Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently employees in my office (about 5 people) have reported that sometimes web pages can not load for no reason, but after pressing refresh button in the browser, it first shows 'Redirecting you to www.....' then the page loads normally.

This only started to happen this week and it has happened to all users (so I've ruled out spyware / virus on individual PCs.)

Could this be a man-in-the-middle attack? I.e. someone is intercepting all web requests and forwarding them onto the real server. If so how could you tell?

Network configuration:

internet --> |ADSL  |--> wireless router --> office PCs
             |modem |--> web server
share|improve this question
What did you do to rule out SpyWare and viruses? – Randolf Richardson Jun 14 '11 at 7:54
What kind of router is it? Have you been into the routers configuration and checked that the DNS and other settings are all aquired from the ISP rather than manually entered? – Mokubai Jun 14 '11 at 7:59
If they are redirecting you, there has probably been a virus or something. Try resetting proxy servers? – Simon Verbeke Jun 14 '11 at 11:19
Just because it is happening to all users does not rule out a virus at all. It REALLY sounds like your computers are infected. – KCotreau Jun 14 '11 at 13:38

If it occurs often enough, I would use Wireshark to examine the response that is causing the "Redirecting" message.

share|improve this answer

To find out what happens behind the curtains you can try Fiddler for a high level (http) view of the browser requests or Network Monitor for a more low level (ethernet) view.

share|improve this answer

Well crafted malware can infect All PC's on the network, so simply ruling it out using that logic is flawed.

See my "Alternate Method" in this link to scan ALL the PC's. Be sure to run the boot CD first.

Do a hard reset of the Router also.

share|improve this answer
+1 Agreed - I would suggest the fact that all PC's show the same symptoms would make me very certain it was malware. – Rory Alsop Jul 6 '11 at 10:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .