6

Brief background: I consider myself a relatively paranoid power-user, if not an absolute pro. I regularly update my AV and keep up with all the latest updates on my Windows 7 machine. But what happened today surprised me for the first time.

Today morning at around 13:30 India time, I opened www.google.com in my Firefox 32 browser. But instead, my browser forwarded me here:

WARNING!! POTENTIAL MALICIOUS SITE: http://demo.opera-mini.net/public

Tried with IE 11, the same result.

Then I did a ping www.google.com and browsed using that IP address instead. It worked and took me to Google India site. I then opened the .co.in instead of .com site, that too worked! I went to a vm inside VirtualBox (Ubuntu/Firefox) and browsed from there instead. That too worked!

At this point, I disconnected my machine from internet and ran a complete AV scan. It came up clean. Then I tried the only logical thing that occurred to me: Clearing the browser cache for google.com domain. I did it on IE and lo! it started working. On Firefox, I didn't have to do that either, it started working on its own (though I don't understand why).

After that brief anomaly, I faced no issues until now. So what do you hackers make of this situation? Could it be a malware issue or something from my ISP end?

  • Which type is your Internet connection? – Ulkoma Feb 10 '15 at 14:01
  • Its mobile broadband (dongle) – Prahlad Yeri Feb 10 '15 at 14:03
  • 4
    Could be a case of DNS poisoning and cached DNS entries. Disconnecting from the internet might have cleared some of those cache entries. – RoraΖ Feb 10 '15 at 14:52
  • 1
    It's mobile broadband configure your computer to use some trusted DNS resolvers like OpenDNS or Google's DNS. For some reason mobile carriers are very disrespectful in terms of net neutrality and I wouldn't be surprised if they poisoned your DNS records to advertise a mobile browser (that's what Opera Mini is). – user42178 May 7 '15 at 11:55
  • 1
    @PrahladYeri you know what's worse ? They install transparent HTTP proxies that alter content in transit, like compressing images for example. In my country I've seen someone complain they couldn't see new responses to a forum thread by just opening it (they had to explicitly press F5 again), and it was clear evidence such a proxy was installed and was tampering with the cache control headers. – user42178 May 7 '15 at 18:43
3

You're either behind a malicious proxy/VPN or your host file is effected. Most likely the latter.

On windows 8 you can check your hosts file here

C:\Windows\System32\drivers\etc\hosts

Remove any lines with strange IPs. Infact you can remove everything if you aren't running any cracked software or have routes setup for a web server.

This could also be DNS poisoning on your local network, so be sure that's secure too.

  • 1
    There was nothing in the hosts file, I already checked. However, this again happened a second time, and this time I opened the task manager to see what .exe processes were running. And sure enough I saw two Flash plugins at work! This was despite the fact that Flash was disabled in Firefox and IE. I immediately uninstalled Flash as I had no real need and that was the end of this. I'm never going to install Flash again! – Prahlad Yeri Feb 11 '15 at 15:03

protected by Community Jul 5 '15 at 13:00

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.