Go Back   English Forum Switzerland > Support > Support > Forum support  
Reply
 
Thread Tools Display Modes
  #1  
Old 20.10.2010, 10:01
MusicChick's Avatar
Forum Legend
 
Join Date: Feb 2008
Location: La Cote
Posts: 17,488
Groaned at 414 Times in 275 Posts
Thanked 20,435 Times in 10,578 Posts
MusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond repute
Still spyware weirdness - d1.openx.org

Ok, I am still having spyware/or whatever ware problems, ever since that incident with spyware feed here. You can tell I am not very PC savvy and don't really know where to turn for help with this. I have updated Avira, actually uninstalled it, got myself a spanking brand new AVG, Spybot S&D, malerwarebytes. They all say I am clean. But anytime I click on EF page, any EF page really, it freezes, and says the PC is busy connecting to d1.openx.org. Why? It slows everything. How can I get rid of it? Our modem does not connect, either, it says connected but somehow the pages won't load. Could there be a link? I am hooked to open access wifi past few days.
__________________
"L'homme ne peut pas remplacer son coeur avec sa tete, ni sa tete avec ses mains." J.H. Pestalozzi

“The only difference between a rut and a grave is a matter of depth.” S.P. Cadman

"Imagination is more important than knowledge." A. Einstein
Reply With Quote
  #2  
Old 20.10.2010, 10:28
Doctor's Avatar
Forum Veteran
 
Join Date: Sep 2008
Location: Zürich
Posts: 1,069
Groaned at 3 Times in 3 Posts
Thanked 527 Times in 323 Posts
Doctor has a reputation beyond reputeDoctor has a reputation beyond reputeDoctor has a reputation beyond reputeDoctor has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

go to the subfolder system32\drivers\etc and locate the file "hosts"
Make an entry there "127.0.0.1 d1.openx.org", and save the file.
127.0.0.1 is the loopback IP, and the entry means, you redirect the traffic, so it connects to your own pc (where it does not find the file), and you can see EF.
It does not solve the problem with spyware, but prevents your pc to connect to the Server, and speeds up the loading of the page, when your pc does not need to wait for an answer.
Dont put a ; in front of 127, as this means "ignore this line".

Doc.
__________________
‘I had a bottle of whisky that I’d bought to take with me when I go to visit friends in Canada, but I thought, “I’m not opening that for him!”
- Gillian Duffy when Gordon Brown visited her
Reply With Quote
The following 3 users would like to thank Doctor for this useful post:
  #3  
Old 20.10.2010, 10:33
MusicChick's Avatar
Forum Legend
 
Join Date: Feb 2008
Location: La Cote
Posts: 17,488
Groaned at 414 Times in 275 Posts
Thanked 20,435 Times in 10,578 Posts
MusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

Quote:
View Post
go to the subfolder system32\drivers\etc and locate the file "hosts"
Make an entry there "127.0.0.1 d1.openx.org", and save the file.
127.0.0.1 is the loopback IP, and the entry means, you redirect the traffic, so it connects to your own pc (where it does not find the file), and you can see EF.
It does not solve the problem with spyware, but prevents your pc to connect to the Server, and speeds up the loading of the page, when your pc does not need to wait for an answer.
Dont put a ; in front of 127, as this means "ignore this line".

Doc.
Sir, I owe you a shot. Thanks.
Reply With Quote
  #4  
Old 20.10.2010, 10:45
MathNut's Avatar
Forum Legend
 
Join Date: Aug 2007
Location: Kt. Glarus
Posts: 4,415
Groaned at 34 Times in 32 Posts
Thanked 10,952 Times in 3,253 Posts
MathNut has a reputation beyond reputeMathNut has a reputation beyond reputeMathNut has a reputation beyond reputeMathNut has a reputation beyond reputeMathNut has a reputation beyond reputeMathNut has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

openx.org is a 'legitimate' site - it's an ad server - but why is your computer trying to access it all the time?

I googled around a little for people reporting similar problems (try "d1.openx.org slow" for example), and it looks like you have a bit of spyware all right. The good news is that its evil plan is to push extra ads at you (this is where openx.org comes in), not steal your data or hijack your email accounts.

Still, it slows down your browsing so let's get rid of it. What Doctor suggested is a good 'quick fix': if your browser can't reach openx.org, it won't spend ages trying to download ads from there. It doesn't actually remove the spyware jobbie from your computer though.

What browser are you using? (Sorry if you told us already, I can't remember.) If it's Internet Explorer, then go to Tools > Manage Add-ons... and look at the list of all plugins you have installed. Some of them will have recognizable names (e.g. Adobe Acrobat.) Start disabling the funny noname ones, one at a time, see if one of them is the culprit. It's only a guess since we don't actually know for sure that the spyware was delivered in the form of a plug-in, but that is one of the common delivery methods.
__________________
Need help? Contact a mod.

Reply With Quote
The following 5 users would like to thank MathNut for this useful post:
  #5  
Old 20.10.2010, 10:55
MusicChick's Avatar
Forum Legend
 
Join Date: Feb 2008
Location: La Cote
Posts: 17,488
Groaned at 414 Times in 275 Posts
Thanked 20,435 Times in 10,578 Posts
MusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

Quote:
View Post
openx.org is a 'legitimate' site - it's an ad server - but why is your computer trying to access it all the time?

I googled around a little for people reporting similar problems (try "d1.openx.org slow" for example), and it looks like you have a bit of spyware all right. The good news is that its evil plan is to push extra ads at you (this is where openx.org comes in), not steal your data or hijack your email accounts.

Still, it slows down your browsing so let's get rid of it. What Doctor suggested is a good 'quick fix': if your browser can't reach openx.org, it won't spend ages trying to download ads from there. It doesn't actually remove the spyware jobbie from your computer though.

What browser are you using? (Sorry if you told us already, I can't remember.) If it's Internet Explorer, then go to Tools > Manage Add-ons... and look at the list of all plugins you have installed. Some of them will have recognizable names (e.g. Adobe Acrobat.) Start disabling the funny noname ones, one at a time, see if one of them is the culprit. It's only a guess since we don't actually know for sure that the spyware was delivered in the form of a plug-in, but that is one of the common delivery methods.
Mozila, and I don't see any plugins, I did delete all the add-ons I found, and restarted but it still goes first to d1 openx.org and only when I dowload any EF page. Annoying thing.
Reply With Quote
  #6  
Old 20.10.2010, 11:00
Glendyn's Avatar
Forum Veteran
 
Join Date: Nov 2008
Location: ZH. Horgen area
Posts: 774
Groaned at 10 Times in 4 Posts
Thanked 933 Times in 385 Posts
Glendyn has a reputation beyond reputeGlendyn has a reputation beyond reputeGlendyn has a reputation beyond reputeGlendyn has a reputation beyond reputeGlendyn has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

I have noticed the same and if I refresh this page I see it connecting to d1.openx.org. I dont see this on other sites - just EF.

EDIT: I've just installed Firebug for Firefox and see it's loading 3 javascripts from another site. I can see this if I view the source of this page it says
<script type='text/javascript' src='http://d1.openx.org/spcjs.php?id=39955'></script>
What it loads are
http://d1.openx.org/spcjs.php?id=39955
http://d1.openx.org/spc.php?zones=le...1%26p%3D983916
http://d1.openx.org/fl.js
__________________
For sale: Baby Equipment & Tissot Swiss Watch

Last edited by Glendyn; 20.10.2010 at 11:10.
Reply With Quote
This user would like to thank Glendyn for this useful post:
  #7  
Old 20.10.2010, 11:10
MathNut's Avatar
Forum Legend
 
Join Date: Aug 2007
Location: Kt. Glarus
Posts: 4,415
Groaned at 34 Times in 32 Posts
Thanked 10,952 Times in 3,253 Posts
MathNut has a reputation beyond reputeMathNut has a reputation beyond reputeMathNut has a reputation beyond reputeMathNut has a reputation beyond reputeMathNut has a reputation beyond reputeMathNut has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

Hm, the plot thickens. I didn't realize it's only happening on EF.

Back to google...

OK, according to the admin of some other forum experiencing the same issues, it's not a spyware thing at all - just that the ad server is overloaded with traffic. That would certainly explain why you're only seeing it on EF (or any other site that has ads from the same server) and also why all your spyware checks came up clean.

If this is the case then either do what Doctor said (i.e. block openx.org manually), or install a Firefox plugin like NoScript or AdBlock and tell it to block access to openx.org.

Let me know how you get on... I've got to run off to a seminar now, will check back in after lunch.
__________________
Need help? Contact a mod.

Reply With Quote
This user would like to thank MathNut for this useful post:
  #8  
Old 20.10.2010, 11:16
Glendyn's Avatar
Forum Veteran
 
Join Date: Nov 2008
Location: ZH. Horgen area
Posts: 774
Groaned at 10 Times in 4 Posts
Thanked 933 Times in 385 Posts
Glendyn has a reputation beyond reputeGlendyn has a reputation beyond reputeGlendyn has a reputation beyond reputeGlendyn has a reputation beyond reputeGlendyn has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

I don't think it's anything to do with actual ads, but some ad related script being loaded by EF. It's in all? the EF pages up by the logo.
have a look at http://www.englishforum.ch/search.php?do=getnew (New Posts). there are no ads, but the link is in the source of the page to load the script from this other server.
Reply With Quote
  #9  
Old 20.10.2010, 11:22
Guest
 
Posts: n/a
Re: Still spyware weirdness - d1.openx.org

Alternatively, configure your firewall or router to block the site like so, and the problem goes away forever (Netgear example)...

Attachment 19867

Last edited by weejeem; 14.10.2011 at 15:03.
Reply With Quote
This user would like to thank for this useful post:
  #10  
Old 20.10.2010, 12:18
MusicChick's Avatar
Forum Legend
 
Join Date: Feb 2008
Location: La Cote
Posts: 17,488
Groaned at 414 Times in 275 Posts
Thanked 20,435 Times in 10,578 Posts
MusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond reputeMusicChick has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

Ok, I downloaded myself a Comodo Firewall, as I didn't know how to put the specific sites I want banned into the windows Firewall. Now, would anyone know how to log the sites (incl openx) into the Comodo Firewall? I can't get into the Netgear modem, since it stopped working (it shows me connected but the sites don't download), I am using a nearby free wifi.
Reply With Quote
  #11  
Old 20.10.2010, 13:33
Guest
 
Posts: n/a
Re: Still spyware weirdness - d1.openx.org

OpenX is the adserver we use. It is legitimate, so no worries there.

It shouldn't be causing slow page loads though. For those who understand the technicalities, the banners are designed to load asynchronously via Javascript. I'll double check that this is working correctly.

In the meantime, the suggestions that others have made about adding openx.org to your block lists is fine. This will block the banners and prevent access to that third party server which may be overloaded at peak times of the day.
Reply With Quote
The following 2 users would like to thank for this useful post:
  #12  
Old 23.10.2011, 20:46
AbFab's Avatar
Forum Legend
 
Join Date: Sep 2006
Location: Zürich
Posts: 8,659
Groaned at 383 Times in 263 Posts
Thanked 13,030 Times in 4,457 Posts
AbFab has a reputation beyond reputeAbFab has a reputation beyond reputeAbFab has a reputation beyond reputeAbFab has a reputation beyond reputeAbFab has a reputation beyond reputeAbFab has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

The OpenX ad server is running slow again...
Reply With Quote
  #13  
Old 23.10.2011, 20:51
Upthehatters2008's Avatar
Forum Legend
 
Join Date: May 2010
Location: In the kitchen at parties.
Posts: 4,540
Groaned at 204 Times in 120 Posts
Thanked 6,078 Times in 2,378 Posts
Upthehatters2008 has a reputation beyond reputeUpthehatters2008 has a reputation beyond reputeUpthehatters2008 has a reputation beyond reputeUpthehatters2008 has a reputation beyond reputeUpthehatters2008 has a reputation beyond reputeUpthehatters2008 has a reputation beyond repute
Re: Still spyware weirdness - d1.openx.org

Quote:
View Post
The OpenX ad server is running slow again...
Wow, I have just blocked d1.openx.org in my firewall and pointed it to 127.0.0.1 in my hosts file and Englishforum is loading superfast now.
Reply With Quote
  #14  
Old 23.10.2011, 20:59
vwild1
 
Posts: n/a
Re: Still spyware weirdness - d1.openx.org

Quote:
View Post
The OpenX ad server is running slow again...
So that's why I'm falling asleep every time I click on something in the forum..!

Just moved to my iMac thinking the Mac Book Air was having "issues" but the iMac is dragging at every click as well.
Reply With Quote
This user would like to thank for this useful post:
Reply




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Spyware Tim General off-topic 43 20.03.2011 00:15
Swiss weirdness. Ghaladh Complaints corner 320 31.03.2010 09:52
Virus and anti-spyware recommendation cricketer General off-topic 12 01.01.2008 22:15


All times are GMT +2. The time now is 03:09.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2022, Jelsoft Enterprises Ltd.
LinkBacks Enabled by vBSEO 3.1.0