One Particular Url Takes Me To The Wrong Place

tmdowling · Jun 28, 2007

Could this be some sort of very subtle infection?

A friend has just created a new subdomain of his existing site. If I go to http://www.newsubdomain.existingsite.com, I see the host's generic "new site will be available soon" message. BUT if I go to http://newsubdomain.existingsite.com (that is, the same address, but without the leading "www."), I wind up on the site for some perfectly innocent-looking automotive specialty parts distribution company.

(It looks like they mostly sell to retailers, not the public, so it makes no sense at all for them to be complicit in this apparent hijacking, although someone could have put something malicious on their site, I guess.)

My computer is a laptop running WinXP Pro. AVG, Spybot and Ad-aware scans find nothing amiss. The machine has no other symptoms of any kind of infection, afaict.

This problem shows up regardless of whether I use Firefox or IE, but another machine on my home-network does NOT have this problem, so I know it's not a case of my ISP's DNS cache having been poisoned. I did run ipconfig /flushdns from a command prompt; that didn't fix it.

Could this just be some simple corrupted record somewhere, or must we conclude a malware infection?

TIA!!!

chaslang · Jun 28, 2007

You may have your default prefixes setup wrong. Run this Using GetRunKey and then attach the requested log here.

See: HOW TO: Attach Items To Your Post

tmdowling · Jun 28, 2007

Interesting tool. The parts I could understand looked clean, but there was plenty I didn't understand. I hope you can find something useful here.

Thanks!

chaslang · Jun 28, 2007

Your log does not show any problem with the Default Prefix setting which could cause problems like this. If this does not happen for anything else, it is probably not malware. For example, did you try:

www.google.com and google.com to see what happens.

I do notice an unexpected setting in your log though. Why is the below setup?

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]
"Dnscache"=dword:00000002

tmdowling · Jun 28, 2007

chaslang said: ↑

Your log does not show any problem with the Default Prefix setting which could cause problems like this. If this does not happen for anything else, it is probably not malware. For example, did you try:

www.google.com and google.com to see what happens.
Click to expand...

Yep -- as my subject line says, it's just this one URL, as far as I can determine. For all other sites I've tried, the www version of the address takes me to the same place as the non-www version.

chaslang said: ↑

I do notice an unexpected setting in your log though. Why is the below setup?

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]
"Dnscache"=dword:00000002
Click to expand...

Eh. I'm pretty sure that reflects a change I made in MSConfig when messing around trying to correct, or at least diagnose, the problem. I've put it back.

SO, bottom line: You don't know the reason for the problem, but you don't think it's anything malicious? Sigh. Do you suggest I go through all the steps in the MajorGeeks Malware Removal Guide, so that I can run a Hijack This report? Or ... anything else?

Thanks for your efforts!

chaslang · Jun 29, 2007

tmdowling said: ↑

SO, bottom line: You don't know the reason for the problem, but you don't think it's anything malicious?
Click to expand...

That's correct. Malware rarely would do something like this that affects only one site and if it did do it, it would be big name, high-access site. You could try doing the below just to see if it has any effect.

Download HostsXpert and then follow the below steps.

Unzip HostsXpert.zip
[*]It will create a folder named HostsXpert in whatever folder you extract it to.
[*]Run HostsXpert.exe, click Restore Microsoft's Hosts File and then click OK.
[*]Click the X to exit the program

tmdowling said: ↑

Do you suggest I go through all the steps in the MajorGeeks Malware Removal Guide, so that I can run a Hijack This report? Or ... anything else?/quote]It's up to you. I really don't expect we would find anything causing this particular problem. We may find other issues, but your problem seems to unique and too isolated to be malware. Look at it this way....you have nothing to lose.
Click to expand...

Log in or Sign up

One Particular Url Takes Me To The Wrong Place

tmdowling Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tmdowling Private E-2

Attached Files:

runkeys.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tmdowling Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member