Home > Emerging Threats > “Wsearch.net/?unknown” Is it a new DNSChanger?

“Wsearch.net/?unknown” Is it a new DNSChanger?

As mentioned in my previous post, there has been a report about browser hijacking. However, as days goes by more and more Mac OS X users shares the same experience.

Unfortunately, this site serves unwanted pop-ups (Ads) although no malwares yet found.

So what’s happening here ?

1st of June, MozillaZine Forum user reported this incident and found his DNS search domain was set to “mygateway.net”. From the thread, they suspected that it was coming from the ISP (Rogers Cable).

A month after, another MozillaZine Forum user feels that the issue covers 3 possible source: 1) Zlob DNSChanger 2) DNS hijacking caused by SMC wireless routers 3) Rogers “service” hijacking URL searches

As more and more user experiencing this issue, I wonder if this is indeed related to Zlob’s DNSChanger. Unless someone can provide a DMG or URL for analysis, we can’t conclude this incident as new DNSChanger related activity.

  1. Rasputin's Dog
    September 22, 2008 at 5:12 am

    This is problem with SMC wireless router/modems. I am an Interent Support Rep and have seen this problem with customer and described on other sites. The problem is that the default search domain on these routers is set to mygateway.net. Changing this to a legitimate search domain is a work around for the problem, but I have seen no explaination for why the default serch domain is set to this. It has been reported for more than one ISP so it not something that just one ISP is doing.

  2. Methusela Cebrian Ferrer
    September 22, 2008 at 8:16 am

    Thanks for this info. Good thing that this issue is not related to any malware.

  3. John
    March 31, 2009 at 2:24 am

    THESE THINGS ARE PIECES OF GARBAGE!!

    I would do anything for my old TOSHIBA modem back!!

    DNS hijacking,etc……….

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: