dns.sysip.net

Hi,

I've just got the latest version of uTorrent and noticed something a bit peculiar - any web page I navigate to goes through dns.sysio.net first. So if I click a link to www.google.com, it'll say (briefly) connecting to dns.sysio.net, and then connecting to www.google.com afterwards. It may well be that the interim page is displaying ads of some kind, but if so, Firefox is blocking them.

The reason why I'm posting here is threefold:

1. It's only just started since upgrading to the latest version of uTorrent

2. It only happens when utorrent.exe is running

3. I've just reverted to the previous version and it's stopped happening.

Can anyone explain what's going on here, please? I don't particularly like the idea that my web traffic is being forwarded through some random other site...

http://www.annoyances.org/exec/forum/win2000/1147318961

looks like other spyware to me instead.

Yeah, I did see that. But, as I said, given that it happened only when I had the latest version of uTorrent running...it seemed like too big a coincidence to me.

I've gone back to v1.5 now and it's stopped happening. Given that nothing else has changed on my system - well, if you were in my position, wouldn't you start asking questions too?

I would start looking for actual spyware.

where did you get your latest latest version of µT from?

and how can you claim it only happends when you run this version. Unless I'm completely wrong, µT isn't a single purpose stand alone device, but a programm that runs on top of a system that runs many other programms/processes at the same time!

I don't read in DWK's answer that he critisises you for "asking questions".

What I do read from your second of all posts you made so far in this forum however, is that you want to spread FUD.

Noone else has reported problems with spyware in µT beside a newly registered user that has never ever posted before but reports using µt since version 1.5.

So if you seriously are not a Troll and FUD spreader you better clean your system from the other stuff that has infected it! I highly doubt it's µTs fault if you used genuine versions from the original downloadlocation.

I expected this for some reason.

If you want to accuse me of spreading FUD, then go ahead. I'd like to point out that at no point have I said "hey, uT installed spyware on my system" - merely pointing out that something odd has started happening since installing it, and it's stopped happening since uninstalling it. The first thing that I did was hit Google to try and find some clue as to the problem. I'm a pretty technically-minded person and computer-literate enough to keep my PC clean and free of grease. So when I find something starts happening when I install something new, and stops once I get rid of it - well, forgive me for jumping to the obvious conclusion.

As I said, I'm not accusing uT of anything. I'm seeing what looks like a connection and posting here to ask about it:

Can anyone explain what's going on here, please?

"Hmm, we've not seen this before, perhaps it could be <blah blah blah>?" would have been a slightly more accommodating answer. Perhaps with 43k members though there's just no time for politeness these days. I understand you're all loyal fans of uT an'all - and I've been using it for years myself without any problems - but there's really no need to jump down someone's throat just for asking for some help. So much for "community", eh?

Oh, and for the record - I got the latest version from the updater within uT.

We've had our unfair share of FUD since the BitTorrent Inc. takeover so sorry if we are a bit touchy on the subject.

In my eyes you were accusing µTorrent too cos u said "it seemed like too big a coincidence to me."

Anyway I have noticed no such behavior here. And a little more research before you start posting couldn't hurt. Things like 'it happened only when utorrent.exe was running' may sound like valid arguments but on its own it doesn't mean anything. Run a spyware and virusscan. Google for the problem. Copy the utorrent.exe to another computer (or a friends) and try it there. Grab a list of processes using Process Explorer and post it along it.

Virus and spyware "redirectors" may route traffic meant for big websites like www.google.com through themselves to steal personal information. That may be why your traffic is going through dns.sysio.net

dns.sysio.net doesn't even exist btw. So I assume he means dns.sysip.net

Yeah, I did mean dns.sysip.net, sorry about that.

Anyway, I did a virusscan and nothing. First thing I did when I noticed it was a spyware scan and that turned up no results either. And I did check Google but as I'm sure you've seen yourself there's precious little on it at all, let alone anything useful. I'd have expected it to be fairly well documented if it was a common piece of spyware or somesuch (and this would be true if it was something uTorrent was doing, too) - but the only interesting thing I've found is from May 2006 (the annoyances.org link posted earlier) - which I'm guessing is before the latest release of uT.

[update:]

Quick update - looks like I've found the problem. It's jumped to the second result on Google as of today, with some recent discussion. For those who are interested:

http://www.techimo.com/forum/t188184.html

Thanks for all your trouble, and apologies for my accusations. I hope I haven't offended anyone.

I think both the O.P.'s and helpers/moderators handled this very well. It stayed mostly factual and above-board.

paradigm. I would be grateful if you can confirm a couple of things:

1. You are on BT Broadband

2. You recently installed Firefox 2.0.0.4

3. The problem is still there but is intermittent. If you reboot (and pick up a new IP) it is fine, a few reboots later but with a different IP it comes back.

Cheers.

The problem was a ISP DNS problem and restarting your router and computer should clear the issue by now.

Lord Alderaan. Are you speaking from personal experience of this problem or suggesting a solution?

I still have this problem - a few others do to. There is no solution yet until BT (isp , not torrent) and or Phorm sort this out.

If anyone does have this problem the only 'prevention' is to add 127.0.0.1 sysip.net and dns.sysip.net in your host files, flush the dnscache, reboot and pick up a new IP.

I still need to gather more evidence on this as unless I hear from said parties a report is going to be filed with the relevant cyber crime authorities.

All info welcome.

Nope, paradigm^ isn't using BT.

Edit (2008-08-20): Seems the IP is owned by BT, though...