What Is Nginx! ? It Comes Up All The Time.

[queenpictoria]

Hello.

 

What is "nginx"? Does anyone know? "404 page not found" "Welcome to nginx!!!"

This page blocks web pages I am looking for.

 

What is this? Should I start to become paranoid that our internet is being overtaken?

Sounds silly. This page comes up randomly on different sites. I do not believe it is

my computer because it is not consistent enough. But maybe it is.

 

Any insight on this would be much appreciated.

 

Thanks,

queenpictoria

[TCH-Bruce]

It is a proxy server. Not sure why you are getting it or how to stop it from happening to you.

[TCH-Alex]

nginx is a lightweight, high-performance Web server/reverse proxy and e-mail (IMAP/POP3) proxy, that is used mainly for load balancing on a cluster of servers.

 

The errors like ""404 page not found" "Welcome to nginx!!!" are common 404 errors on nginx server, when hit on invalid pages etc.

[queenpictoria]

Thank you for the information.

I notice that it can happen on just about any web page: "Welcome to Nginx!"

 

If I wait awhile and go back the web page comes up as usual.

It is not happening on invalid pages only. It happens to real, valid web sites.

 

I appreciate your insight.

 

Best,

queenpictoria

[Head Guru]

Queen,

 

I would think this is happening at your place of work, as many corporate offices utilize Web Proxy software to serve up internet to their workstations.

 

Maybe you should check with your IT department to see if they are having issues.

[queenpictoria]

Hello Sir,

 

No, I am speaking of my own personal computer at home.

 

It is intermittent, and not consistent all the time.

 

It just happens at the most unexpected time.

 

Thanks.

[SteveW]

As others have said, nginx is a web server, like Apache. It can be used, same as Apache, to serve websites.

 

You could see that message if you just happened to be trying to visit a lot of nonexistent pages at websites that happened to be using nginx, but that seems a bit unlikely, as Apache is a lot more common.

 

nginx can run on Windows. I would suggest you do a thorough system-wide antivirus/antispyware scan with a good scanner.

 

The scenario I'm a bit concerned about is that a virus infection might be able to install nginx on your PC, and then make modifications to your Windows "hosts" file (in Windows XP, it's at C:\WINNT\system32\drivers\etc\hosts) that redirects some of your outgoing browser requests to incorrect destinations. That is, it would do erroneous translations from URL names to IP addresses. Some of those requests might be directed to your local nginx server for unknown malicious purposes. If the page doesn't exist, you'd get the 404 Not Found error.

 

It is fairly common for website compromises to install a rogue nginx server alongside Apache on the compromised machine, which is then used for nefarious purposes. I hadn't heard of that being done on a home PC, but it doesn't seem impossible. I think it's worth checking out.

 

As a quicker check, try launching Task Manager to see if anything called nginx is running. I'm not really sure what it would be called, but nginx seems like a logical possibility.

Edited January 19, 2011 by SteveW

[queenpictoria]

Greetings..

I appreciate your concern.

 

For example, I went to http://www.drudgereport.com yesterday, and got the "Welcome to Nginx!" page.

It stayed there for a while. I was able to access other webpages, and I am absolutely sure that Drudgereport is

a real website.

 

This happens "randomly" when I am on the web. I am convinced it is not my server.

It is something else.

 

I guess we'll all know in due time.

 

Thanks.

[SteveW]

You're correct, this (when you see it at a variety of websites) would definitely not be caused by a problem on your TCH server.

 

Drudge is certainly a real website. They don't reveal what server program they use, but their normal 404 page doesn't mention nginx.

 

Besides the "malware on your PC" scenario I tried to describe in my earlier post, another possibility is a simpler "browser hijacking", also caused by malware on your PC. Do you use an antivirus program?

 

If a scan by your current antivirus program, and another scan using something like Trend Housecall, Symantec/Norton, or Malwarebytes finds no malware on your PC, the next suspect is that there might be a problem at your ISP. It could be a DNS cache poisoning, so some of your outgoing requests get hijacked and sent to the wrong websites.

 

Something like this doesn't happen by accident. This behavior is very suspicious (it can be a hazard to you), and there is a cause.

[queenpictoria]

Hello.

 

My antivirus (AVAST) runs and updates everytime I turn on my computer.

 

I will run my Malware (Malwarebytes and Spybot).

 

What can I do about my ISP?

 

Any direction would be appreciated.

 

Regards,

queenpictoria

[Head Guru]

Steve,

 

You are on to something.

 

I was also wondering what ISP she is on, as maybe her ISP is using caching software to reduce load across their network.

 

Very odd for sure.

[SteveW]

Bill,

 

The possible causes I can think of are

 

1) Corrupted DNS cache on the PC (would be solved by a reboot).

2) Corrupted hosts file on the PC.

3) Malicious or corrupted browser toolbar.

4) Other malware, more deeply embedded in Windows.

 

Those should be detected by antivirus scans.

 

5) Corrupted DNS cache at the ISP.

 

If it's not one of those, I've run out of suspects.

 

queenpictoria,

 

Any new updates? Is this still happening?

 

If it's an ISP problem, there's not much you can do except report to them what's happening, in as much detail as possible.

[TCH-Bruce]

If it's an ISP problem, there's not much you can do except report to them what's happening, in as much detail as possible.

If it's an ISP problem you can use other DNS servers and bypass the ISP provided ones like OpenDNS.

[SteveW]

Excellent solution! Which reminds me that I've been using OpenDNS for ages. Fast, reliable, no problems.

 

You don't have to join or register, even though they have some services that you can join or register for.

 

All you have to do is find the location in your version of Windows where you set your DNS server IP addresses, and change them to the two IP addresses of OpenDNS, which are displayed on their home page.

 

In Windows XP, it's start > Connect To > (Name of your Internet Connection) > Properties > Networking > Internet Protocol (TCP/IP) > Properties > Use the following DNS server addresses:, and fill in the blanks.

[queenpictoria]

Hello Again,

 

It's been a few weeks and I just wanted to report to you that "Nginx!! 404 Not Found" is creeping up

on almost everything I do.

1) On YouTube Movies I am watching.

2) On Ebay auctions when I am trying to bid.

3) on various websites, on craigslist, on links.

4) I even see them in the columns on some pages where there are supposed to be ads.

 

This does not seem like a POP3 server.

It is more like a blocking. I could understand if perhaps the website is at a time

where there are lots of people trying to look at it. But these are just not examples

that line up with those conditions.

 

I end up leaving Firefox and going to IE which I do not like.

I even see the "Nginx!! blank page once in a while on IE.

 

It almost looks deliberate.

I cannot say that for sure, but I have no reason to be blocked so much.

 

If Ngnix! is calling itself "a lightweight, high-performance Web server/reverse proxy and e-mail (IMAP/POP3) proxy,

that is used mainly for load balancing on a cluster of servers" it sure doesn't look like that to me. It doesn't

just hit on invalid pages. It hits either randomly or arbitrarily on any page it finds itself.

 

Frankly it is a giant pain. I really hate to give up Firefox. I really do, but I will if necessary.

 

Thanks for listening.

[queenpictoria]

Hello.

 

BTW, how do I check for "corrupted DNS cache at the ISP"?

You may have described it, but it went right over my head.

 

Maybe I could learn something here.

 

Thanks,

 

queenpictoria

[SteveW]

What I believe is happening is that for some reason your browser is sending, at random times, outgoing requests to one or more remote websites different from the one you are visiting at the time. It is from those websites that you are receiving the error messages.

 

I did a web search on the symptoms you're reporting, and got some results on similar but not identical issues. This is one, at a forum where I've seen people receive much helpful advice: http://www.bleepingcomputer.com/forums/topic332524.html

 

For that person, it appears the problem went away after they went through Windows rootkit removal steps. A rootkit is a very serious kind of computer infection.

 

This is not to say that you definitely, or even probably, have a rootkit, but it does indicate that it's one of the possibilities, which suggests that this has the potential of being quite serious.

 

This is another similar post in the same forum: http://www.bleepingcomputer.com/forums/topic359330.html

 

I was going to suggest that you post here a list of your Firefox and IE add-ons and toolbars, and that you post the contents of your Windows "hosts" file. And that you install the Firefox add-on called "Live HTTP Headers" https://addons.mozilla.org/en-US/firefox/addon/live-http-headers/ which allows you to view in real time the outgoing requests that your browser is sending, so you can see where they are being sent to.

 

You can feel free to do that, if you wish, but I suspect that you may find these steps to be more of a challenge than you might want to attempt. And one of the reasons that I posted the link to that other forum is to illustrate that the steps needed to track down and resolve mysteries like this can be very complicated.

 

Because that other forum has a focus on issues like this, it might be worth posting there to get advice from people who do that on a daily basis. However, you can see from that example post that the types of things they are likely to ask you to do to try to track this down can be very challenging.

 

It would probably be much less nerve-wracking to take your computer to a service shop for examination.

 

It's just my opinion, but I don't think it's wise to do things like bid on eBay or visit other financial related sites while you're experiencing a mystery like this that could be malware related.

[chunkertron]

hi queenpictoria i had exactly the same problem as you, your browser has been partially corrupted, if you are using chrome, click on the spanner in top right hand corner, then settings, then basics, open the following pages, yours probably reads nginx.www.google.co.uk, change this to eg www.yahoo.co.uk, then also change homepage below this to the same, then go to start menu in bottom left, type dick clean up, and clean all hard drives , i,e c then d, once you have done this reboot your pc and job done, you will see this has resolved your problem.

[queenpictoria]

I do not use Chrome, and never will.

 

Thanks for your suggestions.

 

I just am fading away from Firefox, and using other browsers who have more depth.

[dbutler]

I've also been experiencing the same issue that when I attempt to browse to Google it comes up with a NGinx page. So I started typing the https:// to avoid the issue. currently running malwarebytes which has found 19 corrupted instances so far. It can truly be a nuisance sometimes.

[galvin2013]

classic malware issue nightmare if ya dont have a good anti malware program installed