Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a clients laptop that is doing the redirect of web pages to other sites.

I have run HitManPro and Combofix and they didn't come up with anything major. There is no proxy set in Internet Explorer, and the host file only has the entry '127.0.0.1'.

Is there a way to tell if there is another host file in use by IE? Or any suggestions of how to clean this thing up would be greatly appreciated.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Let's do some troubleshooting.

  • Try using another browser (Chrome or Firefox). If that solves the problem, then IE is broken. If it doesn't, skip the next step.

  • Try starting IE in Safe Mode and see if the problem recurs. If not, then the problem is most likely an IE plug-in or toolbar.

  • Make sure your DNS is correct. If you don't know what it should be, force it to 8.8.8.8 (Google DNS) and try. If that fixes the problem, identify the correct DNS from your ISP.

If none of these work, try a different virus scan .. Trend Micro House Call is free and works online, so there is no installer.

All that being said, this probably belongs on SuperUser.

share|improve this answer
    
Thanks for the suggestions. No luck with them however all the sites are still redirecting, even in Firefox. And the DNS entries look fine. –  The Woo Jun 24 '11 at 6:38

I had the same, or a very similar issue with a laptop. Even after formatting and re installing Windows, the problem still persisted.

It turned out that the malware was on the laptops hidden restore partition. Luckily the laptop came with full restore media. I was then able to format the entire drive (not just the partition) and and reinstall from scratch.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.