Possible DNS redirection hack attempt

Question

I am trying to login to Windows Live, and I get the message my password has expired and I'm getting redirected to Live website.

The address looks valid: https://login.live.com/login.srf

But I get the message:

The Windows Live Network is unavailable from this site for one of the following reasons:
This site may be experiencing a problem
The site may not be a member of the Windows Live Network

Anyways, I am wondering if it is possible my system has somehow been compromised. My worries are that some malicious program could have created a fake DNS entry on my local machine for live.com.

The IP address I see from a ping to login.live.com is 65.54.165.139.

I checked my hosts file but it looks clean. Please tell me if the hosts file is the only place where a DNS entry can be forced in Windows (Windows 7 to be exact).

Answer 1

Here is what I get pinging

Pinging www.login.live.com [67.215.65.132] with 32 bytes of data:

Your ping IP [65.54.165.139] is Microsoft http://www.dnsstuff.com/tools/whois/?tool_id=66&token=&toolhandler_redirect=0&ip=65.54.165.139

You can flush your local dns cache

ipconfig /flushdns

You cannot ping https addresses.

.

If you think you are infected follow the order given to disinfect your PC

1.) Make a boot AV disc then boot from the disc and scan the hard drive, remove any infections it finds, I prefer the Kaspersky disc myself. The New 2010 Kaspersky disc can update the AV dat files if you are connected to the internet at the time of scan and is suggested to update before the scan.

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

2.) Then: Install free MBAM, run the program and go to the Update tab and update it, then go to the Scanner Tab and do a quick scan, select and remove anything it finds.

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

3.) When MBAM is done install SAS free version, run a quick scan, remove what it automatically selects. http://www.superantispyware.com/download.html

These last 2 are not AV softwares like Norton, they are on demand scanners that only scan for nasties when you run the program and will not interfere with your installed AV, these can be run once a day or week to ensure you are not infected. Be sure you update them before each daily-weekly scan.

.

Answer 2

The address looks valid : https://login.live.com/login.srf

And shows fine on my computer. It is a HTTPS URL, hence if your browser does not give you a certificate error, then you should be safe from being redirected to some third-party.

This site may be experiencing a problem

I guess that's true then, which first caused the login to fail (where the "expired" message might be inaccurate?) and then caused the website itself to fail.

Note that Microsoft uses many IP addresses for their Live services. From The Netherlands:

dig login.live.com.

[...]
login.live.com.            3600  IN  CNAME   login.live.com.nsatc.net.
login.live.com.nsatc.net.   900  IN  A       65.54.186.47
login.live.com.nsatc.net.   900  IN  A       65.54.165.141
login.live.com.nsatc.net.   900  IN  A       65.54.186.17
login.live.com.nsatc.net.   900  IN  A       65.54.165.139
login.live.com.nsatc.net.   900  IN  A       65.54.186.10
login.live.com.nsatc.net.   900  IN  A       65.54.165.177
login.live.com.nsatc.net.   900  IN  A       65.54.186.19
login.live.com.nsatc.net.   900  IN  A       65.54.165.136

By flushing your own DNS cache you might get an IP address that operates better than the one you were trying to use. The above output is fresh, and tells your computer that this answer is only valid for another 900 seconds. (Subsequent executions of the same command will show lower values until they expire. You'll also see the list of IP addresses change.) Meanwhile, on your computer things will already be expiring right now, so maybe when the DNS is refreshed after (at most) 15 minutes, Microsoft will already have taken out the faulty server from its DNS records.

(You'll see similar output when using nslookup login.live.com.)