random 503 errors and redirects to wsearch.net

[sdfs]

I'm starting a thread here in the hopes that someone can help figure out a problem a lot of people are having with random 503 error messages and redirects to wsearch.net.

The issue is being discussed in some depth on a number of other tech forums.
[Only Registered and Activated Users Can See Links. Click Here To Register...]
[Only Registered and Activated Users Can See Links. Click Here To Register...]
[Only Registered and Activated Users Can See Links. Click Here To Register...]

The behaviour is different than that ascribed to DNSchanger. It appears to happen only with Rogers wireless users with SMC modems. Traffic is randomly redirected to either a 503 page or a wsearch.net page. (DNSchanger apparently redirects to all sorts of other pages.)

It is not a Firefox bug, as it also appears in Safari and IE.

It does not seem to be DNSchanger. I have run a scan for that trojan on my Mac, with clean results, and besides, the redirects don't match the described activity of DNSchanger.

It is not isolated to Macs. It has also been documented on Windows machines, in both XP and Vista.

It is not a Google hack, as some have suggested, because the wsearch.net redirects are also happening from embedded hyperlinks in non-Google web pages.

Here's what we "know":

So far, only people operating on Rogers wireless SMC modems have reported the problem. (Not including those with DNSchanger, which is a different group, with a different problem.) Some people are speculating that it has something to do with factory pre-set configurations on Rogers' wireless modems, made by SMC. In fact, so far, that modem is the only common denominator we can find.

It always seems to be random. A link will be "bad" one minute, then accessible ten minute later.

It almost always hijacks searches conducted when a single word is put in the URL address bar without HTML tags.

The 503 errors and the wsearch.net redirects appear to be caused by the same thing. But then, there is a partial fix explained here, for eliminating the 503 errors, but not the wsearch redirects.
[Only Registered and Activated Users Can See Links. Click Here To Register...]

If anyone here can shed any light, it would be greatly appreciated.

Thanks!

[Pancake]

This looks like your problem.....

[Only Registered and Activated Users Can See Links. Click Here To Register...]

[sdfs]

Nope. If you read my whole post you'll see that we know already that it is not DNSchanger.

[sdfs]

Okay folks, here is a fix for this problem.

NOTE: This is not a fix for the trojan called DNSchanger, or its variant called zlob. (If you think you may have DNSchanger, you can download a scanning app here: »[Only Registered and Activated Users Can See Links. Click Here To Register...])

This is a problem that appears to be isolated to SMC wireless modems and has nothing to do with DNSchanger. It seems some SMC modems, on various ISPs, are configured to redirect searches to wsearch.net pages. (DNSchanger will redirect you to all sorts of other pages.)

SYMPTOMS:
1) Links in Google search results randomly redirect to wsearch.net pages or 503 Error pages.
2) Hyperlinks in non-google web pages randomly redirect to wsearch.net pages or 503 Error pages.
3) Single-word entries, or other non-HTML entries, in the URL address bar redirect to wsearch.net pages or 503 Error pages.

(We think all the 503 Errors may be a result of overload on the wesearch.net server due to all the redirects.)

If you have an SMC wireless modem and are experiencing some or all of these problems, here is the fix.

In a browser window, visit the SMC modem page: »192.168.0.1/login.asp

Login as follows
Username: cusadmin
Password: password

From the sidebar menu, choose LAN.

Notice on the screen that appears that the "Domain Name" field has been preset with mygateway.com. Change this to one of the following OpenDNS IPs: 208.67.222.222 or 208.67.222.220

Click "APPLY" and you will see a prompt warning that your modem will have to reboot. Click "OK" on the prompt to reboot the modem.

When your modem reboots (about 30 to 40 secs) all the problems *should* be gone.

(NOTE: If you reset you modem, this will restore the wsearch.net Domain Name default. Something you probably don't want to do.)

[Mobo]

Pancake sent you to a link in regards to the Zlob trojan..

[sdfs]

It's not zlob.

Also, it's been brought to my attention that this isn't exactly a "fix" but more of a "work around". Semantics, but true. It still gets results.

[hmaren]

I had the SMC modem that was causing the redirects. My provider just changed to another, non-wireless modem, to no avail. It seems as though whatever DNS changing method the SMC modem used, it installs itself on the computer itself, so that the WSEARCH.NET redirect remains.
Any thoughts??

[sdfs]

Originally Posted by hmaren

I had the SMC modem that was causing the redirects. My provider just changed to another, non-wireless modem, to no avail. It seems as though whatever DNS changing method the SMC modem used, it installs itself on the computer itself, so that the WSEARCH.NET redirect remains.
Any thoughts??

Can't say anyone else has reported similar problems. Is the new non-wireless modem an SMC?

What system are you working on?

Are you being redirected to pages other than wsearch.net? If so, you probably have DNS changer or zlob on your system.