Member Avatar for Agita

All of my browsers (firefox, IE8, Flock) go only to strangeUSA . com

the address bar displays google or daniweb for example but the page displays strangeUSA dot com.

HijackTHIS shows nothing at all strange. Spybot shows nothing (newest one) Nor malwarebytes

Have reset my winsock and ip configuration using netsh int and winsock catalog via command line.

I'm halfway knowledgeable on this but for now I'm stumped.

Any help would be appreciated! thanks

  • 2 Contributors
  • 2 Replies
  • 99 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by Agita

Dani AI

Generated

already tried hosts-file inspection, Spybot/Malwarebytes scans and winsock/IP resets, and correctly asked about the hosts file. The symptom — typed addresses showing the correct text in the bar but loading strangeUSA.com while search-plugin requests (Yahoo) work — points to one of three places: DNS or router-level redirection, a system proxy/LSP or a browser-level hijack that survives the usual scans.

Suggested diagnostic checklist to isolate the fault:

  • Compare DNS resolution using the built-in resolver vs a known public DNS. Example commands:

    nslookup example.com
nslookup example.com 8.8.8.8
tracert example.com
ipconfig /all

    If the default resolver returns the strangeUSA IP but the public DNS returns normal IPs, the problem is upstream (router or ISP DNS). If both resolvers return the strangeUSA IP, consider local compromise.

  • Verify whether the issue is network-wide: test the same site from another device on the same LAN and from the PC on a different network (smartphone tether). If other devices show the same redirect, investigate the router.

Checks and remediation steps not yet mentioned in the thread:

  • Inspect system and browser proxy settings (Internet Options -> Connections -> LAN settings; Firefox/other browser network settings). Clear any unexpected proxy entries.
  • Start browsers with extensions disabled or in their safe mode; reset search providers and remove unknown toolbars.
  • Log into the router admin page and confirm DNS settings and firmware integrity. Change the router admin password and consider factory-reset + reconfigure if DNS looks tampered.
  • Use a second-opinion rootkit/boot-time scanner if a persistent redirect is suspected (rootkits can hook network stacks).

Preserve outputs from the nslookup/tracert/ipconfig checks as evidence for the next troubleshooting step. These will clearly indicate whether the redirect is happening on the PC, the router, or at the DNS level.

Recommended Answers

All 2 Replies

Member Avatar for HoustonIT

Hack you checked your HOSTS file?

Member Avatar for Agita

Yes i have the only thing there is the default localhost and 3 or 4 blocks that i have added myself a while back

sorry I forgot to mention that.

----NEW---
I can surf by going to the yahoo plugin in the mozilla built-in search
even get here. (daniweb)

But any typed in address goes to that page but displays strangeusa
(google plug-in does this as well)

yahoo is the only thing that worked

-thanks

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.