Web Browsing Problem "domain for sale error"

Are you sure you aren't being redirected to another domain that is actually for sale? It is possible that you had your browser hijacked.

Looking at the practically errorfree typed question, I exclude dyslexia, so I suggest to check the system for spy/mal ware, it looks as if you are "rerouted" when you type a site adress...

will try thanks.

Greetings, tn4712ee !

I agree with the other experts that you are being redirected. If you are going to the sites from Google Search or other search engine, the URL in the Search could be redirected.

If the problem is from your computer:
1. Use the following scanners to find and remove the adware.

Ewido
http://www.ewido.net/en/
or
Spy Sweeper
http://mysite.webroot.com/forms/Infoworld
or
SpyBot S&D searches your harddisk for so-called spy- or adbots;
http://security.kolla.de/
or
Adaware
http://www.lavasoftusa.com/software/adaware/

2. Some shopping and porn websites redirects links to their websites using your HOSTS file. Do a search for the HOSTS (without extension) file and remove the entry.

HOSTS file is located in C:\WINDOWS\SYSTEM32\DRIVERS\ETC. It is a hidden file, so you need to unhide hidden files to see it. Go to any folder and select Tools > Folders Options > View. Check "Show hidden files and folders". Click OK.

3. If still no joy, download HijackThis

http://www.majorgeeks.com/download3155.html

Run the program and you will find many entries. Most are OK. Post the log at http://www.hijackthis.de/ and click Analyse, Save.  Post a link to the saved list here.

Best wishes!

Open Add/Remove Programs (Start > Settings > Control Panel). Find something related to the links u received (unwanted/strange programs) and remove them.

This could also be an attack to redirect your browser using DNS settings.

Check that they are set to "obtain automatically" (if you have not configured them yourself of course).

In windows XP open up the 'network connections' from control panel.
Select the 'dial up' or 'Lan or high-speed internet connection' item by double clicking it.
The new dialog box has a button called 'Properties' - click it.
This will get you yet another, new dialog box this time with tabs.
What you are looking for is a tab that contains the following - 'Internet Protocol {TCP/IP}' with a tick in front of it.
Select it (turns blue) and the click on 'Proporties' - you will then get a new dialog box.
This dialog box lists the proporties for TCP/IP and may have 'Use the following DNS server addresses' with the radio button checked - the address is the redirection.
What you actually want is to select the other button - 'Obtain DNS server address automatically' - this will allow your ISP to take care of any redirections.

The DNS server for our location currently is a Novell box, we are getting ready to switch to a new 2003 box.  Funny enough this is happening to PC still on the Novell network not the AD domain.

tn4712ee, did you try any of the propose solutions above?

I did, I am still having the same problem.  Network settings are fine, there is no detectable spyware on the PC's having this issue.

tn4712ee, I like to see your HijackThis log.

Logfile of HijackThis v1.99.1
Scan saved at 3:22:39 PM, on 1/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\Alert\ALERT.EXE
C:\PROGRA~1\APC\POWERC~1\agent\pbeagent.exe
C:\PROGRA~1\APC\POWERC~1\server\PBESER~1.EXE
C:\Program Files\CA\SharedComponents\BrightStor\CADS\casdscsvc.exe
C:\Program Files\CA\BrightStor ARCserve Backup\msgeng.exe
C:\Program Files\CA\BrightStor ARCserve Backup\Catirpc.exe
C:\Program Files\WatchGuard\wsm8\wfs\controld.exe
C:\Program Files\CA\BrightStor ARCserve Backup\casmrtbk.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Ixia\Endpoint\endpoint.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\WatchGuard\wsm8\apache\bin\apache.exe
C:\Program Files\WatchGuard\wsm8\apache\bin\apache.exe
C:\Program Files\CA\BrightStor ARCserve Backup\asalert.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Novell\GroupWise\Notify.exe
C:\PVSW\Bin\W3DBSMGR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\WatchGuard\wsm8\wbserver\bin\wbserver.exe
C:\Program Files\WatchGuard\wsm8\wfs\AppMngr.exe
C:\Program Files\WatchGuard\wsm8\fsm\bin\fsm.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\Documents and Settings\admin\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluevalleyrec.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise\Notify.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\Bin\W3DBSMGR.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1121718604687
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB9311CB-CFEC-4FFD-A306-CA64FB777F8C}: NameServer = 192.168.0.1
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Alert Notification Server - Computer Associates International, Inc. - C:\Program Files\CA\SharedComponents\Alert\ALERT.EXE
O23 - Service: APC PBE Agent (APCPBEAgent) - APC - C:\PROGRA~1\APC\POWERC~1\agent\pbeagent.exe
O23 - Service: APC PBE Server (APCPBEServer) - APC - C:\PROGRA~1\APC\POWERC~1\server\PBESER~1.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: CA BrightStor Discovery Service (CASDiscoverySvc) - Computer Associates - C:\Program Files\CA\SharedComponents\BrightStor\CADS\casdscsvc.exe
O23 - Service: CA BrightStor Message Engine (CASMsgEngine) - Computer Associates - C:\Program Files\CA\BrightStor ARCserve Backup\msgeng.exe
O23 - Service: CA Remote Procedure Call Server (CATIRPC) - Computer Associates - C:\Program Files\CA\BrightStor ARCserve Backup\Catirpc.exe
O23 - Service: WatchGuard Log Collector - WSEP (controld_service) - Unknown owner - C:\Program Files\WatchGuard\wsm8\wlserver\..\wfs\controld.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe
O23 - Service: Iap - Dell Inc - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Ixia Performance Endpoint (IxiaEndpoint) - Ixia - C:\Program Files\Ixia\Endpoint\endpoint.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: WatchGuard WebBlocker Server (wbserver_service) - WatchGuard Technologies, Inc. - C:\Program Files\WatchGuard\wsm8\wbserver\bin\wbserver.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: WatchGuard Log Collector - WSM (wlserver_service) - Unknown owner - C:\Program Files\WatchGuard\wsm8\wlserver\..\apache\bin\apache.exe" -k runservice (file missing)
O23 - Service: WatchGuard Management Server (wmserver_service) - Unknown owner - C:\Program Files\WatchGuard\wsm8\wmserver\..\apache\bin\apache.exe" -k runservice (file missing)

tn4712ee,

Your HijackThis log looks fine.  Looks like you are being redirected.

1. Clear your DNS cache.  Go to Start > Run and type CMD
and hit OK.
At the command prompt, type ipconfig /flushDNS
and hit OK.

2. If no joy, check if your PC is blocking the site.  Do a search for HOSTS file and open it with an editor like Notepad. Delete any line that has the redirected site in it.

HOSTS file is located in
Windows XP      =      C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K     =     C:\WINNT\SYSTEM32\DRIVERS\ETC
Win 98/ME     =     C:\WINDOWS

It is a hidden file. Go to any folder and select Tools > Folders Options > View. Check "Show hidden files and folders". Click OK.

3. If you are using Internet Explorer, check if the site is restricted or blocked.  Go to Tools > Internet Options > Security. Hightlight Restricted Sites and see if the blocked site is located there.

Also under Content tab > Content Advisor, check if the site is restricted there. Remove it.

4. If you are using Google search to go to Microsoft pages, the link in Google Search could be hijacked. What link did you click on to go to Microsoft page?  You need to let Google know of the problem.

1. Did not affect it.
2. I actually already deleted the host file hoping that would work.
3. Nothing is restricted here.
4.  Not clicking a link, going direct to websites that are being re-directed.  Not just microsoft.com but other sites like kcstar.com.  It is random and will typcially rotate the site it is re-directing.

This problem is becoming very troublesome.

Try to use Microsoft Windows Defender:

http://www.microsoft.com/athome/security/spyware/software/default.mspx

Go to: Tools > Software Explorer.

Browse: Startup Programs, Currently Running Programs and Network Connected Programs.

At least, I found active spywares using Windows Defender: https://www.experts-exchange.com/questions/22122938/msrtmon-exe-and-svcmon-exe.html and removed the spywares using Remove feature from Windows Defender.

Already tried, nothing there either.

Strange. There's no any info about the "this domain is for sale" 's provider?

Below is a sample of what I may read:



www.msn.com   
 
 
The owners of the domain name msn.com are accepting offers from interested parties willing to obtain ownership rights over the domain name. You may learn more about how to place your offer by clicking HERE.    
 
   
 
www.msn.com   
 
 

The owners of the domain name msn.com are accepting offers from interested parties willing to obtain ownership rights over the domain name. You can place your offer by filling out the form below.
This is a good faith offer. If you believe that your rights are violated please read the disclaimer

How to make offer

Fill out the form below.
Receive an e-mail with a unique web link
Click on the link and confirm your bid. You will be also asked about the executional details of the transaction.
Your proposal will be immediately passed to the owners of the domain name. After your offer will be reviewed, you will receive additional information or escrow transaction will be initiaited.
Valuation of domain name can change rapidly in current market situation and therefore there is no fixed price on this name. Owners will consider your offer and they have option either to accept it or send counteroffer. Please try to send serious proposals in order to speed up negotiations . Offers under $400 US will not be reviewed and no counteroffer will be sent.
Sales Process.

As soon you succesfully negotiated on domain name (or your offer was accepted), you will receive e-mail from escrow with transaction details and further instructions. Generally, we recommend use of www.escrow.com an independent third party transaction management service. The process of domain name transfer at Escrow is simple: Seller registers at escrow.com web site and initiates a domain name transfer transaction. Buyer accepts the terms of the transaction and pays the full amount of sale to the escrow account via chosen payment method. Upon securing funds escrow.com instructs the seller to pass the domain name to buyer. Buyer receives control over the domain name and notifies escrow.com. Escrow.com then releases funds to the seller.

If agreed price on domain name exceeds $1,000 US, escrow fees are to be covered by Seller. Otherwise, Buyer is responsible for escrow fees (escrow fee calculator)

If you are unable to proceed using escrow services, it is possible to use sedo.com escrow service.

We can also accept direct payment via bank wire transfer or credit card.

Before proceeding to placing your bid we strongly suggest you to read our FAQ.

If you are going to choose Escrow Transfer, please also read:

Escrow.com Domain Name Transfers FAQ
Customer Support for Escrow Services

To place your offer please fill out the form below.

   
Your offer for domain name:  msn.com  
Your offer (US$) *  
 
First name *  
 
Last name *  
 
Company name *  
 
Your e-mail address *  
 
Country *  
 
Phone (including international code) *  
 
Fax (including international code)
 
 

It is important to make sure that your SPAM filter will not block incoming e-mail confirmation letter or turn it off before submitting this form. Otherwise, you will not be able to confirm your offer.
   
 
 I placed my bid and confirmed it on your site. When will I receive e-mail from escrow or your reaction on my offer?
In most cases you will receive it within 2-3 business days. If you suspect that your offer did not reach us, feel free to resend it or contact us.
 
Do you recommend choosing escrow option?
Indeed, we recommend to proceed via escrow. It is safe for Buyer, provides various payment options (credit card, check or money order, bank transfer) and you don't have to cover any additional fees. However, if you can not pay via escrow, you can always pay directly to our bank account.
 
Will I receive full and sole control over the domain name in the end of the transaction?
Yes, you will. You and only you will be able to change owner, administrative, technical , billing contacts, nameservers. . No third party will have control over your domain.
 
How do you pass control over the domain name to me?
We will send you authentication information along with the instructions how to modify the domain name record.
 
How soon will I be able to use the domain name for e-mail, web site etc.?
First you will have to set up nameservers for this domain. Typically it can be done by purchasing web/e-mail hosting services from the hosting provider. Your hosting provider will instruct you what nameservers to use to make it all working. Then you must "redelegate" the domain name, i. e. change its nameservers. In about 48 hours after that your domain must be working for you.
 
How will I renew the domain I bought?
You will be able to renew domain name within current Registrar or your preferred one.
 
Do you provide web hosting or e-mail hosting?
No.
 
Do you provide consulting services on domain names?
Yes. We can do it for a reasonable fee (from US$200).
 
 
 
www.msn.com   
 
 
Intellectual property issues

This domain name was acquired for bona fide commercial use. The owner intends to avoid infringements of third parties' intellectual property rights and interests and take measures by all means reasonably assumed to do so.

If you have rights and legitimate interests in this domain name, you are obliged to inform the owner using its contact information in WHOIS. Please provide all the relevant details about your registered trademarks or other intellectual property, if any.

If you have reasonable and good faith basis for a claim, the domain name will be transferred to you in exchange for documented out-of-pocket costs directly related to the domain name.

The owner believes that the procedure denoted above is sound, reasonable and constitutes a fair business practice. To the contrary, disregard of this procedure constitutes bad faith.

The domain name may be registered in the name of a company providing private (proxy) registration services. Actual holder of rights in this domain name may be different from the person denoted in WHOIS.


   
 
 
 

 
   
 

When I click on www.msn.com link, it goes directly to the MSN website.  Download Firefox and see if you can get to MSN website with Firefox
http://www.getfirefox.com

Me too, I can goes directly to MSN website. Could it your ISP problem?

When you type in http://www.msn.com and you get the page you described above, is the address in the address bar still http://www.msn.com?

What about the links on that page? When you view the address of the link, what do they point to?

Yes the address bar displays msn.com.  Firefox does not make a difference.  The links do not point ot a web site.  After 4 days of the site being re-directed inclduing this morning, it is now working on this machine.  However I have multiple PC with this problem.

Some firewall or antisyware program locks you to homepage.  Check the option menu or antispyware to disable the lock on homepage.

You may have a Rootkit.  Run Rootkit Revealer and Blacklight

Rootkit Revealer
http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx
or
F-Secure Blacklight
http://www.f-secure.com/blacklight/

Considering that you are facing the same problem of several machines (I assume using the same ISP), it may be a good idea to contact your ISP and see if there is something being done on their end to cause this issue.

How about using the Phishing feature on IE7?

Take a look at the Source (View + Source)?

Web Page Privacy Policy... (View + Web Page Privacy Policy...)?

To use the Phishing feature, go to: Tools + Phishing Filter + Check This Website etc...

It was our now old Novell DNS.

tn4712ee,

Glad you found the solution. What does the accepted answer have to do with your solution?