I use MSN Accelerator and recently noticed in my internet connection settings that, along with my local address, an exception has been placed (as in bypass proxy server) for brazil.ntcmn.edu. It may be nothing at all, but i've never visited that site in my life and am curious as to how an exception might have been set for it. Thanks.

Also... You may assume that i have already run Adaware, Spybot S&D, and McAfee (all with today's updates installed), and i have Spywareblaster enabled for full protection. I try not to waste people's time, so i made sure to do all that before i posted. MSN Tech Support says that it has nothing to do with their software. Specifically, it is located in Internet Properties > Connections > Settings > Advanced > Proxy Settings > Exceptions 127.0.0.1 is always listed there, which i understand is normal, but this new entry... brazil.ntcmn.edu has got me stumped. It may be nothing at all, but i sure am curious as to how it got there, and why it keeps coming back after i delete it. Is this in fact a security risk, or should i ignore it? Thanks, Jim

I don't know enough to help you but I did see this and thought you might want to read about this virus at symantec.com http://www.symantec.com/avcenter/venc/data/w32.gaobot.wx.html It looked to me that there is a strong chance you might have it.

I just relised that there is also a post right below yours on this forum that is about this very same thing, w32.gaobot.wx.html. You might want to follow that post to see if it will help you.

Thanks Tammy, I followed the thread and also followed the instructions at Norton, and it doesnt look like i have that virus. I can't post a hijackthis log here, but it does have one line that reads ProxyOverride = ;127.0.0.1;;brazil.ntcmn.edu;<local> which is definitely whats putting that entry in my settings and keeping it there. What the heck IS this and how did it get there? Jim

Like I said, I don't know much to be able to help you and I wish I could. I have hung out in this site for around 7 months now and to me it looks like somekind of hijacking. The only reason that I responded to your post was because I remembered that I had just read about this and I saw that no one had responded to your post. You might have to do a new post. The reason that I say this is because some of the people who run this site were having a little disagreement about something earlier, about the time we both had made a post, and they were checking out this site, which is listed below here, just above my last post. And they had missed my post also. So, the next night or two, when I had trouble updating my Ad-aware, I had posted this fact in their notice about the update and I included that they had missed my post, but only then did someone look at my post. I'm very sure they just missed you, just like they did me. Just copy and paste into the new post. Sorry I couldn't help you more.