Has my office network been hacked or tapped into? (Web pages sometimes not loading and then redirecting on refresh)

Question

Recently employees in my office (about 5 people) have reported that sometimes web pages can not load for no reason, but after pressing refresh button in the browser, it first shows 'Redirecting you to www.....' then the page loads normally.

This only started to happen this week and it has happened to all users (so I've ruled out spyware / virus on individual PCs.)

Could this be a man-in-the-middle attack? I.e. someone is intercepting all web requests and forwarding them onto the real server. If so how could you tell?

Network configuration:

internet --> |ADSL  |--> wireless router --> office PCs
             |modem |--> web server

Answer 1

If it occurs often enough, I would use Wireshark to examine the response that is causing the "Redirecting" message.

Answer 2

To find out what happens behind the curtains you can try Fiddler for a high level (http) view of the browser requests or Network Monitor for a more low level (ethernet) view.

Answer 3

Well crafted malware can infect All PC's on the network, so simply ruling it out using that logic is flawed.

See my "Alternate Method" in this link to scan ALL the PC's. Be sure to run the boot CD first.

Do a hard reset of the Router also.