Maybe hijacked

  • Thread starter Thread starter JJ
  • Start date Start date
J

JJ

I have a problem with everyone in my office.
They can't use the search function on the IE browser.
and there are certain sites they can't get to.
I got a reply from someone in the IE 6.0 site and they
suggested we were hijacked. The only work around I have
found is to stop and re-start the DNS server. But that
only works for a short period. I added the host file they
suggested to the DNS server.
What else should I do? I shouldn't have to go around to
everyone and add the host file or check for spyware right.
 
I have a problem with everyone in my office.
They can't use the search function on the IE browser.
and there are certain sites they can't get to.
I got a reply from someone in the IE 6.0 site and they
suggested we were hijacked. The only work around I have
found is to stop and re-start the DNS server. But that
only works for a short period. I added the host file they
suggested to the DNS server.
What else should I do? I shouldn't have to go around to
everyone and add the host file or check for spyware right.
Click to expand...

This isn't a DNS issue, try an Internet Explorer or Security group.
And do a check for spyware anyway.

Jeff
 
I ran Adware and spybot and no spyware were found.
What do you mean try try an Internet Explorer or Security
group.
I still don't know why it affects everyone. If I stop and
restart the dns server it works fine again for a couple
hours.
 
In
I have a problem with everyone in my office.
Click to expand...

Wow, is there a conspiracy going on?
:-)
They can't use the search function on the IE browser.
and there are certain sites they can't get to.
I got a reply from someone in the IE 6.0 site and they
suggested we were hijacked.
Click to expand...

IE6.0 Site? Curious, what site is that? Can you provide the URL?
The only work around I have
found is to stop and re-start the DNS server. But that
only works for a short period. I added the host file they
suggested to the DNS server.
Click to expand...

Who suggested that? Do you have a link or other info on this? Can you
elaborate? Hosts files is not the answer.
What else should I do? I shouldn't have to go around to
everyone and add the host file or check for spyware right.
Click to expand...

I'm leaning towards Jeff's suggestions.

What OS are the client and the DC and/or DNS server?

What Service Pack level?

Are you only using your internal DNS server on your internal machines?

If you change the forwarder (provided that your DNS infrastructure is
properly setup) to 4.2.2.2, does that eliminate the issue?

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Thanks for your response.
IE 6.0 and 5.5
The site is really the search engine for msn
ie.search.msn.com
DNS is 2k server. and clients are 2k as well
sp3 I know I should put sp4 on.
if your leaning towards Jeff's suggestions how is that
posible that everyone in the office can't connect to the
search engine for msn. But if I restart (stop and start
the services)on the DNS server people can us the search
function.
 
This is the message from someone else in the IE forum

Subject: Re: What would cause everyone to lose there
search
From: "Mike Burgess" <[email protected]> Sent:
12/16/2003 12:55:37 PM




JJ,
Why do I see the Action Cancelled message?
http://mvps.org/winhelp2002/hosts.htm#message
--
Go to: http://www.tomcoyote.org/hjt/
Download "Hijack This!" [freeware] or download direct
(below):
http://www.merijn.org/files/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change
into a "Save Log"
button.
Click: "Save Log" (generates: "hijackthis.log")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, go to the "Spyware and Hijackware Removal"
section.
Press "New Topic", copy and paste hijackthis.log into your
new message.
___________________________________________________________
_
Mike Burgess [MVP Windows Shell\User]
http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans,
with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-15-
03]
Please post replies to this Newsgroup, email address is
invalid
 
In
This is the message from someone else in the IE forum

Subject: Re: What would cause everyone to lose there
search
From: "Mike Burgess" <[email protected]> Sent:
12/16/2003 12:55:37 PM




JJ,
Why do I see the Action Cancelled message?
http://mvps.org/winhelp2002/hosts.htm#message
--
Go to: http://www.tomcoyote.org/hjt/
Download "Hijack This!" [freeware] or download direct
(below):
http://www.merijn.org/files/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change
into a "Save Log"
button.
Click: "Save Log" (generates: "hijackthis.log")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, go to the "Spyware and Hijackware Removal"
section.
Press "New Topic", copy and paste hijackthis.log into your
new message.
___________________________________________________________
_
Mike Burgess [MVP Windows Shell\User]
http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans,
with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 12-15-
03]
Please post replies to this Newsgroup, email address is
invalid

JJ said:
What would cause everyone to lose there search function in
the browsers window. When anyone clicks on the search
button they get finding site: ie.search.msn.com then
Action canceled Internet Explorer was unable to link to
the Web page you requested. The page might be temporarily
unavailable. I have check for spyware. What else could it
be?
Click to expand...
Click to expand...

I would follow the links and suggestions for spyware (and continue to look
for it) and trojans.

This may be a cache issue. Since you have SP3 (yes, update it immediately -
due to numerous security fixes), and run WIndows Update, but one other BIG
suggestion is to enable Secure Cache Against Pollution (DNS properties, Adv
tab).


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Back
Top