0

I am always getting redirected to some page that shows ads, on several webpages (Microsoft, Linkedin, Yahoo). However, Facebook and Gmail are working fine. I deleted all cookies, but I am facing the same issue.

What type of attack is this? How to fix it?

Note: I'm having the same issue with all browsers.

(Click to enlarge)

Tamara Wijsman
  • 57,881
talktopk
  • 1

3 Answers3

3

This seems to me like a virus. What anti-virus do you use and is it up to date and used?

soandos
  • 24,600
  • 29
  • 105
  • 136
Xavierjazz
  • 8,218
1

I can think of at least nine ways to achieve this effect, off the top of my head:

  1. A malicious plug-in.
  2. A malicious proxy auto-configuration script.
  3. A change to the proxy settings that directs all requests to a proxy HTTP server that is under the control of the advertiser.
  4. A whole list of new entries in your hosts file pointing to a content HTTP server that is under the control of the advertiser.
  5. An ISP that requires authentication before letting IP traffic go anywhere other than a network controlled by the ISP.
  6. A change to the DNS client library settings that directs all requests to a proxy DNS server that is under the control of the advertiser.
  7. A problem on some other machine that your machine relies upon for proxy DNS service, proxy HTTP service, or IP connectivity.
  8. A malicious DHCP server on your LAN handing out leases that have bogus DNS proxy or HTTP proxy settings.
  9. A malicious host on your LAN that has been registered as wpad, and that is handing out bogus PAC scripts.

There's not enough information in your question to eliminate any of these. I'm discounting the possibility that you're living in a country whose government decides what companies on Internet its citizens can talk to, on the grounds that you wouldn't need to ask about that. Malice for profit is more likely than malice for ideology, in this case.

First, remove the malware/machine that did this. SuperUser has a general question on this subject, which I'm not going to repeat here. Then clean up the problems that it left behind. You'll have to go through all of the configuration settings for plug-ins, PAC scripts, HTTP proxies, and DNS proxies and check that they are appropriately set. See this question for cleaning up DNS hijacking.

Community
  • 1
JdeBP
  • 27,556
  • 1
  • 77
  • 106
0

From my experience, it's likely spyware/malware/adware. I would suggest trying the following.

Use Malewarebytes, Spybot and Ad-Aware to scan for malware, spyware and adware. Use all three because some get things the other doesn't.

To be double sure it's not a virus, make sure you have the latest updates for your McAfee and also do an online scan at ESET.

CharlieRB
  • 23,021
  • 6
  • 60
  • 107