Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to login to Windows Live, and I get the message my password has expired and I'm getting redirected to Live website.

The address looks valid: https://login.live.com/login.srf

But I get the message:

The Windows Live Network is unavailable from this site for one of the following reasons:
This site may be experiencing a problem
The site may not be a member of the Windows Live Network

Anyways, I am wondering if it is possible my system has somehow been compromised. My worries are that some malicious program could have created a fake DNS entry on my local machine for live.com.

The IP address I see from a ping to login.live.com is 65.54.165.139.

I checked my hosts file but it looks clean. Please tell me if the hosts file is the only place where a DNS entry can be forced in Windows (Windows 7 to be exact).

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Here is what I get pinging

Pinging www.login.live.com [67.215.65.132] with 32 bytes of data:

Your ping IP [65.54.165.139] is Microsoft http://www.dnsstuff.com/tools/whois/?tool_id=66&token=&toolhandler_redirect=0&ip=65.54.165.139

You can flush your local dns cache

ipconfig /flushdns

You cannot ping https addresses.

.

If you think you are infected follow the order given to disinfect your PC

1.) Make a boot AV disc then boot from the disc and scan the hard drive, remove any infections it finds, I prefer the Kaspersky disc myself. The New 2010 Kaspersky disc can update the AV dat files if you are connected to the internet at the time of scan and is suggested to update before the scan.

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

2.) Then: Install free MBAM, run the program and go to the Update tab and update it, then go to the Scanner Tab and do a quick scan, select and remove anything it finds.

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

3.) When MBAM is done install SAS free version, run a quick scan, remove what it automatically selects. http://www.superantispyware.com/download.html

These last 2 are not AV softwares like Norton, they are on demand scanners that only scan for nasties when you run the program and will not interfere with your installed AV, these can be run once a day or week to ensure you are not infected. Be sure you update them before each daily-weekly scan.

.

share|improve this answer
    
Note that for large distributed web sites such as those from Microsoft, different regions (and different times) may result in different IP addresses when just using ping. See dig login.live.com for details. Also note that www.login.live.com is not necessarily the same as login.live.com. –  Arjan Dec 19 '10 at 16:57
    
Can you guys with Live accounts login just fine? –  JL. Dec 19 '10 at 16:58
    
+1 for MBAM really superb software –  edelwater Dec 19 '10 at 17:11
    
@JL, yes I can log in just fine to login.live.com –  Moab Dec 19 '10 at 20:04
    
If you're still curious - I wasn't hacked or compromised. But this is great info you shared! The reason was my password had expired in Windows Live and because of this when you try to login, you end up in a infinite redirect loop. I guess Microsoft will fix this, but for now - if this happens you need to do a password RESET using - I forgot my password button. –  JL. Dec 21 '10 at 11:25

The address looks valid : https://login.live.com/login.srf

And shows fine on my computer. It is a HTTPS URL, hence if your browser does not give you a certificate error, then you should be safe from being redirected to some third-party.

This site may be experiencing a problem

I guess that's true then, which first caused the login to fail (where the "expired" message might be inaccurate?) and then caused the website itself to fail.

Note that Microsoft uses many IP addresses for their Live services. From The Netherlands:

dig login.live.com.

[...]
login.live.com.            3600  IN  CNAME   login.live.com.nsatc.net.
login.live.com.nsatc.net.   900  IN  A       65.54.186.47
login.live.com.nsatc.net.   900  IN  A       65.54.165.141
login.live.com.nsatc.net.   900  IN  A       65.54.186.17
login.live.com.nsatc.net.   900  IN  A       65.54.165.139
login.live.com.nsatc.net.   900  IN  A       65.54.186.10
login.live.com.nsatc.net.   900  IN  A       65.54.165.177
login.live.com.nsatc.net.   900  IN  A       65.54.186.19
login.live.com.nsatc.net.   900  IN  A       65.54.165.136

By flushing your own DNS cache you might get an IP address that operates better than the one you were trying to use. The above output is fresh, and tells your computer that this answer is only valid for another 900 seconds. (Subsequent executions of the same command will show lower values until they expire. You'll also see the list of IP addresses change.) Meanwhile, on your computer things will already be expiring right now, so maybe when the DNS is refreshed after (at most) 15 minutes, Microsoft will already have taken out the faulty server from its DNS records.

(You'll see similar output when using nslookup login.live.com.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.