Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In IE9 when I search for anything my ISP hijacks google search and I get this result.IE9 search ISP hijacked

To add complication to this I've already changed the default DNS servers (OpenDNS) months ago. This only happens in IE9; even after machine reboots and cache flushing.ipconfig info

I even have my router (dd-wrt) intercepting all requests for DNS and I am still getting this result.

I have all extensions disabled and there are no toolbars. This is IE9 from M$. This is not malware; it happens all machines with IE installed (even IE7/8).

share|improve this question
Is this a vanilla IE9 or was it supplied by your ISP? – ChrisF Nov 16 '11 at 12:24
Do the intercepts work on dd-wrt too? Try installing for example Links and see if it works on the router. Also try some https sites, like – AndrejaKo Nov 16 '11 at 12:28
No wonder he can hijack it because he's your Internet provider, so all your packets going out from your LAN pass through him. He can replace all your packets and reroute as he wishes. Are you sure this is not a malware actually? – m0skit0 Nov 16 '11 at 13:00
Sounds more malware/add-ons/spamware installed as part of your router 'setup'. If it turns out your ISP is changing your search results (read: stripping out the search providers logo's) then i'm sure they would be very interested to hear about it... ;) – HaydnWVN Nov 16 '11 at 13:59

If this only happens in IE, then it is likely something in IE that is making this happen.

Check the Manage Add-ons in Internet Explorer Tools, and remove any Toolbars or Extensions, and Search Providers that you do not want.

By default there are no extensions or toolbars installed, and the only search provider is Bing. So everything else can go to get it back to vanilla.

share|improve this answer
Also check your proxy settings. – LawrenceC Nov 16 '11 at 12:52
This happened to me last year. It turned out to be a toolbar plugin that someone had installed in IE on my machine. – BBlake Nov 16 '11 at 14:15
All toolbars and extensions have been disabled; forgot to indicate that. – jersten Nov 16 '11 at 23:50
Search providers? – Paul Nov 16 '11 at 23:54

To check if this is a DNS issue or an IE issue you can run the following command in powershell:

nslookup asdf.

As you're using OpenDNS the result should be:

Non-authoritative answer:
Name:    asdf

For any other DNS server it should be

*** dnsserver can't find asdf.: Non-existent domain

You could also try it in a different browser such as Portable Firefox (which won't have any add-ons by default)

share|improve this answer
This is the issue; I have the machines DNS set via DHCP and when I run nslookup it's going to my ISP; how do I stop this? I can confirm this with ipconfig; all machines are set to opendns or google dns; but nslookup revealse ISP dns. – jersten Nov 16 '11 at 23:57
Contacted ISP and can confirm they are DNS Hijacking BROKEN queries only – jersten Nov 17 '11 at 1:05
A DNS hijacking tester: EFF on DNS hijacking – jersten Nov 17 '11 at 1:35
This isn't really search or Google request hijacking - this is what happens with your particular ISP when you send a request that doesn't actually resolve to anything. (Like, "Hey ISP's DNS Server! Resolve asdf!" <uhh, okay? what the he.. here, have a search thing.>) – Dustin Howett Nov 17 '11 at 1:37
(You are probably falling through the other nameserver entries on your system because they are just bailing on your malformed input. The IE address bar is not a search bar - other browsers will just hit Google for DNS resolution failures.) – Dustin Howett Nov 17 '11 at 1:39

I know this is my second answer, but it's a different theory.

It wouldn't be beyond possibility for the ISP to intercept port 53 traffic and re-route it to it's own DNS servers. There's not authentication performed with DNS.

share|improve this answer
Yes, but it doesn't fit the symptoms of "IE only". It would be quite difficult to do this at the ISP for only IE, as the original DNS query would not indicate the browser being used. You could redirect once the user-agent was seen, but that doesn't fit the behaviour described. – Paul Nov 16 '11 at 22:28
ISP's dns hijack all the time. Besides that the comment below by Matthew Steeples tells me they are intercepting anyways. – jersten Nov 17 '11 at 0:15
up vote 1 down vote accepted

My ISP was doing the hijacking even after all the precautions I had in-place because of a tool called PaxFire. This tool allows your ISP to intercept all of your traffic even your DNS traffic when you're not using your ISP's DNS servers. There are only two ways to disable it; contact your ISP and they'll disable it per your modem or; when you're greeted with the page scroll down to the bottom and click opt out.

share|improve this answer

If this only happens in IE9, why do you think it your ISP?

Can you check your search provider list? (ie Tools/Manage Addons/Search providers).

Each of them has a option 'Search in the address bar'. If this is ticked and you type adsf in the address, since it is not a valid website address, it will send this to the search engine and presumably go to the first search engine listed which (given your symptoms) is probably one provided/brand by your ISP

share|improve this answer

Boot off of a Linux live CD and see if the issue persists. That will for sure eliminates the operating system entirely. You can use the nslookup command in Linux.

If you are indeed hijacked, try calling your ISP and see if you can opt-out of this in any way.

If you are stuck, you can access DNS over Tor. Works great (if but a little slow) but defintely not for the fainthearted. Not sure how to get it to work under Windows but if you have an old computer and can slap Linux on it that might be your best bet.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .