Google and YouTube redirect problem

Question

Level 1

5 points

Google and YouTube redirect problem

Hi all,

For the last one month, everytime I want to visit Google or Youtube the browser is always will be redirected to 123.99huo.com. Currently I'm using Safari and Google Chrome, and both are having the same problem.
I've been trying to search for the solution on this forum, and I've tried OpenDSN by changing the DNS address but no luck.
I also had reset the Safari and cleared all browsing history, cookies on Google Chrome, but still no luck. I've tried to install new browser (i.e. Opera) hoping with the new fresh installed browser I would not experiencing the problem, but again still no luck.

Really appreciate if anyone could help me on this.

Cheers,

13" MacBook Pro 2.66Ghz, Mac OS X (10.6), 4 Gb RAM, 320 Gb-5400 rpm HDD

Posted on Dec 24, 2010 6:39 PM

Reply

Answer 1

barista7105 Author

Level 1

5 points

Dec 24, 2010 6:42 PM in response to barista7105

Forgot to add that I'm using Safari on my other laptop running on Windows 7, and experiencing the same problem.

Reply

Answer 2

Dec 24, 2010 9:46 PM in response to barista7105

Hi,

Try Google DNS instead of OpenDNS, instructions here.

http://code.google.com/speed/public-dns/docs/using.html

If that doesn't help, you may want to contact your ISP.

Carolyn 🙂

Reply

Answer 3

andyBall_uk

Level 7

20,516 points

Dec 25, 2010 1:12 AM in response to barista7105

Hi

you should check the dns numbers that your router/modem is using, since it's common to two computers.

Reply

Answer 4

barista7105 Author

Level 1

5 points

Dec 25, 2010 8:16 AM in response to barista7105

Dear all,

Thank you for your reply, unfortunately the problem still can't be fixed.
I've been using the DNS provided by my ISP, which the problem occurs. And I had changed it to Google DNS (i.e. 8.8.8.8 and 8.8.4.4), and still doesn't work.

Wondering whether it is a malware/spyware or virus.

Rgds,

Reply

Answer 5

andyBall_uk

Level 7

20,516 points

Dec 25, 2010 8:39 AM in response to barista7105

Hi

if you see it on two separate computers, over different operating systems - the problem must lie in the router or at your isp... unless you have some identical add-ons on each computer, which is unlikely over two OS's & at least three(?) browsers.

You've changed dns in the router/modem - yes?
use Network Utility from /Applications/Utilities/ to do a 'traceroute' for google.com or www.youtube.com & paste the results here.

Reply

Answer 6

barista7105 Author

Level 1

5 points

Dec 25, 2010 9:23 AM in response to andyBall_uk

Hi andyBall,

Yes, I have changed DNS in my Cisco router to be the same with DNS in my laptop.
Below is the traceroute result for google.com and youtube.com:
Traceroute has started…

traceroute: Warning: www.google.com has multiple addresses; using 74.125.235.16
traceroute to www.l.google.com (74.125.235.16), 64 hops max, 52 byte packets
1 192.168.1.1 (192.168.1.1) 1.625 ms 0.886 ms 1.177 ms
2 cyber-pppoe-3745.cbn.net.id (202.158.51.149) 6.588 ms 10.241 ms 17.501 ms
3 ip127-1.cbn.net.id (202.158.127.1) 17.090 ms 27.209 ms 10.936 ms
4 ip127-130.cbn.net.id (202.158.127.130) 20.488 ms 19.242 ms 15.737 ms
5 121.100.4.17 (121.100.4.17) 8.441 ms 26.746 ms 18.071 ms
6 121.100.5.5 (121.100.5.5) 30.520 ms 54.369 ms 39.412 ms
7 p15169.sgw.equinix.com (202.79.197.30) 41.759 ms 112.209 ms 135.374 ms
8 209.85.243.156 (209.85.243.156) 23.603 ms 26.593 ms 29.716 ms
9 72.14.233.107 (72.14.233.107) 36.735 ms 23.616 ms 19.106 ms
10 74.125.235.16 (74.125.235.16) 30.552 ms 26.232 ms 25.147 ms

Traceroute has started…

traceroute: Warning: www.youtube.com has multiple addresses; using 74.125.235.15
traceroute to youtube-ui.l.google.com (74.125.235.15), 64 hops max, 52 byte packets
1 192.168.1.1 (192.168.1.1) 3.951 ms 0.853 ms 0.792 ms
2 cyber-pppoe-3745.cbn.net.id (202.158.51.149) 21.059 ms 8.433 ms 23.378 ms
3 ip127-1.cbn.net.id (202.158.127.1) 15.879 ms 24.047 ms 29.074 ms
4 ip127-130.cbn.net.id (202.158.127.130) 17.546 ms 198.856 ms 193.202 ms
5 121.100.4.17 (121.100.4.17) 8.704 ms 7.544 ms 7.389 ms
6 121.100.5.5 (121.100.5.5) 29.632 ms 28.418 ms 27.152 ms
7 p15169.sgw.equinix.com (202.79.197.30) 21.028 ms 17.647 ms 32.564 ms
8 209.85.243.156 (209.85.243.156) 29.206 ms 83.132 ms 63.990 ms
9 72.14.233.107 (72.14.233.107) 60.197 ms 27.104 ms 31.748 ms
10 74.125.235.15 (74.125.235.15) 26.774 ms 22.045 ms 25.596 ms

Really appreciate your kind advise on what I should do next with above data?

Cheers,

Reply

Answer 7

andyBall_uk

Level 7

20,516 points

Dec 25, 2010 10:52 AM in response to barista7105

Hi

those look normal, & suggest that dns at least, is working ok; & that traceroute isn't being diverted as the browsers seem to be.

You get these redirects every time?
& if you enter 74.125.235.16 directly into the browsers?

Reply

Answer 8

barista7105 Author

Level 1

5 points

Dec 25, 2010 11:13 AM in response to andyBall_uk

Hi

Yes, I've tried entering 74.125.235.16 and the result still the same. I was directed to http://123.huo99.com/main4127.html

The same thing happened with youtube. And if I try to traceroute above website the result is "unknown"

Traceroute has started…
traceroute: unknown host http://123.huo99.com

Cheers,

Reply

Answer 9

andyBall_uk

Level 7

20,516 points

Dec 25, 2010 11:37 AM in response to barista7105

ok good, it's not dns then - 74.125.235.16 goes directly to google, so it seems likely that you're being diverted at the router/modem or upstream of that.

If a wireless router & separate router - have you tried bypassing the router & connecting by ethernet cable?
using another connection altogether- perhaps a nearby wireless hotspot or a neighbour's connection?

just trying to establish for certain whether or not the issue is on your computers.
---

If you use traceroute, remove the http:// & trailing / - like 123.huo99.com

Reply

Answer 10

barista7105 Author

Level 1

5 points

Dec 25, 2010 5:51 PM in response to andyBall_uk

andyBall,

Yes, I have bypass the router by connecting cable from my ISP modem to my MBP, still not working.

If I connect through other wifi network somewhere else (which I'm doing now at a cafe near my house), I can connect to Google and Youtube normally.
Btw, I tried connecting my blackberry phone through wifi network in my house, it can connect to Google and Youtube. So what could be wrong with my MBP and other laptop? I've tried to look for DNS on my blackberry but it didn't show anything, just the "Primary and Secondary DNS" name and it didn't show the address.

If the issue is with my MBP and other laptop, I should not be able to connect to Google and Youtube through any other wifi network too, isn't it? On the other side, if the issue is with ISP at my house, I shouldn't be able to connect to those sites with my blackberry?

Thanks,

Reply

Answer 11

andyBall_uk

Level 7

20,516 points

Dec 26, 2010 5:38 AM in response to barista7105

If the issue is with my MBP and other laptop, I should not be able to connect to Google and Youtube through any other wifi network too, isn't it?

I'd say so, yes - barring something rather unusual that behaves differently on a different connection.

On the other side, if the issue is with ISP at my house, I shouldn't be able to connect to those sites with my blackberry?

True; normally I'd say a blackberry likely uses its own dns, although we seem to have excluded dns by trying the ip address of google directly.It will have its own UserAgent of course, and something might be using that to recognise browsers.

We could mess around in Terminal & Safari trying to see exactly what's happening, but hey, it;s two separate computers, differing OS, and apparently even typing in the numeric address for google, led you to that chinese site... so I have to think it's upstream of the modem - although I'd reset that completely if you haven't already.

Reply

Answer 12

barista7105 Author

Level 1

5 points

Dec 26, 2010 7:30 AM in response to andyBall_uk

I just upgraded the firmware of my router, and still no luck.... The only left option is to remove Safari and re-install it through installation DVD.

Wish me luck.... And thanks a bunch for your great assistance here, I really appreciate it. I will update you with the result.

Cheers,

Reply

Answer 13

andyBall_uk

Level 7

20,516 points

Dec 26, 2010 7:37 AM in response to barista7105

I do wish you luck 🙂 yes, although you already tested Chrome & Opera & at least one Windows browser, right? - so I'm not sure where reinstalling Safari will go.

If you do reinstall, it's quicker to grab the latest Safari installer & skip the dvd route, use Pacifist from http://charlessoft.com/ to 'force' the install. This will replace Safari & several software 'frameworks' like webkit, webcore, javascriptcore which all come with Safari.

Reply

Answer 14

barista7105 Author

Level 1

5 points

Dec 26, 2010 8:09 AM in response to andyBall_uk

Has been reinstalled, and again, still no luck.....

Reply

Answer 15

Jan 13, 2011 12:01 PM in response to barista7105

This is a nasty piece of malwar/virus. I've had it in my network for a month and can not locate the source. Every website offering advice has only one thought in mind - BUY MY AntiVirus. I am sick of it.

What I do know is that it starts with the disappearance of the "Google News" logo and graphics under "Spotlight Videos". Then it takes over the Business link "Finance" frame for the DOW chart. Eventually, after several hours, it will take over the entire browser completely - so it apparently works its way up the DOM.

This virus acts like a DNS server looking for Google requests.

It also will disappear over night or from inactivity only to resume its annoyance the next day.

I would like some REAL clues on this virus. It will make a presence in the registry ZONEMAPS and MRu folders under SearchAssistant - removing them does nothing. It keeps coming back.

Thx -

Reply