea ?
     
    Last edited: Jan 20, 2009
  2. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,852
    That URL wont resolve for me but it sounds like you are infected with something Avira missed. I would do the standard thing and do a scan with some online scanners eset/kaspersky/drweb and try download Malware Bytes/Super AntiSpyware.
     
  3. Baz_kasp

    Baz_kasp Registered Member

    Joined:
    May 1, 2008
    Posts:
    593
    Location:
    London
    Sounds a lot like ARP poisioning...are you on a network...like a uni campus or something?
     
  4. Moh2mmed

    Moh2mmed Registered Member

    Joined:
    Oct 18, 2008
    Posts:
    7
    nope , iam usin it @ home wiz some neighbors , i dun think it's ARP Attack , cuze after i unplug the cable for a while , some sites n pages sill not loads too , from about a year i got the same prob. but wiz a different name not cxaaa ? , is there a recommendation for a security setup for Vista X64 ?
     
    Last edited: Jan 21, 2009
  5. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,852
    Did you follow my advice?
     
  6. Moh2mmed

    Moh2mmed Registered Member

    Joined:
    Oct 18, 2008
    Posts:
    7
    funkydude , yea i have do all wt u have say , SuperAntispyware Detect 5 files , but it's still on the ad block :S any help ?
     
  7. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,852
    So I assume SAS removed those 5 files? Also, MBAM detected nothing? The online scanners detected nothing?
     
  8. Moh2mmed

    Moh2mmed Registered Member

    Joined:
    Oct 18, 2008
    Posts:
    7
    MBAM dun work @ my vista x64 , online scanner doesn't catch anything too :S , so where the problem :S o_O , is it only rerouting for router and it doesn't affect me ?
     
  9. magian

    magian Registered Member

    Joined:
    Jan 21, 2009
    Posts:
    5
    You can always wipe and reinstall. :-*
     
  10. Spid3r

    Spid3r Registered Member

    Joined:
    Jan 22, 2009
    Posts:
    1
    Hy guys, I have the same s**t in my pc,
    1/22/2009 3:57:34 PM HTTP filter file [noparse]hxxp://mk.cxaaaa.cn/flash.htm[/noparse] JS/TrojanDownloader.Iframe.NBK trojan connection terminated - quarantined
    but i cant get off this trojan :ouch:
    any new ideeas?
    i reinstal win a few times, etc but nothing... :mad:
     

    Attached Files:

  11. Moh2mmed

    Moh2mmed Registered Member

    Joined:
    Oct 18, 2008
    Posts:
    7
    any experts know anything about this problem :S ?
     

    Attached Files:

  12. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,852
    It's loading scripts for that website on every website?

    Try this beta online scanner.
     
  13. Moh2mmed

    Moh2mmed Registered Member

    Joined:
    Oct 18, 2008
    Posts:
    7
  14. JRViejo

    JRViejo Global Moderator

    Joined:
    Jul 9, 2008
    Posts:
    20,924
    Location:
    U.S.A.
    Moh2mmed, since you're using NoScript, go to Options > Plugins and make sure that both Forbid <IFRAME> and Forbid <FRAME> are checked. Also, go to Firefox Tools > Options > Privacy Tab, click on Show Cookies and see if there's a cookie for cxaaaa.cn. If so, remove it and see if that helps.

    If all of this fails, download HijackThis and go to any of the Web sites listed on this Wilders thread: https://www.wilderssecurity.com/showthread.php?t=42148 and post your HijackThis log there. Don't do it here; it will be removed. Good luck!
     
Thread Status:
Not open for further replies.