Author Topic: radio channel?? (Read 9325 times)

zeexen · « **on:** February 07, 2015, 02:13:48 pm »

Everytime time i start winmx a certain radiochannel start to play.
Only by completely closing winmx the music stops.
The music start 2 seconds after being connected.

zeexen · « **Reply #1 on:** February 07, 2015, 02:20:48 pm »

after reinstalling winmx, the music still plays after launching winmx. Is this a new form of attacking the community?

GhostShip · « **Reply #2 on:** February 07, 2015, 05:53:37 pm »

I would say not, have a look through your file type associations and see if any have been set to use WinMx as the launching app, alternatively have a peek at the task manager and see if any other application is running that may give you a clue on how the player your hearing is being triggered, also let us know what version of WinMX you have as some folks think they are using WinMX but find out they are running some third party sound-a-like

That reminds me

, I think I may have the answer after all, WinMX uses some of the system sounds for selected events, take a peek in the control panel -> "Sounds and audio devices" and click the "Sounds" tab to make sure that the "sound theme" is set to "Windows default" (remember to press "apply"), I believe that will cure the problem

zeexen · « **Reply #3 on:** February 07, 2015, 06:37:35 pm »

still hearing a radiochannel

I had winmx 3.53, now i installed 3.54.
checked the processes and applications, no other process start except for winmx
placed the default sound theme and verified the file associations

I never listen to online radio, i do not know why winmx suddenly plays an online radio.
Does online radio has an "file type association"?
I do not have any mp3 with this kind of music (not my style).

White Stripes · « **Reply #4 on:** February 07, 2015, 07:42:36 pm »

are you using the community patch? or an older hosts based patch? i ask because internet explorer (technically capable of being used as a 'radio') is embedded in a little sliver of the program where winmx.com used to post that there was an update...

zeexen · « **Reply #5 on:** February 07, 2015, 09:29:14 pm »

i downloaded the winmx 3.54 from here, so i guess i have the latest patch
3 days ago i installed wxp SP3, and other updates.
my standard browser is chrome.
is there a setting in IE that i need to change or should i remove IE completely?

White Stripes · « **Reply #6 on:** February 07, 2015, 09:37:25 pm »

well... you cant remove internet explorer completely (winmx, among quite a few other things, wouldnt run if you did)... if, near the top of winmx it says FSR=0 (or other number) and BC=0 (or, again, other number) you have the right patch.....

open the command prompt (start > run > type 'cmd' with no quotes > hit enter) and in that prompt type netstat ... look for things connected to port 8000 or urls you may know to be internet radio stations.....

also it couldnt hurt to do a complete malware and virus scan of your system....

also curious.... what type of music is being played? techno, rap, country, other?

zeexen · « **Reply #7 on:** February 07, 2015, 09:51:38 pm »

your suggestion of IE worked
i removed IE8
now when i start winmx windows aked me if chrome should start "find.html"
after starting it chrome opened a page with internetradio, when i close this it stopped
i'm sure this is a virus (find.html is located in the temp int files) but my av does not see it
"find.html" is only actived when winmx starts
i'm a bit worried if this virus is designed for winmx users.

i will run a complete scan and empty the temp files.
Will let you know if it comes back.

zeexen · « **Reply #8 on:** February 07, 2015, 10:16:10 pm »

i made a screenshot
winmx downloads a file and wants to open it
by pressing cancel i do not listen to the music

i checked the 2 ini files in the winmx folder, there's nothing written about downloading a file during the start up.
the registry is also clean, no key or value containing "find.htm" or "iwdr". only after clicking "open" the file is downloaded to the temp folder

i downloaded 3.54 today from your website.

White Stripes · « **Reply #9 on:** February 07, 2015, 11:00:47 pm »

right click the shortcut you use to start winmx and look if a program other than winmx is being run... ...or if there is a shortcut to a website containing that 'find.html' ...

GhostShip · « **Reply #10 on:** February 07, 2015, 11:44:15 pm »

I just googled the address shown in the image above ( iwdir.net ) and gained some data on this issue by reading this topic

http://www.boards.ie/ttfthread/2057296668/2

and this one relating to the same issue

http://community.upc-cablecom.ch/posts/c3b5d0b7c5

It seem the issue is caused by the DNS config in the router (liberty global own a few ISP companies now it seems )

http://en.wikipedia.org/wiki/Liberty_Global

anyway this is the post that got my interest :

Quote

I started seeing this today as well. It's not malware or a virus, it's just the way the DNS client is configured on the Horizon router.

Technical stuff: When you connect via Wifi or Ethernet the Horizon box gives your computer/smartphone a DHCP lease with something like the following information:

DHCP4.OPTION[1]: domain_name = net
DHCP4.OPTION[2]: expiry = 1421777983
DHCP4.OPTION[3]: broadcast_address = 192.168.192.255
DHCP4.OPTION[4]: vendor_encapsulated_options = 3c:d:53:54:42:2d:55:50:43:2d:64:68:63:70:73
DHCP4.OPTION[5]: dhcp_message_type = 5
DHCP4.OPTION[6]: dhcp_lease_time = 86400
DHCP4.OPTION[7]: ip_address = 192.168.192.44
DHCP4.OPTION[8]: subnet_mask = 255.255.255.0
DHCP4.OPTION[9]: routers = 192.168.192.1
DHCP4.OPTION[10]: domain_name_servers = 192.168.192.1
DHCP4.OPTION[11]: network_number = 192.168.192.0
DHCP4.OPTION[12]: dhcp_server_identifier = 192.168.192.1

The first line, 'domain_name = net', is the one causing this issue. When you type in a website that doesn't exist (for example dsjkldsjkdsajkl.com) the Horizon box will try and fail to find an IP address for the site. When that failure happen the option 'domain_name = net' instructs your computer to try connecting to dsjkldsjkdsajkl.com.net instead. When you do that the 'com.net' domain will return some random looking IP adresses. e.g.:

;; ANSWER SECTION:
dsjkldsjkdsajkl.com.net. 6170 IN A 106.186.123.143
dsjkldsjkdsajkl.com.net. 6170 IN A 74.221.212.214
dsjkldsjkdsajkl.com.net. 6170 IN A 199.167.196.149

Your browser chooses the first of these (106.186.123.143) and tries to connect to it. One of them is where the iwdir.net website lives, iwsearch.net lives at another. Whichever one you end up connecting to is a matter of chance.

I'm not sure why the com.net name servers are set up like this - I think they've been that way a while.

So UPC can and should fix this. I believe they can update the Horizon router to stop setting the 'domain_name = net' option on the DHCP lease and it will make the problem go away.

I hope this helps.

PS: the mystery of the Find.html may be resolved by looking at this page

http://www.iwdir.net/find.html

zeexen · « **Reply #11 on:** February 07, 2015, 11:54:24 pm »

i do not use a shortcut.
Winmx starts when i use mxmonitor, but it also starts when i open the winmx.exe directly.
i was one step ahead of you, i checked if there was an extra command line. could not find anything.

I used ccleaner to remove the unnecessary files and started a complete scan for viruses. in the meantime 2 XP updates installed, restarted the pc.
but he still asks for the download. Now that I can cancel the download it's not so bad anymore.
I am puzzled why he wants to download a file from a site i never use. And why only winmx?

White Stripes · « **Reply #12 on:** February 07, 2015, 11:58:01 pm »

http://radioinfoweb.net/wordpress/?page_id=96 --- well... heres the radio....... this is one seriously colossal screwup if its DNS based... ... for what its worth googles dns is at a easy to remember 8.8.8.8 ... if i remember the configuration settings of winmx you can tell it to use that DNS server rather than the one used by the system.... if nothing else it should shut this problem up....

zeexen · « **Reply #13 on:** February 08, 2015, 12:08:31 am »

it makes sence.

I do have an UPC horizon box.
never thought that this problem is related to the ISP and the horizon box

in 2 weeks i'm changing isp anyway (fiber optic

I changed the DNS in winmx to 8.8.8.8. restarted winmx
but still the stupid file download

i can live with this hick-up for 2 weeks.

zeexen · « **Reply #14 on:** February 08, 2015, 05:14:30 pm »

Thanks for the hint about IE, without it I never found out the link to the radiochannel.
For a moment I thought I had a new virus. Or a new way of attacking winmx users.
But now I know it's from my ISP (one of the several errors from their side)