Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've got a really weird problem. I often use a specific site, namely www.wunderground.com. For some time, however, both Firefox and Internet Explorer display weird characters whenever I try to open the site. This happens only on a specific PC with Windows 7 Professional 64 bit installed. The page looks like this (in IE it is pretty much the same): Firefox with binary garbage displayed Each time I reload the page I get a slightly different picture, however some parts remain the same, that "ks#" thing for example.

If I save the page and try to open it using a hex viewer, I can confirm that there's complete nonsense like EC DB 6B 73 23 C7 95 20 FA 59 FA 15 69 48 22 C8 and so on. Doesn't look like any character encoding I know. Doesn't even look like compressed information - too many repetitions.

However, if I try to download the page using console utilities like lwp-request or wget, I get the correct page in UTF-8. If I open the site on any other PC including an Ubuntu virtual machine on the same PC, it opens correctly.

What I have tried so far: change the proxy setting from "auto" to "none" in Firefox, check the system for viruses using Dr. Web CureIt!, check the hosts file (I figure it has nothing to do with the issue since the console utilities are working OK). Nothing seems to change anything. On one occasion I was able to open the site in Firefox. That was right after reboot, which makes me think it must be something in the autorun that didn't get loaded at that time yet. I tried to look at the autoruns, but there is a lot of stuff and I found only one suspicious adware which I removed to no avail.

Everything else seems to be perfectly working on this particular PC, including other sites and software (got no other browsers installed, though). I am particularly careful about what I do, so I got almost no chances to pick up any viruses or malware with NoScript installed and no warez or suspicious software from random sites. I got some adware once when I had to install a rare driver or whatever, but that was long time ago and I think I got rid of it pretty quickly.

Got any ideas about a specific system setting or malware that could be causing this? I find it hard to believe there's a virus blocking only a specific weather report site. Looks more like some common browser settings, but I see nothing there.

EDIT: Using Wireshark, I was able to determine that the data I see is exactly what is being sent by the remote site. Turns out it is compression after all. What I still don't understand is why it's broken on this PC. Tried running portable Chrome, the same picture there. I thought that each browser uses its own decompression libraries, so why they are all broken? I use this PC to develop a compression library, so I have some versions of zlib installed here and there, but I seriously doubt they can break all the browsers.

share|improve this question
    
Have you tried opening the page with firefox in safemode? Could be something wrong with a certain plugin. I would also try with other browsers (chrome, opera). Use the portable apps versions, if you do not wish to install software. –  lenooh Mar 3 at 18:41
    
@lenooh, if it's a plugin problem, then why the same thing in IE? It has no plugins installed. Thanks for the heads-up about portable apps. Didn't think of that. –  Sergey Tachenov Mar 4 at 2:45
    
sergey: some plugins are installed system wide (flash, acrobat reader, multimedia, java, etc...) –  lenooh Mar 4 at 18:09
    
@lenooh, looks like you were right. Some global adware plugin. See my answer below. –  Sergey Tachenov Mar 5 at 3:40

1 Answer 1

up vote 0 down vote accepted

Whew. I've figured it out. It was some adware called ShopperPro. I have no idea how I got it, but probably with some legal freeware program (that's why I hate free programs that are not open source). Since it's not a virus, it wasn't detected. Then it's supposed to display ads, but ads and scrips are blocked so I didn't even realize it was there. How it can break compression in all browsers, including portable Chrome, I have no idea. But after uninstalling it through the normal Control Panel procedure everything works fine now.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.