TrafficClub.com instead of 404 Page
 

Hi all,
Im getting trafficclub.com come up if i put in a bogus URL, say www.yyyfdbfy.com etc... instead of a page not found.

This happens in both IE and Firefox, Spyware sweep with Spysweeper 4.5 shows nowt and neither does NOD32 show anything.

However i cant find anything of note anywhere on either my ISP's web site or Google regarding this company?

Does anyone else get this or have any idea why i may be?

Re: TrafficClub.com instead of 404 Page
 

I'd run a hijackthis, spyware/ adware scan and then check the host file,

Re: TrafficClub.com instead of 404 Page
 

Cant see squit - HiJack this shows

Logfile of HijackThis v1.99.1
Scan saved at 18:59:13, on 13/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Program Files\Eset\nod32kui.exe
D:\Program Files\NetLimiter\NetLimiter.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\taskswitch.exe
D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
D:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
D:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
D:\Program Files\MrPostman\wrapper\wrapper.exe
D:\Program Files\Eset\nod32krn.exe
D:\Program Files\Java\jre1.5.0_05\bin\java.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
D:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\SCOTTB~1\LOCALS~1\Temp\Rar$EX00.375\Hi jackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NetLimiter] D:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Anapod Manager.lnk = D:\Program Files\Red Chair Software\Anapod Explorer\anamgr.exe
O4 - Startup: Mozilla Thunderbird (2).lnk = D:\Program Files\Mozilla Thunderbird\thunderbird.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1131054016093
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MrPostman - Unknown owner - D:\Program Files\MrPostman\wrapper\wrapper.exe" -s wrapper.conf (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Host file is empty and SpySweeper shows nothing... Any ideas? This is plain weird...

Re: TrafficClub.com instead of 404 Page
 

What are your dns servers set to ?

Re: TrafficClub.com instead of 404 Page
 

Have you tried booting into safe mode to see if anything currently installed has caused the problem?

Re: TrafficClub.com instead of 404 Page
 

can't see any problems in your hijack log, can you post the copy of your hosts file as well please

Re: TrafficClub.com instead of 404 Page
 

From his post he is saying the host file is empty.
I would run a multiple tool spyware, trojan, adaware and virus scan and check the add/ remove programs list and your IE toolbars list for anything strange too.

Re: TrafficClub.com instead of 404 Page
 

Still happens in safe mode (in it now) - i will try a different spy sweeping proggy.
DNS 1: 212.23.6.35
DNS 2: 212.23.3.11

Which was picked up by DHCP, i also hard coded the DNS as

Primary DNS: 212.23.8.1
Secondary DNS: 212.23.8.6

Which were given to me by my ISP in my joining up e-mail... Same thing.

WT Heck is going on here? Remember this happens in both IE and Firefox so its not a specific browser related issue.

EDIT: Adaware SE comes back empty too....

Re: TrafficClub.com instead of 404 Page
 

Anybody know any other DNS servers i can try?

Is anybody here on Zen that can try a false address to see what happens?

Re: TrafficClub.com instead of 404 Page
 

You could try ntl's 194.168.4.100 & 194.168.8.100

Re: TrafficClub.com instead of 404 Page
 

You could also run Blacklight to look for any hidden processes/files that normal AV and Spyware scanners won't detect.
Might not help but worth a look.

Re: TrafficClub.com instead of 404 Page
 

Doesnt work - i just time out when looking for a page. :shrug:

Re: TrafficClub.com instead of 404 Page
 

Thanks - shows clean...

Re: TrafficClub.com instead of 404 Page
 

I know it's not a fix but a temporary solution but why not just add them to
your hosts file or block the IP in your firewall for now.
Also worth trying a few other scanners as they can vary in results.
Have you tried Spybot S & D ?

Re: TrafficClub.com instead of 404 Page
 

Try 217.115.138.24 & 216.87.84.209.

Re: TrafficClub.com instead of 404 Page
 

Will do..

I found this after an extensive google search...

http://forums.devshed.com/showthread.php?t=281039 where the guy has exactly the same issue as me (no solution though and nobody knows whats causing it) he's done the whole HiJackthis and spy sweep / registry check too with no solution to be found. He calls it a php lander - ring any bells?

Im boggled to say the least.

Re: TrafficClub.com instead of 404 Page
 

That works, but i still get the search page - looking like something is on my PC. Damn this is weird.

Re: TrafficClub.com instead of 404 Page
 

bizarre....

having read that thread, i can't see what having a network bridge would have to do with anything though!!!

falling back to the old favourite here- have you tried a system restore to before the problem started?

Re: TrafficClub.com instead of 404 Page
 

Nope - I - ahem - switched System restore off.

I have no idea when it started anyway to be honest. The thing is i can see this is related to landing.domainsponsor.com somehow. But everything i look for on that has not been resolved by anyone.

Why the heck does it
A) Happen in all browsers
B) Go undetected by Spyware or Virus checkers
C) Happen in safe mode
D) Not show up in the host file
E) Occur despite the DNS server you use?

Im stumped!

Re: TrafficClub.com instead of 404 Page
 

Sorry for being thick but I spotted this in the log and wondered what it does :dunce:

D:\Program Files\MrPostman\wrapper\wrapper.exe

Re: TrafficClub.com instead of 404 Page
 

No probs,
Its a program which sits on your machine as a proxy between your POP3 Client and Hotmail so that you can download your Hotmail into a Mail client like Mozilla Thunderbird.

Quite good actually and i've used it for ages.

Re: TrafficClub.com instead of 404 Page
 

i wonder if it affects apple macs :Sprint:

tell you what, i'll see if i can get this pc infected with the same thing, just cos it'll annoy me until i find the solution otherwise!

can you send me a copy of your firefox config file?

also, do you remember doing anything in particular when the problem started??

Re: TrafficClub.com instead of 404 Page
 

Thanks for the support, but its not specific to firefox - it happens in IE too so it wont be something in the config file.

And to be honest - i rebuilt XP last week so unless it sneaked on between SP1 and SP2 going in im not sure how its happened. Saying that i have installed loads recently obviously so it could be pretty much anything.

Re: TrafficClub.com instead of 404 Page
 

Just to clarify- do you get the trafficclub page instead of all error pages or just some?

ie 403/404/500 etc

Re: TrafficClub.com instead of 404 Page
 

I noticed also

D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
D:\Program Files\Java\jre1.5.0_05\bin\java.exe

I don't see any processes running that require java, so just a shot in the dark,
kill the processes and disable java.I have java disabled by default as I'm a
paranoid freak. :D

Re: TrafficClub.com instead of 404 Page
 

As far as i can see its only for mistyped URL's so it only pops up if i type www.cbleforum.co.uk etc instead of the correct URL.

Re: TrafficClub.com instead of 404 Page
 

Java isnt loaded in Safe mode...

Re: TrafficClub.com instead of 404 Page
 

[thinks out loud]
hmm... that tends to suggest something happening at the lookup stage....

edit: what happens if you set a search engine as the default? eg, setting yahoo search as default when installing messenger- that kind of thing. If you have yahoo/ msn search then it will default to this when you mistype an address. Did it do this before? or can you try installing one to see if it does now? That normally wouldn't affect firefox though....

grr.

Re: TrafficClub.com instead of 404 Page
 

If I type "trafficclub.com" into google I loads of pages of these

Your browser does not support frames
We recommend upgrading your browser. Click here to enter the page:
http://search.trafficclub.com/index2...yaz.com&type=0.
cosmeticsurgeryaz.com/ - 1k - Cached - Similar pages

The bottom line is different with every result but you get the idea, don't know how on earth this will help but hey, you never know !! :erm:

Re: TrafficClub.com instead of 404 Page
 

I dont have any of that - Google is my search page... Messenger isnt installed.

Although that gives me a thought (cluting @ straws) - Messenger - hmmm.... I did install Messenger previously and put on the APatch to remove ads etc... I wonder if i accidentally installed the sponsor... (Cant see it though) :shrug:

Re: TrafficClub.com instead of 404 Page
 

MrPostman uses Java.

Re: TrafficClub.com instead of 404 Page
 

Whoo!

This gets dafter and dafter - get this.

I thought - OK - lets rule out the OS so i booted up with the Windows XP Ultimate boot CD straight from the CD into the clean OS and then ran the in built K-Meleon browser that comes with it - typed it a dodgy URL and guess what - trafficclub pops up.

Now im thinking WTF...

So i figure - OK - lets rule out the PC altogether so i boot up my work laptop with the bootcd straight into Windows XP (normally this is a 2000 machine with VPN straight into my work network via Checkpoint firewall) and lauch K-Meleon again right from the CD - put in a faulty URL and trafficclup pops up.

Now i am confused - so i think whats the common link here - the router?

So i hard reset it and set it back to factory defaults and start again with a new config - then run the boot cd again from the lappy and still trafficclub.

Is it just me or is this one weird.

Re: TrafficClub.com instead of 404 Page
 

Does the router have dns settings, or indeed any settings ? What happens if you connect direct, cutting out the router ?

Re: TrafficClub.com instead of 404 Page
 

The router is also my ADSL modem so i cant just cut it out unfortunately - it does have DNS which it picks up via DHCP from my ISP.

Im downloading Knoppix Live CD now to test what happens under a different OS.

Re: TrafficClub.com instead of 404 Page
 

which isp are you with? Do they redirect mis typed urls?

Re: TrafficClub.com instead of 404 Page
 

I with Zen, and no they dont.

:cry: :cry: :cry:

Thing is I just tried this with the Knoppix Live boot cd (UNIX) on my Machine and it dosent happen via firefox on that.

So it cant be them or the router.

What have is missed - WHY does it happen with the XP Boot CD on multiple machines?

Im going to go off somewhere and go loco for a while... :mad:

Re: TrafficClub.com instead of 404 Page
 

Ok,
Im booking a stint in the loony bin - this has just stopped happening....

I downloaded Knoppix tried that - it didnt happen then rebooted into XP tried it again and it no longer happens.

This was reported to my ISP though so i wonder if they have changed anything in the mean time. :shrug:

Re: TrafficClub.com instead of 404 Page
 

I would say that's quite likely.

Re: TrafficClub.com instead of 404 Page
 

Funny how there have been no more responses from them in my thread over in their support forums through.

Still its fixed (for now anyway) but it gets on my goat that i dont know what it was and that i had to spend all that time trying to find out what was going on.

Re: TrafficClub.com instead of 404 Page
 

Did you ever try pinging random non-existing URLs to see if anything came up?

Re: TrafficClub.com instead of 404 Page
 

Nope - but a ping wouldnt have helped a tracert might - but - then i'd have to resolve ip addresses and work out which was what etc..

I just wanted to find out where the blame was to be laid.

Re: TrafficClub.com instead of 404 Page
 

It would have told you if non-existing WWW addresses were being resolved to IP addresses.

Re: TrafficClub.com instead of 404 Page
 

True - but i didnt :D