TrafficClub.com instead of 404 Page - Page 2

TheBlueRaja · 13-11-2005, 20:55

Quote:

Originally Posted by Paul M

Try 217.115.138.24 & 216.87.84.209.

Will do..

I found this after an extensive google search...

http://forums.devshed.com/showthread.php?t=281039 where the guy has exactly the same issue as me (no solution though and nobody knows whats causing it) he's done the whole HiJackthis and spy sweep / registry check too with no solution to be found. He calls it a php lander - ring any bells?

Im boggled to say the least.

TheBlueRaja · 13-11-2005, 21:05

Quote:

Originally Posted by Paul M

Try 217.115.138.24 & 216.87.84.209.

That works, but i still get the search page - looking like something is on my PC. Damn this is weird.

Chris W · 13-11-2005, 21:32

Quote:

Originally Posted by TheBlueRaja

Will do..

I found this after an extensive google search...

http://forums.devshed.com/showthread.php?t=281039 where the guy has exactly the same issue as me (no solution though and nobody knows whats causing it) he's done the whole HiJackthis and spy sweep / registry check too with no solution to be found. He calls it a php lander - ring any bells?

Im boggled to say the least.

bizarre....

having read that thread, i can't see what having a network bridge would have to do with anything though!!!

falling back to the old favourite here- have you tried a system restore to before the problem started?

TheBlueRaja · 13-11-2005, 21:40

Quote:

Originally Posted by Chris W

bizarre....

having read that thread, i can't see what having a network bridge would have to do with anything though!!!

falling back to the old favourite here- have you tried a system restore to before the problem started?

Nope - I - ahem - switched System restore off.

I have no idea when it started anyway to be honest. The thing is i can see this is related to landing.domainsponsor.com somehow. But everything i look for on that has not been resolved by anyone.

Why the heck does it
A) Happen in all browsers
B) Go undetected by Spyware or Virus checkers
C) Happen in safe mode
D) Not show up in the host file
E) Occur despite the DNS server you use?

Im stumped!

Marge · 13-11-2005, 21:48

Sorry for being thick but I spotted this in the log and wondered what it does

D:\Program Files\MrPostman\wrapper\wrapper.exe

TheBlueRaja · 13-11-2005, 21:50

Quote:

Originally Posted by Marge

Sorry for being thick but I spotted this in the log and wondered what it does

D:\Program Files\MrPostman\wrapper\wrapper.exe

No probs,
Its a program which sits on your machine as a proxy between your POP3 Client and Hotmail so that you can download your Hotmail into a Mail client like Mozilla Thunderbird.

Quite good actually and i've used it for ages.

Chris W · 13-11-2005, 21:51

Quote:

Originally Posted by TheBlueRaja

Nope - I - ahem - switched System restore off.

I have no idea when it started anyway to be honest. The thing is i can see this is related to landing.domainsponsor.com somehow. But everything i look for on that has not been resolved by anyone.

Why the heck does it
A) Happen in all browsers
B) Go undetected by Spyware or Virus checkers
C) Happen in safe mode
D) Not show up in the host file
E) Occur despite the DNS server you use?

Im stumped!

i wonder if it affects apple macs

tell you what, i'll see if i can get this pc infected with the same thing, just cos it'll annoy me until i find the solution otherwise!

can you send me a copy of your firefox config file?

also, do you remember doing anything in particular when the problem started??

TheBlueRaja · 13-11-2005, 22:17

Quote:

Originally Posted by Chris W

i wonder if it affects apple macs

tell you what, i'll see if i can get this pc infected with the same thing, just cos it'll annoy me until i find the solution otherwise!

can you send me a copy of your firefox config file?

also, do you remember doing anything in particular when the problem started??

Thanks for the support, but its not specific to firefox - it happens in IE too so it wont be something in the config file.

And to be honest - i rebuilt XP last week so unless it sneaked on between SP1 and SP2 going in im not sure how its happened. Saying that i have installed loads recently obviously so it could be pretty much anything.

Chris W · 13-11-2005, 22:28

Just to clarify- do you get the trafficclub page instead of all error pages or just some?

ie 403/404/500 etc

Dogster · 13-11-2005, 22:30

I noticed also

D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
D:\Program Files\Java\jre1.5.0_05\bin\java.exe

I don't see any processes running that require java, so just a shot in the dark,
kill the processes and disable java.I have java disabled by default as I'm a
paranoid freak.

TheBlueRaja · 13-11-2005, 22:39

Quote:

Originally Posted by Chris W

Just to clarify- do you get the trafficclub page instead of all error pages or just some?

ie 403/404/500 etc

As far as i can see its only for mistyped URL's so it only pops up if i type www.cbleforum.co.uk etc instead of the correct URL.

TheBlueRaja · 13-11-2005, 22:40

Quote:

Originally Posted by Dogster

I noticed also

D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
D:\Program Files\Java\jre1.5.0_05\bin\java.exe

I don't see any processes running that require java, so just a shot in the dark,
kill the processes and disable java.I have java disabled by default as I'm a
paranoid freak.

Java isnt loaded in Safe mode...

Chris W · 13-11-2005, 22:46

Quote:

Originally Posted by TheBlueRaja

As far as i can see its only for mistyped URL's so it only pops up if i type www.cbleforum.co.uk etc instead of the correct URL.

[thinks out loud]
hmm... that tends to suggest something happening at the lookup stage....

edit: what happens if you set a search engine as the default? eg, setting yahoo search as default when installing messenger- that kind of thing. If you have yahoo/ msn search then it will default to this when you mistype an address. Did it do this before? or can you try installing one to see if it does now? That normally wouldn't affect firefox though....

grr.

Marge · 13-11-2005, 22:53

If I type "trafficclub.com" into google I loads of pages of these

Your browser does not support frames
We recommend upgrading your browser. Click here to enter the page:
http://search.trafficclub.com/index2...yaz.com&type=0.
cosmeticsurgeryaz.com/ - 1k - Cached - Similar pages

The bottom line is different with every result but you get the idea, don't know how on earth this will help but hey, you never know !!

TheBlueRaja · 13-11-2005, 23:08

Quote:

Originally Posted by Chris W

[thinks out loud]
hmm... that tends to suggest something happening at the lookup stage....

edit: what happens if you set a search engine as the default? eg, setting yahoo search as default when installing messenger- that kind of thing. If you have yahoo/ msn search then it will default to this when you mistype an address. Did it do this before? or can you try installing one to see if it does now? That normally wouldn't affect firefox though....

grr.

I dont have any of that - Google is my search page... Messenger isnt installed.

Although that gives me a thought (cluting @ straws) - Messenger - hmmm.... I did install Messenger previously and put on the APatch to remove ads etc... I wonder if i accidentally installed the sponsor... (Cant see it though)