Internet issue - redirecting to FoxMovies.com

[Darren S]

Anyone come across this? It's looking like an issue that targets ISA Server, but we're not 100% sure on that yet.

Basically, all the main brands of AV software and spyware have their webpages forwarded on to www.foxmovies.com or www.fox.com. It also affects Google too, but other sites like ClioSport (clearly) work ok.

None of the AV vendors seem to be aware of this and even one PC that was built yesterday is suffering from the same issue. All MS Updates are current (as of about an hour ago), but still no joy.

We're about to rebuild an temp ISA Server to get us out of the brown, smelly stuff.

We haven't exactly ruled out that its an ISP issue either as we have a 2MB LL connection to them.

Any ideas guys? :S

D.

 

[Ian_182]

Its a virus then...

ian

 

[Darren S]

It's looking more likely. We've got reports of laptops seperate of our network having the same issue.

Bizarre - but more than that, just fooking annoying.

D.

 

[whatatash]

Try running a ping fom cmd to www.google.co.uk

If it replies from the above address the it looks like it is a virus rather than being a network error.

 

[Darren S]

Try running a ping fom cmd to www.google.co.uk

If it replies from the above address the it looks like it is a virus rather than being a network error.

Tried that already m8. Google won't acknowledge the ping, but it does resolve the IP address via DNS. Can't even get to the likes of Sophos and stuff to see if there's any news!

D.

 

[whatatash]

Just done a quick search on Google to see if its a know virus/error and nothings been reported.

Is it always to fox.com and foxmovies.com??

 

[whatatash]

Try restarting all ISA related services in Comp Management.!

Might have had a fit !!!

 

[Darren S]

Yep - always foxmovies or fox.co.uk.....

BBC works ok as a homepage. If I then type in Google.co.uk or Google.com, like so....

....... it then goes to fecking Fox again....

I wouldn't mind if it went to somewhere decent - like p**n - but Fox, ffs?!

D.

 

[Darren S]

Try restarting all ISA related services in Comp Management.!

Might have had a fit !!!

Applied the latest 3 patches and restarted it m8. Killed off 4 depots in the process (ah, they were only doing work at the time! ) and it did seem to improve things a bit. We could start getting to Sophos at least....

D.

 

[whatatash]

Defo sounds like it might be something thats wrong in the setup of you ISA server.

Can't see it being a virus anymore because like you said it redirects to Fox and not p**n etc. Most virus`/trojans etc redirect to crap!!!

 

[Darren S]

Just about to setup an ISA rule specific to us IT Gimps. Making sure that our PCs can only see www.sophos.com as a web-page. It will be interesting to see is it still redirects us to Fox....

D.

 

[Darren S]

Sorted.

Either the primary, alternative (or both?!) DNS records for the Proxy server were wrong. We've had them changed and everything is a-ok....

D.