Inactive Google redirect and friends - check your router!

[stereoXJ]

Hey folks. I just signed up and can't reply to posts yet, but I'd like to chime in on the "google redirect" issue that apparently started showing up more and more in the last few days.

There are several rootkits in the wild that basically do the same thing - they change your DNS to 213.109.73.249 and 213.109.68.247. All DNS queries from your computer get resolved by these rogue DNS servers. Some websites resolve ok, some (like search engines) resolve to rogue IP addresses. Also, a lot of anti-virus and anti-malware sites do not resolve correctly, so you can't update your virus/spyware definitions.

Some of these rootkits can also change DNS settings in your router, if your router's password has not been changed from the factory setting. You will either need to reset your router and re-configure it or simply change the DNS servers back to the ones provided by your ISP. Don't forget to change your router's admin password.

Hope this helps someone....

 

[Bobbye]

Thank you for this contribution. You are correct. However, we would review logs from programs first and then use the DNS Flush and router reset if indicated. All rootkits aren't the DNS Changer malware.

We follow an organized process for determining if there is an infection and what it may be. We would then recommend the most appropriate actions.

This recommendation is not to be used for all 'google redirects'.