All requests seem to be going "through" something

Question

Sorry for the title, its hard to put the problem into proper words.

Basically, in Firefox or Chrome, I try to navigate to stackoverflow.com.

The request fails and the URL I see in the navigation bar is:

http://d2e24t2jgcnor2.webhostoid.com/Secure/Error?URL=http%3A%2F%2Fstackoverflow.com%2F&ResponseCode=504&user_id=5b5033d3-3543-4b7c-9844-055afde93841&uc=20140915&subid=20140915&source=browsersafeguard-rockettab-spigot&version=1.0.5370.12627&implementation_id=browsersafeguard-rockettab-spigot%20&block_host=False&reg=False&redirectms=True

This looks shady and my internet seems slower lately. I have a few questions:

1. Why is my request going through this strange URL?
2. Do the query parameters reveal my identity?
3. How can I stop this?

I use my cell phone’s 3G network and tether it to my laptop.

Solution 1

I had this issue as well. I struggled with it for 3 days - turns out I had ended up with something called 'Rocket Tab' which wouldn't let me open any websites at all! Looked for any new programs recently installed in my laptop and found rocket tab and deleted it. I can rest in peace now!

Solution 2

BrowserSafeguard with RocketTab is malware that gets installed surreptitiously when you load certain "free" software. This link describes the "product". See this link for additional information on how to remove it.

The gist of their removal procedure is to uninstall it from Windows and then run a number of anti-malware programs. The malware has a number of obnoxious features--adware, browser hijacker, and its virus engine--and they recommend a separate tool to eliminate each feature.

I never heard of the two they recommend running first and can't comment on their necessity or efficacy. You could always start with the last two and see it they solve the problem. The last two recommended programs are Malwarebytes Anti-Malware Free and HitmanPro, both well known, effective products.

Solution 3

I experienced a similar issue with pages displaying references to d2e24t2jgcnor2.webhostoid.com if I mistyped a domain name. I found that GeniusBox adware bundled with Vuze had installed itself as a proxy server for both HTTP and HTTPS traffic on the system. It also installed a certificate titled "DO_NOT_TRUST_FiddlerRoot" in the root certificates list so that it could intercept HTTPS traffic without a warning being displayed to a user by his/her web browser that there was now a "man-in-the-middle" intercepting HTTPS traffic. I wonder if the GeniusBox developer(s) thought it funny to install a root certificate with "DO_NOT_TRUST" as part of the issuer name or just copied what was done for the Fiddler proxy server software that someone might install for debugging web connectivity issues without bothering to make any changes. For anyone else experiencing a similar problem, look for "GeniusBox" under "Uninstall or change a program" within the Windows Control Panel.

Comments

[pad]

forgot to mention, the example is for stackoverflow but this happens to every url that fails to load.

[tvdo]

It might help if you attach the output of ipconfig /all. This is likely either a DNS hijack or malware on your computer (or in the browser). Do you know when this started? Did you install anything recently?

[pad]

@Bob I noticed this on my parent's computer. Let me check with my laptop which has ubuntu and get back to you in a min.

[pad]

@Bob I've pasted the output of ifconfig here. Note that this is from a different machine (linux) than the one where I noticed the problem (windows) but still the same network.

[Ravindra Bawane]

There is an ongoing thread for virus clean up suggestions. Please see that and report back if the issue persists after a thorough cleaning. superuser.com/questions/100360/…

[pad]

@music2myear I uninstalled a program called "RocketTab", ran a scan of the machine through Microsoft Security Essentials, and it looks like its gone now. I'll confirm when I get back to that machine.

[pad]

Turned out to be an ad/malware called "RocketTab"

[Admin]

I had same issues. it was Rocket Tab. Removed it n all is fine now.. thx for this post