very weird. Browser going to wrong website. [Archive]

View Full Version : very weird. Browser going to wrong website.

RaidenWoW

10-24-09, 06:08 AM

MUYA

10-24-09, 06:53 AM

oooh very suspicious that mate.

One thing would be to check the local host file usually by typing the following in run and checking etc...

notepad c:\windows\system32\drivers\etc\hosts

Others would be to check for malware etc

ViN86

10-24-09, 11:35 AM

when I try to go to http://www.facebook.com/ in google chrome and firefox AND internet explorer it takes me to this albania crap....

it's only facebook though, and it's only on this stupid computer.

http://img33.imageshack.us/img33/1931/fsafj.th.jpg (http://img33.imageshack.us/i/fsafj.jpg/)

I use my itouch to browse facebook.com from the same wireless router and it comes up just fine.

I've checked my hosts file and there's nothing there.

this is really confusing me. Anyone know if my computer is hijacked or something?

Two potential problems.

1. Spyware - reads the address and redirects your browser to their site. They probably chose Facebook because it's popular.

2. Your DNS has an incorrect entry and facebook is resolving to the server your visiting.

Since it's only that browser and only that computer, my guess is it's number 1.

oooh very suspicious that mate.

One thing would be to check the local host file usually by typing the following in run and checking etc...

notepad c:\windows\system32\drivers\etc\hosts

Others would be to check for malware etc

Yes, as MUYA said, check the hosts file with a text editor and make sure there isn't an entry like "xxx.xxx.xxx.xxx www.facebook.com" where the x's are numbers as in an IP address.

Typically the only entries in your hosts file should be "127.0.0.1 localhost" and "::1 localhost", unless you have other hosts with static IP's you want to access without going through a DNS.

General Lee

10-24-09, 11:59 AM

Yeah, it sounds like the browser is being redirected somehow, probably in the hosts file. I use the hosts file to keep the computer from connecting to sites blacklisted by Spybot.

ViN86

10-24-09, 12:13 PM

Here's the dig of OpenDNS. Looks like your command prompt is pinging/returning the correct address

; <<>> DiG 9.6.0 <<>> @208.67.222.222 facebook.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2538
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;facebook.com. IN A

;; ANSWER SECTION:
facebook.com. 3475 IN A 69.63.181.11
facebook.com. 3475 IN A 69.63.181.12
facebook.com. 3475 IN A 69.63.187.19
facebook.com. 3475 IN A 69.63.184.142
facebook.com. 3475 IN A 69.63.187.17

;; Query time: 22 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Sat Oct 24 11:12:03 2009
;; MSG SIZE rcvd: 110

Looks like you have spyware. Your DNS appears to be resolving the name just fine. I think this rules out the hosts file as well.

RaidenWoW

10-24-09, 02:36 PM

Yeah I checked my hosts file with notepad. Ctl+f'd and no "facebook" found in it anywhere. It's really odd. I scanned with spybot search and destroy and also scanned with AVG free but nothing came up.

Starscream

10-24-09, 04:37 PM

You've basically done nothing then.

At the very least run Malware Bytes anti-malware and smitfraudfix.

RaidenWoW

10-26-09, 12:38 AM

None of that was the problem.

I read somewhere to do ipconfig /flushdns

That worked for some reason. Can anyone tell me why? The other day it pointed to propeller.com instead of facebook. Lol.

t3hl33td4rg0n

10-26-09, 02:49 AM

None of that was the problem.

I read somewhere to do ipconfig /flushdns

That worked for some reason. Can anyone tell me why? The other day it pointed to propeller.com instead of facebook. Lol.

Your DNS cache probably just got screwed up. I get customers calling in and I just tell them to do that.

ipconfig /flushdns
ipconfig /registerdns

Problem solved.