Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Upon logging into my OpenDNS dashboard, I got this happy message:

Malware/Botnet Activity Detected
Activity    Label    IP               Last seen
Malware     Home     107.2.178.118    Sep 9, 2012, 12:06am MDT

Here are the stats:

Rank    Domain                    Reason     Requests
1       js.tongji.linezing.com    Malware    2

From what I gather, this indicates that I visited a website at some point this morning that had been infected with a script of some kind which initiated the DNS lookup. I get the impression it's not anything that's installed on my machine, which would explain why Microsoft Security Essentials didn't detect anything.

I also understand that the DNS lookup could have been made by any device on my network that's using OpenDNS and there's no easy way to figure out which. But, even if it happened on another device, it sounds like there's nothing I can do about it but be more careful about the websites I visit.

Sound right? Or could one of MY devices be infected?

share|improve this question

migrated from unix.stackexchange.com Sep 9 '12 at 21:52

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems..

    
This might be on the wrong site. Should I move it to Stack Overflow or something else> –  Koveras Sep 9 '12 at 19:44
add comment

1 Answer 1

up vote 2 down vote accepted

What it indicates is that something on your network issued a DNS request to that DNS name.

You are correct in saying that it is not telling you which device on your network has done this. Assuming you are a user with a standard NATted residential ISP setup, there really isn't a way it can with the standard DNS protocol.

While no antivirus is 100% foolproof, it seems to me that it's more likely that OpenDNS is intercepting the lookup to this site because the site itself may be infected, and that visiting the site may cause an exploit to occur that may try to infect your system.

Possible situations you may be in:

  • You may be actually infected with something attempting to contact this domain name.
  • You may have tried to visit a website, and the website attempted to redirect you to this address.
  • You may have visited a website that sported compromised ads by an ad provider, or a website that was compromised and attempting to redirect you to this domain.
share|improve this answer
    
Any chance it could be a bad Firefox extension? I have a ton of those. –  Koveras Sep 9 '12 at 23:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.