Hijacked!!

At work we use a home-grown php program that allows workers to punch in and out of an automated time clock. It's pretty neat, but recently one of the workers had a problem getting into the clock; said she was not authenticated. The admin of the program came by and checked and noted that, not just a home page was hijacked, but that it appeared something had landed on the hard drive and was causing IE 6 to send everything out to/through a proxy, and back to us. We we set to blow away the PC and start over, but one of the guys had some ideas. He played some magic, then we ran AdAware, SpyBOT, and McAfee 8.0i Enterprise. All three caught some little gremlins, but we still don't know for sure what may have caused the problem. If anyone has any thoughts/ideas/experience with this same issue, please let me know so I can document it for our helpdesk knowledgebase.

 

Without details of exactly what was removed, it's impossible to say what might have caused the problem.

Do you use Spybot's immunize feature on PCs? How about IESPYAD and Spyware blaster? Both of them protect against a long list of stuff ever getting near the PC.

 

Hijacked!

Newt, thanks for the reply. I don't remember if this particular PC was immunized or not. With 1.3 we try to get them all immunized, but I don't know about the one. I guess I'm not familiar with the other two programs you mentioned, but will certainly check them out for reference.
Thanks again, and 'safe computing.'

 

Spywareblaster is basically a passive protection app. No need to do anything with it other than install, update, protect, and then do updates at least once a month.

IE-SPYAD is a .reg file that loads your restricted site registry key with a ton of entries. You could do the same via the browser and adding them one at a time but this is certainly lots quicker and easier. With this one again, run it and then forget it for a while.