OT: What is 'server 288'?

Shamelessly OT, sorry, but I've asked around in a few other places such as
the Firefox forum etc and I'm still looking for an answer.

Occasionally, out of the blue as far as I'm concerned, I'll be saving or
moving a file in XP folders, or opening an image or something, and I'll
suddenly find Firefox has been activated and is attempting to open up a
tab to 'Server 288'. After a few seconds it displays a message that
'Server 288 is taking too long to respond...'

I have no idea what 'Server 288' is, and so far I haven't pinned down
exactly what triggers this behaviour.

I did find this:
http://www.who.is/dns/server288.com/
but it rings no bells whatsoever.

I do daily virus/trojan scans but this looks a bit suspicious. Or it could
turn out to be some inadvertent triggering of one of my many Firefox
extensions, or some other innocent cause.

How can I identify it please?


--
Terry, East Grinstead, UK

In article <(E-Mail Removed)>, Terry Pinnell
wrote:
> Shamelessly OT, sorry, but I've asked around in a few other places such as
> the Firefox forum etc and I'm still looking for an answer.
>
> Occasionally, out of the blue as far as I'm concerned, I'll be saving or
> moving a file in XP folders, or opening an image or something, and I'll
> suddenly find Firefox has been activated and is attempting to open up a
> tab to 'Server 288'. After a few seconds it displays a message that
> 'Server 288 is taking too long to respond...'
>
> I have no idea what 'Server 288' is, and so far I haven't pinned down
> exactly what triggers this behaviour.
>
> I did find this:
> http://www.who.is/dns/server288.com
> but it rings no bells whatsoever.
>
> I do daily virus/trojan scans but this looks a bit suspicious. Or it could
> turn out to be some inadvertent triggering of one of my many Firefox
> extensions, or some other innocent cause.
>
> How can I identify it please?

Maybe it's a proxy server? Whether a benign or malevolent one I couldn't
say, but there are benign reasons for using proxies so it's not in itself a
reason to worry. It could, for example, be intended to provide a function
similar to "Opera Turbo", the one that is supposed to speed up the Opera
browser by, as far as I know, downloading its own bandwidth-reduced versions
of websites when the main ones are busy or the internet connection is slow.

If it is something of this sort, it wouldn't necessarily show up in the
proxy settings, as it would be part of the browser itself.

Rod.
--
Virtual Access V6.3 free usenet/email software from
http://sourceforge.net/projects/virtual-access/

On 21/01/2012 23:49, Terry Pinnell wrote:
> Shamelessly OT, sorry, but I've asked around in a few other places such as
> the Firefox forum etc and I'm still looking for an answer.
>
> Occasionally, out of the blue as far as I'm concerned, I'll be saving or
> moving a file in XP folders, or opening an image or something, and I'll
> suddenly find Firefox has been activated and is attempting to open up a
> tab to 'Server 288'. After a few seconds it displays a message that
> 'Server 288 is taking too long to respond...'
>
> I have no idea what 'Server 288' is, and so far I haven't pinned down
> exactly what triggers this behaviour.

Ah, found in my DNS Cache ... (ipconfig /displaydns)

www.server288.com
----------------------------------------
Record Name . . . . . : www.server288.com
Record Type . . . . . : 1
Time To Live . . . . : 13537
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 64.14.68.96

WHOIS doesn't return anything on server288.com, but the IP address range
it's in belongs to these hosting guys,

http://www.icdsoft.com/contact.php

Based in BULGARIA. <fx:klaxon...>

Icdsoft are probably blameless but their clients may not be, given the
nature of what they call IT interest in that part of the world.

For now, put in your host file

127.0.0.1 www.server288.com
127.0.0.1 server288.com

There is obviously a background process running, you'll have to find it.
Try booting a linux based trojan scanner live CD.

--
Adrian C

Adrian C <(E-Mail Removed)> wrote:

>On 21/01/2012 23:49, Terry Pinnell wrote:
>> Shamelessly OT, sorry, but I've asked around in a few other places such as
>> the Firefox forum etc and I'm still looking for an answer.
>>
>> Occasionally, out of the blue as far as I'm concerned, I'll be saving or
>> moving a file in XP folders, or opening an image or something, and I'll
>> suddenly find Firefox has been activated and is attempting to open up a
>> tab to 'Server 288'. After a few seconds it displays a message that
>> 'Server 288 is taking too long to respond...'
>>
>> I have no idea what 'Server 288' is, and so far I haven't pinned down
>> exactly what triggers this behaviour.
>
>Ah, found in my DNS Cache ... (ipconfig /displaydns)
>
> www.server288.com
> ----------------------------------------
> Record Name . . . . . : www.server288.com
> Record Type . . . . . : 1
> Time To Live . . . . : 13537
> Data Length . . . . . : 4
> Section . . . . . . . : Answer
> A (Host) Record . . . : 64.14.68.96
>
>WHOIS doesn't return anything on server288.com, but the IP address range
>it's in belongs to these hosting guys,
>
> http://www.icdsoft.com/contact.php
>
>Based in BULGARIA. <fx:klaxon...>
>
>Icdsoft are probably blameless but their clients may not be, given the
>nature of what they call IT interest in that part of the world.
>
>For now, put in your host file
>
>127.0.0.1 www.server288.com
>127.0.0.1 server288.com
>
>There is obviously a background process running, you'll have to find it.
>Try booting a linux based trojan scanner live CD.

Thanks both. All a bit of a black art to me but tomorrow I'll try editing
the host file as suggested.

--
Terry, East Grinstead, UK

On Sat, 21 Jan 2012 23:49:10 +0000, Terry Pinnell wrote:

> Occasionally, out of the blue as far as I'm concerned, I'll be saving or
> moving a file in XP folders, or opening an image or something, and I'll
> suddenly find Firefox has been activated and is attempting to open up a
> tab to 'Server 288'. After a few seconds it displays a message that
> 'Server 288 is taking too long to respond...'

Can you tell us the address that Firefox is trying to access? If you open
the tab it should be in the address bar.

Deux <(E-Mail Removed)> wrote:

>On Sat, 21 Jan 2012 23:49:10 +0000, Terry Pinnell wrote:
>
>> Occasionally, out of the blue as far as I'm concerned, I'll be saving or
>> moving a file in XP folders, or opening an image or something, and I'll
>> suddenly find Firefox has been activated and is attempting to open up a
>> tab to 'Server 288'. After a few seconds it displays a message that
>> 'Server 288 is taking too long to respond...'
>
>Can you tell us the address that Firefox is trying to access? If you open
>the tab it should be in the address bar.

OK, will do that the next time it happens. I've had a day or so without a
repetition so far. Have a vague feeling that it usually occurs when I'm
clicking in general vicinity of lower right corner, but could be imagining
that or it's coincidental. I tried various clicks/gestures on the various
tray icons I have around there, with no further useful evidence.

Just ploughed through my Firefox History in the hope that something might
stand out, but nothing did.

--
Terry, East Grinstead, UK