OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Michael Gargan (michaeladest.com)
Date: Tue Feb 26 2002 - 11:26:14 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Quick addition to my last mail.. After going to the site using the proxy I
    removed the Proxy settings but it still kept going there.. had to delete the
    proxyserver key manually from
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
    Settings in the registry to clean it again...

    this then worked..

    Should have looked before I mailed eh :)

    Mike

    ----- Original Message -----
    From: <Matthew.van.Eerdehbinc.com>
    To: <focus-mssecurityfocus.com>
    Cc: <focus-virussecurityfocus.com>
    Sent: Tuesday, February 26, 2002 4:29 PM
    Subject: browser redirection to forward.domainname.at

    > A strange problem is surfacing on our network. Users will type in a
    website
    > they have been to before, and they will be forwarded to
    >
    > http://forward.domainname.at/http://212.69.172.16/forward.php
    > and then to
    > http://212.69.172.16/forward.php
    >
    > Have we been hit by a virus? Or is there some name resolution hack on the
    > internet?
    >
    > Typing in the ip address of a site
    > http://216.168.252.86 for http://www.verisign.com for example
    > goes to the correct site. nslookup prompts from the command line yeild
    the
    > correct IP address.
    >
    > Workstations are Windows 2000 Professional SP2 with IE 6.
    >
    > Matthew van Eerde
    > Software Engineer
    >