[rickytheanuj]

in my office network 2-3 computer had a problem, it automatically popup some unwanted porn site.
Nod32 antivirus is installed in that computer and i checked my computer with mcafee stringer virus remover but nothing is there.. there is nothing like that in startup and even schedule so what's the problem.. i also cleaned my web browsers' history and cookies too.. but nothing is gonna work..

help me.. or i have only way to solve is format

[-X-]

Sounds like malware. Post a hijackthis log or something.

[rickytheanuj]

so.. wat's the sol??

[submix8c]

-X-, on Dec 17 2009, 03:17 AM, said:

Sounds like malware. Post a hijackthis log or something.

Uhhh...

[cluberti]

The solution is gonna involve some investigative work by you to help us, because the MSFN crystal ball is in the shop currently. Please start by running hijackthis on the affected machine and attach the log to your next post here, for starters.

We're really bad even with the crystal ball at guessing, but pretty good once we have data .

[herbalist]

Hijack this and instructions regarding its use are available here.

[MrJinje]

To be honest, any corporate problem that takes longer to solve than the time it takes to provision a new machine, does not need to be solved.

You have to weigh how many hours you have worked this problem against how long it would have taken you to reformat/reinstall.

[cluberti]

...until it happens twice. Then, might as well fix it and find root cause, otherwise it'll just keep re-appearing.

[MrJinje]

If it turns out to be an employee surfing for pr0n, the HR reps will have a lunch of him. We have fired many employees for violating that little policy, very embarrassing way to go.

Another way to go might be to configure that website (pr0n address) into the "Restricted Zone" via group policy, or better yet configure the DNS/gateway/router to bar access to that site. That would help prevent a future infection.

This post has been edited by MrJinje: 07 January 2010 - 05:33 PM

[herbalist]

At a place of employment, office and workstation computers should only get internet access if it's necessary for them to perform their jobs.

Reformatting might be the fastest way to fix the problem (assuming your office has all the data on these PCs backed up, but finding and fixing the actual problem could show who is the source of this problem.

[MrJinje]

Has the OP already ruled out a browser helper object. These would be beyond all the measures the OP employed (not found in start up, clear cookies, history).

Dig around in the Manage Add-on console (IE Options) and see if there are any randomly named, unsigned, unknown BHO's and react accordingly. Disable them one by one until the pop-up stops.



Then after you are 100% sure you know which add-on is causing trouble, create a group policy setting that prevents usage/installation of that particular add-on.

The settings are controlled from here, via group policy.

Windows Components\Internet Explorer\Security Features\Add-on Management

This post has been edited by MrJinje: 09 January 2010 - 02:28 PM

[rwycuff]

Mr Jingie has the right idea its either a BHO or Could be Hosts file.