Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am always getting redirected to some page that shows ads, on several webpages (Microsoft, Linkedin, Yahoo). However, Facebook and Gmail are working fine. I deleted all cookies, but I am facing the same issue.

What type of attack is this? How to fix it?

Note: I'm having the same issue with all browsers.

(Click to enlarge)

share|improve this question

migrated from stackoverflow.com Jan 7 '12 at 23:55

This question came from our site for professional and enthusiast programmers.

1  
Time to reinstall Windows? :-3 –  deceze Jan 7 '12 at 23:54
    
hey don't joke please:), first time i saw this type of issue –  talktopk Jan 7 '12 at 23:56
    
You have a virus. –  SLaks Jan 7 '12 at 23:58
    
I am using windows xp. –  talktopk Jan 7 '12 at 23:58
1  
they might be tracking you via IP adress... try changing that –  That Guy Jan 7 '12 at 23:58

3 Answers 3

This seems to me like a virus. What anti-virus do you use and is it up to date and used?

share|improve this answer
    
i have cisco security agent and MacAfee both. –  talktopk Jan 8 '12 at 0:01
    
can u suggest any solution? –  talktopk Jan 8 '12 at 0:05
    
why with specific websites? –  talktopk Jan 8 '12 at 0:06
1  
Try Malwarebytes AntiMalware and Microsoft Security Essentials. Try removing any add ind you don't use. Chek your proxy settings –  Canadian Luke Jan 8 '12 at 0:43

I can think of at least nine ways to achieve this effect, off the top of my head:

  1. A malicious plug-in.
  2. A malicious proxy auto-configuration script.
  3. A change to the proxy settings that directs all requests to a proxy HTTP server that is under the control of the advertiser.
  4. A whole list of new entries in your hosts file pointing to a content HTTP server that is under the control of the advertiser.
  5. An ISP that requires authentication before letting IP traffic go anywhere other than a network controlled by the ISP.
  6. A change to the DNS client library settings that directs all requests to a proxy DNS server that is under the control of the advertiser.
  7. A problem on some other machine that your machine relies upon for proxy DNS service, proxy HTTP service, or IP connectivity.
  8. A malicious DHCP server on your LAN handing out leases that have bogus DNS proxy or HTTP proxy settings.
  9. A malicious host on your LAN that has been registered as wpad, and that is handing out bogus PAC scripts.

There's not enough information in your question to eliminate any of these. I'm discounting the possibility that you're living in a country whose government decides what companies on Internet its citizens can talk to, on the grounds that you wouldn't need to ask about that. Malice for profit is more likely than malice for ideology, in this case.

First, remove the malware/machine that did this. SuperUser has a general question on this subject, which I'm not going to repeat here. Then clean up the problems that it left behind. You'll have to go through all of the configuration settings for plug-ins, PAC scripts, HTTP proxies, and DNS proxies and check that they are appropriately set. See this question for cleaning up DNS hijacking.

share|improve this answer

From my experience, it's likely spyware/malware/adware. I would suggest trying the following.

Use Malewarebytes, Spybot and Ad-Aware to scan for malware, spyware and adware. Use all three because some get things the other doesn't.

To be double sure it's not a virus, make sure you have the latest updates for your McAfee and also do an online scan at ESET.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.