Web pages all redirect to fake sites!!

Serendipity

So - I'm doing a simple Google search for a project yesterday and noticed that every site I click on gets redirected to a different site! For example, Polk Audio redirects to "Free Coupons."

Most of these websites are spammy "search" sites, so the first thing I think is that I've got a spyware infection.

However, I go on another PC and low and behold - I get the same thing!

Was my ISP hacked?

Serendipity

Attached is a pic of what I am talking about -

Now Polk Audio redirects to lowpriceshopper.com!!

P.S. I scanned for spyware too and couldn't find anything.

shack

You definitely have some malware infection from a virus or trojan that spyware removers won't fix. What antivirus are you running?

Serendipity

My antivirus is AVG 8.0. It's always updated daily and I do scans all the time.

For antispyware I use Spybot S&D and Ad-Aware.

If I had a virus or trojan, why is this issue happening on EVERY computer attached to my home ISP? Especially my laptop which I just brought home yesterday? It would be a bit odd that none of this happens at school, but the day I take the laptop home I experience this problem?

Serendipity

Also, some of the PC's at home are never connected to the Internet (for example, my HTPC).

I'm starting to think this is with my ISP - even a clean PC is doing this. (If I do a full format of my laptop and I get this again, then I'll know for sure.)

Serendipity

I can see where you are coming from.

But this seems like a DNS attack on the ISP's side - which explains why machines with a clean install of XP still exhibit this problem.

I'm going to get someone to bring a laptop over and see if their machine does this too.

sucks2beme

Did you run all the MS updates before surfing in general?.
Were your other pc's turned on and on the network?
You might be getting re-infected from another pc at the house.
I recall something simular happening many years ago.

Serendipity

1. Yes, why? Does it make a difference?
2. No, I made sure every other PC was turned off so that one PC couldn't infect another
3. Sure, but my HTPC is standalone and has never been online before.

I could just reformat one of the machines, isolate it from the network, and go to a neighbor's to use their internet connection. That way I'll know if it is the ISP or not.

Serendipity

I have a question -

If I go to Best Buy/CC and pick up a new PC, hook it up, make sure all the other PC's in the house are turne off, and the FIRST thing I get is the redirecting of sites, would that prove it's not a virus/trojan?

bobman1235

Sounds to me like someone hacked your router and redirected your DNS server. Log into your router and make sure the DNS settings haven't been messed with.

I set my DNS servers to use OpenDNS. At the very least that site will tell you how to change your DNS servers, no matter what you want them to point to.

Serendipity

bobman1235 wrote: »

Sounds to me like someone hacked your router and redirected your DNS server. Log into your router and make sure the DNS settings haven't been messed with.

I set my DNS servers to use OpenDNS. At the very least that site will tell you how to change your DNS servers, no matter what you want them to point to.

Aha. That makes more sense. If someone hacked my router, this would clearly explain why a newly reformatted machine still got all the sites redirected.

So what should I check for?

bobman1235

If you're not sure, and you don't have any custom settings in your router, I'd just reset it to its factory state (check your owner's manual), then immediately make sure you change the password and your wireless encryption and all that.

If you know what yo'ure doing, I'd just go in and look at the "static DNS" lines in the router setup, and make sure they're either blank (which will use your IP's DNS servers), or using something like OpenDNS that I linked to above.

Serendipity

No, they're not blank, and I don't recall it was like that before.

I just got a new Lenovo laptop today - should I plug it into the router or not?

sucks2beme

appadv wrote: »

1. Yes, why? Does it make a difference?
2. No, I made sure every other PC was turned off so that one PC couldn't infect another
3. Sure, but my HTPC is standalone and has never been online before.

I could just reformat one of the machines, isolate it from the network, and go to a neighbor's to use their internet connection. That way I'll know if it is the ISP or not.

I had a customer site where not being up to date on the MS hotfixes was
the kiss of death. The first time you opened IE, something like this happened.
It was a HUGE site, and this happened to a number of us working there.
I wish I could remember the details. It involved "hostfiles" in the windows directory. The problem would go from machine to machine.

Serendipity

Sure, I can understand that.

My new laptop - it's all updated and secure, I'm just hesitant to connect it to the network. Would it get infected too?

John30_30

appadv wrote: »

Sure, I can understand that.

My new laptop - it's all updated and secure, I'm just hesitant to connect it to the network. Would it get infected too?

Are you saying all your machines are compromised from just one clicking on the link? Typical AV's won't block them since port 80 (the Web) is open.

You have to really look hard at some of those links in Google. It really sucks because some ultra-nasty malwares have been wired into the links. If they have a bunch of totally unassociated names in the link, beware. Also hover your cursor over it before you click on something, and check what website it references.

Serendipity

John30_30 wrote: »

Are you saying all your machines are compromised from just one clicking on the link? Typical AV's won't block them since port 80 (the Web) is open.

You have to really look hard at some of those links in Google. It really sucks because some ultra-nasty malwares have been wired into the links. If they have a bunch of totally unassociated names in the link, beware. Also hover your cursor over it before you click on something, and check what website it references.

Yes, I noticed that the links are to sites that have TONS of malware!!

I guess I'm not going to connect my new laptop to the 'net until I get to the bottom of this.

mmadden28

bobman1235 wrote: »

If you're not sure, and you don't have any custom settings in your router, I'd just reset it to its factory state (check your owner's manual), then immediately make sure you change the password and your wireless encryption and all that.

If you know what yo'ure doing, I'd just go in and look at the "static DNS" lines in the router setup, and make sure they're either blank (which will use your IP's DNS servers), or using something like OpenDNS that I linked to above.

If your router was compromised, then resetting as bobman stated would be the first step.
You could also try this first to rule out the browser (or proxies or any other malware) as the source of the issue:
Go to a command prompt (Start>Run>cmd>OK) and type nslookup and hit enter.
type www.polkaudio.com and hit enter.
You should get something like this (ignore the **):

> www.polkaudio.com
Server: ****
Address: ****

Non-authoritative answer:
Name: polkaudio.com
Address: 72.32.55.205
Aliases: www.polkaudio.com

If you get something different for polkaudio, then you may have an issue with DNS on your router. If it comes back as above, then the router is not your issue.

Next thing to try is to take that IP address, and use it in your browser.:
http://72.32.55.205/forums
When you use an IP address directly, no DNS resolution is required and will bypass requesting a DNS server to resolve it for you.
If it works fine with the IP address, then some malware is intercepting the DNS requests. If it does not work (or serves up the bogus pages), then some malware is incercepting the entire session. This can include a form of proxying, etc. Some toolbars do this as well.

Try that and let us know what your results are

mmadden28

oh and if you do look at your router's config, and it does have a static DNS server entry, let us know what that is as well.

mmadden28

I just reread your original post and realized you were having an issue with google searched not everything on the internet, is that right?
If so , here are the nslookup results for google:

Non-authoritative answer:
Name: www.l.google.com
Addresses: 64.233.169.103, 64.233.169.104, 64.233.169.99, 64.233.169.147
Aliases: www.google.com

Try putting those into the URL:
http://64.233.169.103
and try your polk audio search again.

Also, go to the command prompt and do the nslookup for google.com yourself and report back what it gives you.

Also, look at your hosts file. The hosts file is a text fiel but has no extension. Its located here C:\WINDOWS\system32\drivers. This file is used before any DNS resolution is requested by a DNS server. A foul entry here will also cause a similar result and could have been modified by malware.

Again let me know your results.

mmadden28

Another thing you can try is download a Linux Live distro, such as Ubuntu. You can boot your computer directly from the CD, without having to install it or mess with your existing stuff. This way you can run a browser from there and see if you get the same redirected site problem.

Serendipity

Okay - so I go back to my dorm and the Internet connection here is working fine.

I noticed that my router at home had an entry in the manually added DNS category, so something's up.

But both my machines work fine when brought to school.

bobman1235

Just remove the entry in the DNS category and you should be fixed. THen make sure you change the password for the router....

Serendipity

bobman1235 wrote: »

Just remove the entry in the DNS category and you should be fixed. THen make sure you change the password for the router....

Thanks. One of my machines, however, is now displaying random popups and icons are appearing on the desktop out of nowhere. So I guess that one got malware too

Serendipity

Dangit. How does stuff like this happen?

Totally malware'd my HP notebook and screwed up my router. At least now I know it was the router, and good thing I didn't connect my new PC to the router!!

I didn't even know a hacked router could lead to malware.

bobman1235

If the hack redirected you to malicious sites....

Serendipity

bobman1235 wrote: »

If the hack redirected you to malicious sites....

I get that part...

The thing is, my router's password is WAY too long for anyone to guess - plus there are %, ?, and $ marks in it. But then who really knows how secure WEP is??

Systems

appadv wrote: »

I get that part...

The thing is, my router's password is WAY too long for anyone to guess - plus there are %, ?, and $ marks in it. But then who really knows how secure WEP is??

Your confusing your wep encryption with your router login, those are two different things.

Is the password to log into your router still the default?

mmadden28

Lorthos wrote: »

Your confusing your wep encryption with your router login, those are two different things.

Is the password to log into your router still the default?

Yes it sounds like you may have the WiFi confuised with the Router login.
And WEP is not secure for WiFi. Use WPA2 if you can.

Serendipity

mmadden28 wrote: »

Yes it sounds like you may have the WiFi confuised with the Router login.
And WEP is not secure for WiFi. Use WPA2 if you can.

Are you referring to the password for the config page?

I just type username = admin, password = password to get into the router.

Fireman32

Lasareath wrote: »

Download this: http://www.malwarebytes.org/mbam.php

I just used it on a client's laptop that had 131 trojans. It removed them all.

It's a very powerful program.

+100 for this program. We had a few machines at the office get infected and was able to remove them with this. Saved me from having to re-image the computer.