New windows opening on their own!

[RobinC]

Hello,

For some reason when I search for something on google, I often get re-directed to pages selling medication or web hosting.

Malwarebytes hasn't found anything but there must be something causing this?

I thought I'd better post this here as it might be connected.

[MarkJ]

Wonder if your previous problem had altered either your Hosts file or your DNS Server entry?

Both of those are known activities of various malware. I would check your DNS settings are those which your ISP (or yourself) recommend first as that is nice and easy. If all seems well, then you need to look at the Hosts file (which can be found in various places, depending on the version of Windows you have, but most likely in system32\drivers\etc, which is in the root Windows folder

Mark

[RobinC]

Thank you for replying so promptly, Mark.

I'm a complete novice when it comes to computers so I'm not sure how to check my DNS settings.

[MarkJ]

Assuming you are using Windows,

Start > Control Panel > Network Connections

In Network Connections, choose your local connection and then select Properties, then choose Internet Protocol (TCP/IP) and again, select Properties.

You will now be looking at a box which has two "radio" buttons at the top - one says "Obtain and IP address automatically" the other allows you to enter your own settings. Firstly, check that either the "Obtain Automatically" button is checked or that the settings in the second box are correct if that one is checked.

Now, further down you will see the DNS server settings. Again, these will either be "Obtain DNS Server address automatically" or "Use the following DNS Server address"
This is the setting most likely to have been changed. You will need to know the DNS server settings which your ISP provided you with when you joined them (assuming you use the ISPs standard DNS server). They will have given you the info regarding your DNS server, so use their details if you have them. If not, then there are a number of options - you can obtain the details from the ISPs website or use an alternative DNS server (there are plenty of free ones out there, but they all have their pros and cons)

Basically, what the DNS server does is to convert your website requests - e.g google.com (with the www. bit in front) - to the numerical value used by the internet (the so called IP address, a series of numbers seperated by dots e.g 192.168.0.1)
When you enter your www. address, your browser first checks to see if the site is mentioned in your Hosts file and, if it is, it can get the IP address from there which is quicker. Otherwise, it uses the DNS server to look up the IP address for the site you want. This is a simplified version of course - you also have cache etc involved, but for a basic explanation, it is OK.

The Hosts file usually doesn't contain much - in most cases it will be just a very simple entry or two. You should have

127.0.0.1 localhost

or something similar. Nothing else should be there as a rule - so if you see other entries, let me know.

Mark

[RobinC]

Mark,

I'm using Windows Vista.

The IP and DNS are both on "Obtain automatically" (so I haven't touched them), the second box of each is empty.

As for the Hosts file, I have the following listed:

127.0.0.1 localhost
::1 localhost
91.215.180.170 www.british-genealogy.com

I put the Brit-Gen listing in there due to having trouble getting on here.

[MarkJ]

OK, at least that seems fine. The localhost entries (the first is IPv4, the second IPv6, but you don't need to worry about that!) are perfectly normal. The IP for Brit-Gen was because of the access issues the other day - again, no problem.

The only other easy thing I can suggest for now is to update your AV program and re-run both that and your Malwarebytes to see if they can find an issue. There could be something still left behind.

It is worth just keeping an eye on when the problem occurs - some DNS servers will direct you to a page which can include "offers" etc if the website you are looking for is not available for some reason. However, those sites usually state that they are being displayed because the website you requested was not available.

Mark

[RobinC]

some DNS servers will direct you to a page which can include "offers" etc if the website you are looking for is not available for some reason. However, those sites usually state that they are being displayed because the website you requested was not available.

That's exactly what seems to be happening, I thought that the standard "Page 404 not found" would be displayed though?

[MarkJ]

Ah, it varies, depending on how your ISP has set up the DNS server and other factors. They may have decided to earn some cash by popping up ads on the "Page Not Found" page - amazingly, some folks do actually click on ads which appear on their screen. You could use another DNS server, but these things are going to happen (unless you are really, really keen and actually decide to set up your own DNS server...!)
A 404 error would be displayed for example if you tried to go to a page on my server which doesn't exist - my server would send that. But if you mistyped the address for my server, then the reply will come from your ISPs DNS server.

Try this -

My server is at www.kernowyon.co.uk
There isn't a page at www.kernowyon.co.uk/nothing

If you go to the /nothing page, you should get a 404 error

Now, if you had mis-spelled my address and plonked in -

www.kernoyon.co.uk

you should get whatever your DNS server decides to send you. In my case, it was

Address Not Found


www.kernoyon.co.uk could not be found. Please check the name and try again.
The browser could not find the host server for the provided address.




* Did you make a mistake when typing the domain? (e.g. "ww.mozilla.org" instead of

"www.mozilla.org")


* Are you certain this domain address exists? Its registration may have expired.


* Are you unable to browse other sites? Check your network connection and DNS server settings.


* Is your computer or network protected by a firewall or proxy? Incorrect settings can interfere with Web browsing.

[RobinC]

When I clicked on www.kernoyon.co.uk, I got:

"Oops! Internet Explorer could not find www.kernoyon.co.uk
Suggestions:
•Go to www.*kernowyon.*co.*uk
•Go to kernowyon.*com
•Go to www.*kernowyon.*org.*uk
•Search on Google:"

In this morning's case, I searched Google for 32 inch tvs and tried to click a link to Amazon, which is where the page diverted, however I found Amazon on my favourites list and the page opened as normal when I searched for 32 inch tvs.

My computer is protected by Windows firewall.

[MarkJ]

Have you tried clearing your cache? It is possible that whilst your PC was infected you were being redirected to other sites when attempting to access a site. If we say that perhaps you tried to access Amazon whilst you had the problem, then you would be sent to some dodgy site or other and that would be cached as the Amazon site perhaps. Then, once the problem was removed, you attempt to go to Amazon, and your computer looks in the cache, finds "Amazon" (the dodgy site version) and uses that as the site.

Clear the Internet cache and see if that sorts things. That is under the tools menu on your Internet Explorer browser. Look for Internet Options, then under the General Tab, locate Temporary Internet Files and click the Delete Files button.

Mark