18

For the last few weeks all the machines on my home network are having the same problem whilst browsing the internet. When the user enters an invalid URL in the browser address bar, instead of the default browser behaviour, the request is sent to http://www1.dlinksearch.com/. As far as I can tell this is all machines and all browsers.

It is so consistent I am wondering whether it has anything to do with our router. We use a DLink DIR-655 router so maybe the clue is in the name :)

Anyhow, I cannot figure out how to disable/remove the offending behaviour. I've checked hosts files, spyware, AV etc. etc. Anybody have any ideas?

Paul

P.S. Apologies if this is not the right place to ask this type of question. I'm a bit stuck

1

7 Answers 7

17

Uncheck Advanced DNS in the router internet setup. This will take care of it. I had this problem with my DLink router before.

3
  • 1
    This fixed the issue for me. More background info: forums.mozillazine.org/viewtopic.php?f=9&t=1472515 Dec 28, 2010 at 20:50
  • 3
    I had this issue with my DIR-655 and unchecking the Advanced DNS setting in Setup -> Internet -> Manual Internet Connection Setup fixed it. Though it did take a few minutes for the old DNS records to expire. May 17, 2011 at 14:04
  • 1
    Worked for me! But... now I have Time Warner's DNS hijacking page. :/ May 28, 2012 at 18:46
1

On my Dir-645, the advanced DNS settings was found under setup > parental control (after an hour of hide and seek)

0

If this is just internet explorer, you can go to Tools > Internet Options or Internet Options in Control Panel.

From here, go to the advanced tab and click the Reset button.

alt text

This should fix it, but if you are still having the problem, please write in comments and I will update with the registry way of overwriting this setting - however just doing a reset is a much easier solution!

2
  • Thanks for the info but this affects all browsers. In the house we use Opera, Chrome, Firefox, IE and Safari. All are doing the same thing. Just on my machine I use Opera, Firefox and Chrome every day and they all re-direct to the pesky dlinksearch nonsense.
    – Bish
    Sep 26, 2010 at 19:43
  • @Bish - I got it wrong, I googled it and it looks like it is a proper malware attack - check your hosts file at c:\windows\system32\drivers\etc\hosts and make sure that there are no malicious entries there. Sep 26, 2010 at 21:29
0

It looks like something is serving a wildcard DNS record on .com. It could be your machines (because of malware), your router or your ISP. You can easily check if it's your machines by booting one from a Linux live CD. If it's your ISP, some routers are able to ignore wildcard replies (I have no idea if your model can); or you can use an alternative DNS server such as Google (assuming you trust them more than your ISP) or OpenDNS. As for your router, it's a tempting possibility given the name of the site you're redirected to, but routers don't normally change settings by themselves: did you reconfigure it or uprade the firmware recently?

0

I would set the router's DNS to a site like OpenDNS, and I would ensure the machines are set to get their DNS settings via DHCP or set the machine's DNS setting to OpenDNS. If the router's DNS looks like it was messed with, some bad software know the default passwords for routers and could have changed it. If you don't already I would make sure the password to the router is not default or easy to guess.

I've had spyware change a machine's DNS, but the fact it is happening on all machines makes me wonder if it is the router.

0

Something got into your router and changed the dns server most likely, do a hard reset of the router and then change the password to something strong. Also check for a firmware update for the router and apply it as soon as possible.

0

Andrew's answer also fixed it for me.

My symptom was that my iphones wouldnt connect to wifi. I kept getting the dlinksearch (log in) page.

Also, on the pc's (wired connection) on my network, any attemp to go to an apple.com page also led me to the dlinksearch page.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .