How to remove the dlinksearch browser search hijack

For the last few weeks all the machines on my home network are having the same problem whilst browsing the internet. When the user enters an invalid URL in the browser address bar, instead of the default browser behaviour, the request is sent to http://www1.dlinksearch.com/. As far as I can tell this is all machines and all browsers.

It is so consistent I am wondering whether it has anything to do with our router. We use a DLink DIR-655 router so maybe the clue is in the name :)

Anyhow, I cannot figure out how to disable/remove the offending behaviour. I've checked hosts files, spyware, AV etc. etc. Anybody have any ideas?

Paul

P.S. Apologies if this is not the right place to ask this type of question. I'm a bit stuck

Bish

Posted 2010-09-26T19:25:13.370

Reputation: 403

Possible duplicate of How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC?

– bummi – 2016-03-08T08:08:27.757

Answers

Uncheck Advanced DNS in the router internet setup. This will take care of it. I had this problem with my DLink router before.

andrew

Posted 2010-09-26T19:25:13.370

Reputation: 186

This fixed the issue for me. More background info: http://forums.mozillazine.org/viewtopic.php?f=9&t=1472515

– Mercer Traieste – 2010-12-28T20:50:06.910

3I had this issue with my DIR-655 and unchecking the Advanced DNS setting in Setup -> Internet -> Manual Internet Connection Setup fixed it. Though it did take a few minutes for the old DNS records to expire. – Richard Marskell - Drackir – 2011-05-17T14:04:42.760

1Worked for me! But... now I have Time Warner's DNS hijacking page. :/ – Joseph Lust – 2012-05-28T18:46:27.730

On my Dir-645, the advanced DNS settings was found under setup > parental control (after an hour of hide and seek)

koltr

Posted 2010-09-26T19:25:13.370

Reputation: 11

If this is just internet explorer, you can go to Tools > Internet Options or Internet Options in Control Panel.

From here, go to the advanced tab and click the Reset button.

alt text

This should fix it, but if you are still having the problem, please write in comments and I will update with the registry way of overwriting this setting - however just doing a reset is a much easier solution!

William Hilsum

Posted 2010-09-26T19:25:13.370

Reputation: 111 572

Thanks for the info but this affects all browsers. In the house we use Opera, Chrome, Firefox, IE and Safari. All are doing the same thing. Just on my machine I use Opera, Firefox and Chrome every day and they all re-direct to the pesky dlinksearch nonsense. – Bish – 2010-09-26T19:43:32.583

@Bish - I got it wrong, I googled it and it looks like it is a proper malware attack - check your hosts file at c:\windows\system32\drivers\etc\hosts and make sure that there are no malicious entries there. – William Hilsum – 2010-09-26T21:29:40.470

It looks like something is serving a wildcard DNS record on .com. It could be your machines (because of malware), your router or your ISP. You can easily check if it's your machines by booting one from a Linux live CD. If it's your ISP, some routers are able to ignore wildcard replies (I have no idea if your model can); or you can use an alternative DNS server such as Google (assuming you trust them more than your ISP) or OpenDNS. As for your router, it's a tempting possibility given the name of the site you're redirected to, but routers don't normally change settings by themselves: did you reconfigure it or uprade the firmware recently?

Gilles 'SO- stop being evil'

Posted 2010-09-26T19:25:13.370

Reputation: 58 319

I would set the router's DNS to a site like OpenDNS, and I would ensure the machines are set to get their DNS settings via DHCP or set the machine's DNS setting to OpenDNS. If the router's DNS looks like it was messed with, some bad software know the default passwords for routers and could have changed it. If you don't already I would make sure the password to the router is not default or easy to guess.

I've had spyware change a machine's DNS, but the fact it is happening on all machines makes me wonder if it is the router.

Scott McClenning

Posted 2010-09-26T19:25:13.370

Reputation: 3 519

Something got into your router and changed the dns server most likely, do a hard reset of the router and then change the password to something strong. Also check for a firmware update for the router and apply it as soon as possible.

Moab

Posted 2010-09-26T19:25:13.370

Reputation: 54 203

Andrew's answer also fixed it for me.

My symptom was that my iphones wouldnt connect to wifi. I kept getting the dlinksearch (log in) page.

Also, on the pc's (wired connection) on my network, any attemp to go to an apple.com page also led me to the dlinksearch page.

tony

Posted 2010-09-26T19:25:13.370

Reputation: 1