How to remove the dlinksearch browser search hijack

Question

For the last few weeks all the machines on my home network are having the same problem whilst browsing the internet. When the user enters an invalid URL in the browser address bar, instead of the default browser behaviour, the request is sent to http://www1.dlinksearch.com/. As far as I can tell this is all machines and all browsers.

It is so consistent I am wondering whether it has anything to do with our router. We use a DLink DIR-655 router so maybe the clue is in the name :)

Anyhow, I cannot figure out how to disable/remove the offending behaviour. I've checked hosts files, spyware, AV etc. etc. Anybody have any ideas?

Paul

P.S. Apologies if this is not the right place to ask this type of question. I'm a bit stuck

Answer 1

Uncheck Advanced DNS in the router internet setup. This will take care of it. I had this problem with my DLink router before.

Answer 2

If this is just internet explorer, you can go to Tools > Internet Options or Internet Options in Control Panel.

From here, go to the advanced tab and click the Reset button.

This should fix it, but if you are still having the problem, please write in comments and I will update with the registry way of overwriting this setting - however just doing a reset is a much easier solution!

Answer 3

It looks like something is serving a wildcard DNS record on .com. It could be your machines (because of malware), your router or your ISP. You can easily check if it's your machines by booting one from a Linux live CD. If it's your ISP, some routers are able to ignore wildcard replies (I have no idea if your model can); or you can use an alternative DNS server such as Google (assuming you trust them more than your ISP) or OpenDNS. As for your router, it's a tempting possibility given the name of the site you're redirected to, but routers don't normally change settings by themselves: did you reconfigure it or uprade the firmware recently?

Answer 4

I would set the router's DNS to a site like OpenDNS, and I would ensure the machines are set to get their DNS settings via DHCP or set the machine's DNS setting to OpenDNS. If the router's DNS looks like it was messed with, some bad software know the default passwords for routers and could have changed it. If you don't already I would make sure the password to the router is not default or easy to guess.

I've had spyware change a machine's DNS, but the fact it is happening on all machines makes me wonder if it is the router.

Answer 5

Something got into your router and changed the dns server most likely, do a hard reset of the router and then change the password to something strong. Also check for a firmware update for the router and apply it as soon as possible.