Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Intermittently, and not at the same time, computers connected the network will redirect to Stop-online-piracy.com (may not want to go there). The domain responds with the source:

<div id="Message">
ERROR: This web site encountered an error (40100), please notify your Technical Support.</div>

just an error, .nothing hidden there.

It is privately registered. Seems like a sham trying to impersonate a Cease&Desist. A Google search of the domain yield no references.

The other strange part is that right before it happened the internet connection gets really slow AND the wifi signal bar goes down. This signal bar could just be Windows 7's adding in connection speed into the task-bar icon. (or it could indicate something really interesting...) The wifi is using WPA2 if that matters. Not many Computers are plugged into an Ethernet so it's unknown whether or not it affects them.


edit: When I said it wasn't at the same time, I meant that not exactly the same, but all within a few minutes of each other. I has subsided now. Also is there anything I can do if/when it happens again? It seems like it comes in waves.

share|improve this question
    
When did you last do a proper virus and malware/spyware scan? –  John Gardeniers Mar 3 '11 at 2:33
    
besides the realtime, not since it started happening yesterday, currant running one now. –  Zak Mar 3 '11 at 2:39
    
A full scan yielded nothing with NOD32 –  Zak Mar 3 '11 at 18:00

2 Answers 2

Download Combofix and run it on the machines experiencing the issue. It sounds like you have a malware issue.

share|improve this answer
    
Why does everything people say about this program make it seem riskier that partitioning your hard-drive blindfolded? –  Zak Mar 2 '11 at 20:51
    
That's a great question. I personally use it without any reservation. It is far more effective than any other program I've ever used to remove malware. I have never once experienced an issue with it. To be honest, I've never heard people complain about it either. It's not a pretty program by any means; it runs in a blue DOS window, but it's a slam-dunk when it comes to effectiveness. –  pk. Mar 2 '11 at 21:34
    
could this really be the case if all the computers had separate login Credentials and it all happened in the same time frame? When I said it wasn't at the same time, I meant that not exactly the same, but all within a few minutes of each other. I has subsided now. Also is there anything I can do if/when it happens again? And lastly I ran the program and it hung at the restore point, and I was kinda wary about giving it so much power to delete things. I am running Eset NOD32 AV and spyware protector on this machine. –  Zak Mar 3 '11 at 2:18

Well I finally know the answer, recently It happened again, to a bunch of people on the network. But this time, for me the page was not blank. It was a proper cease a desist, Stating a number of items that were supposedly torrented by my computer; they were not however. It must be the fact that some other computers on the network were torrenting items and somehow the cease and desists targeted the entire network. It forced me to agree to resume use of my internet connection. Just figured I would leave this here In case it helped anyone else.

share|improve this answer
    
For the lolz... –  DanBig Apr 25 '11 at 14:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.