6

Something makes all browsers on any operating system or computer of my home network to open random web pages and ask to install a Microsoft protection of some kind, what could do that?

It send random links like:

  • http://results.google-analytics.com/

  • http://wellaction.com/?q=fine+silverware
    redirects to http://crazyfastcash.com/?query=fine+silverware

9
  • Are you saying that if you insert a live linux CD and boot from that , your web browser still offers to install microsoft protection? Mar 28, 2010 at 19:57
  • Checked and does the same ...
    – user32571
    Mar 29, 2010 at 1:26
  • are you connecting via wifi? Does this happen if you plug directly into your modem or router? Are you certain your not inadvertently roaming onto a neighbouring network? Mar 29, 2010 at 5:04
  • 3
    Sounds like DNS hijacking to me, got nothing to do with any of your computers and probably doesn't even have anything to do with your computer. Try setting your DNS servers to 8.8.8.8 (secondary to 8.8.4.4) which are Google's DNS servers and should be safe. If it still continues to happen then it might be worth it contacting your ISP to figure this out with them (mention in full detail this happens across all OSes and all computers and you checked out the router). Sep 28, 2012 at 17:31
  • 1
    DNS hijacking is a possibility, but I think it's unlikely an ISP's DNS server can be hit with DNS hijacking for any extended period of time. A more common scenarior to hijack website resolution, is ARP spoofing based malware, that will only affect the user's local network. The user just need to find out which computers have the malware, and clean it.
    – KoKo
    Sep 28, 2012 at 18:01

5 Answers 5

3

Yes, there are many trojans that try to duplicate the Microsoft Windows Update and Windows Defender UIs. They are especially effective if you run your browser full-screen; they really do look like the real thing. Also, Googling the name will not help because they use Microsoft's names and logos.

The best way to tell if it's a fake is to minimize the browser; if the "virus alert" disappears, it's a fake.

Microsoft has a web page showing some of these fake programs at http://www.microsoft.com/security/antivirus/rogue.aspx.

If you see one of these things, tell the web site.

1
1

How do you connect to the internet?

Given it's any OS and all computers it sounds like there's something wrong with your router or gateway PC.

What's the URL of the site(s) you get? You can enter them as text if you don't want to link to them.

1
  • wifi ... I tried to upgrade the firmware of the router, I thinked the same as you for that ... For websites examples, I will try to note some then add them here ...
    – user32571
    Mar 28, 2010 at 20:45
1

It's very strange that all OS are affected, so it must be something on your router or internet connection.

If you connect through a gateway computer you should restart the computer in safe mode and run antivirus and spyware to check for DNS changer viruses.

If you have a connection through a wireless router, it may be compromised. Try changing the password for the router and see if the problem continues.

Just to be safe I recommend scanning all the computers in your home for viruses.

0

It's best to actually research the 'Microsoft protection' program that it's detailing. Try Googling the name of it to see if it's malware (note: it's best to go to recognisably named websites and look at any that are paid for at the top - they are usually reputable).

Though it sounds as if that if it is malware, it's something in your router, or maybe on a bit of hardware, like a shared USB key for it to be on more than one computer. Or maybe everybody went on the same website and got infected, but it does sound like malware at the moment, though you will have to research it more to properly find out

2
  • malware are uneffective on linux, rootkits are possibles but won't affect all os on many computers and browsers ...
    – user32571
    Mar 29, 2010 at 3:13
  • an ARP spoofing malware installed on your windows machine, can still affect your linux machine or any other OS that is connected to your local network.
    – KoKo
    Sep 28, 2012 at 18:04
0

Sounds like an ARP spoofing malware if it is affecting all computers on your network. First isolate the computer that is sending out the ARP attacks, then either wipe and re-install the OS clean or get a really good scanner that can detect ARP malware (I'd probably just wipe and re-install the OS).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .