Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Something makes all browsers on any operating system or computer of my home network to open random web pages and ask to install a Microsoft protection of some kind, what could do that?

It send random links like:

  • http://results.google-analytics.com/

  • http://wellaction.com/?q=fine+silverware
    redirects to http://crazyfastcash.com/?query=fine+silverware

share|improve this question
    
Are you saying that if you insert a live linux CD and boot from that , your web browser still offers to install microsoft protection? –  DaveParillo Mar 28 '10 at 19:57
    
Checked and does the same ... –  user32571 Mar 29 '10 at 1:26
    
are you connecting via wifi? Does this happen if you plug directly into your modem or router? Are you certain your not inadvertently roaming onto a neighbouring network? –  DaveParillo Mar 29 '10 at 5:04
3  
Sounds like DNS hijacking to me, got nothing to do with any of your computers and probably doesn't even have anything to do with your computer. Try setting your DNS servers to 8.8.8.8 (secondary to 8.8.4.4) which are Google's DNS servers and should be safe. If it still continues to happen then it might be worth it contacting your ISP to figure this out with them (mention in full detail this happens across all OSes and all computers and you checked out the router). –  Tom Wijsman Sep 28 '12 at 17:31
1  
DNS hijacking is a possibility, but I think it's unlikely an ISP's DNS server can be hit with DNS hijacking for any extended period of time. A more common scenarior to hijack website resolution, is ARP spoofing based malware, that will only affect the user's local network. The user just need to find out which computers have the malware, and clean it. –  KoKo Sep 28 '12 at 18:01
show 4 more comments

5 Answers 5

Yes, there are many trojans that try to duplicate the Microsoft Windows Update and Windows Defender UIs. They are especially effective if you run your browser full-screen; they really do look like the real thing. Also, Googling the name will not help because they use Microsoft's names and logos.

The best way to tell if it's a fake is to minimize the browser; if the "virus alert" disappears, it's a fake.

Microsoft has a web page showing some of these fake programs at http://www.microsoft.com/security/antivirus/rogue.aspx.

If you see one of these things, tell the web site.

share|improve this answer
    
this isn't a malware, it's more like a rootkit or an hijack, it send links like results.google-analytics.com ... –  user32571 Mar 29 '10 at 3:11
add comment

How do you connect to the internet?

Given it's any OS and all computers it sounds like there's something wrong with your router or gateway PC.

What's the URL of the site(s) you get? You can enter them as text if you don't want to link to them.

share|improve this answer
    
wifi ... I tried to upgrade the firmware of the router, I thinked the same as you for that ... For websites examples, I will try to note some then add them here ... –  user32571 Mar 28 '10 at 20:45
add comment

It's very strange that all OS are affected, so it must be something on your router or internet connection.

If you connect through a gateway computer you should restart the computer in safe mode and run antivirus and spyware to check for DNS changer viruses.

If you have a connection through a wireless router, it may be compromised. Try changing the password for the router and see if the problem continues.

Just to be safe I recommend scanning all the computers in your home for viruses.

share|improve this answer
add comment

It's best to actually research the 'Microsoft protection' program that it's detailing. Try Googling the name of it to see if it's malware (note: it's best to go to recognisably named websites and look at any that are paid for at the top - they are usually reputable).

Though it sounds as if that if it is malware, it's something in your router, or maybe on a bit of hardware, like a shared USB key for it to be on more than one computer. Or maybe everybody went on the same website and got infected, but it does sound like malware at the moment, though you will have to research it more to properly find out

share|improve this answer
    
malware are uneffective on linux, rootkits are possibles but won't affect all os on many computers and browsers ... –  user32571 Mar 29 '10 at 3:13
    
an ARP spoofing malware installed on your windows machine, can still affect your linux machine or any other OS that is connected to your local network. –  KoKo Sep 28 '12 at 18:04
add comment

Sounds like an ARP spoofing malware if it is affecting all computers on your network. First isolate the computer that is sending out the ARP attacks, then either wipe and re-install the OS clean or get a really good scanner that can detect ARP malware (I'd probably just wipe and re-install the OS).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.