citiFun-chat adult icon on desktop

[SpecSys]

I have an employee who came back from his lunch hour and discovered this icon on his desktop. It simply says citiFun-chat with an icon that appears as a nude woman. It states that is was created at 12:50 (when he was gone). He locks his computer at noon and its unlikely someone broke in. Virus scan and Ad-aware turn up nothing.

As a side note, he locked his computer because last week he discovered his home page had been changed to an adult site. He assumed it was someone messing with him, but I am not convinced...is there something hiding on the computer?

 

[petermeachem]

Do you believe him? The computer did it all by itself eh. I don't think so. Peter Meachem
peter @ accuflight.com

 

[AVChap]

He probably surfed one of those adult sites with a JavaScript which changes the start page to itself. I think its called JS/IEStart. In any case, it wasn't the computer

AVChap ... take my advice, I don't use it anyway!

 

[edfair]

But there are other programs that can take control, and that could be an explanation.
What was running when he left for lunch? Ed Fair
unixstuff@juno.com
Any advice I give is my best judgement based on my interpretation of the facts you supply. Help increase my knowledge by providing some feedback, good or bad, on any advice I have given.

 

[Grenage]

Aye, well It's unlikely that it appeared when he wasn't there, usually your browsing a site and you have security low, or you click yes to some message comes up and it installs some dodgy dialup. That said, it's always possible.

 

[SpecSys]

Well, I do believe him that HE didnt do it. It seems if he would have he wouldnt have told me (and also because of the earlier reported incident). That being said, I am pretty sure someone else must have done it for him. Also, there is not anything showing up in the internet monitoring I do. Maybe I haven't looked in the right place.

 

[2ffat]

If someone hacked his site, they may have left a backdoor open. It may be possible that there is also a backdoor on his PC, too.
James P. Cottingham

When a man sits with a pretty girl for an hour, it seems like a minute. But let him sit on a hot stove for a minute and it's longer than any hour. That's relativity.
[tab][tab]Albert Einstein explaining his Theory of Relativity to a group of journalists.

 

[Luckyfour]

Well, virus scan and Ad-aware turn up nothing. There are trojans such as trojan.JS.cover, Swporta.trojan and JS.seeker.B than can change the home page. One thing you could try is to download the free one month of Moosoft "The Cleaner" which I have and can find a lot more trojans.

http://www.moosoft.com/thecleaner/index.php

 

[Kento]

SpecSys, If this computer has windows 95, 98, or ME run Startlog.com on it. It'll create 2 text files on the desktop. Copy and paste the results of just Startlog (not the stubpaths file) to your reply here. It may show us where it's coming from.

http://home.earthlink.net/~rmbox/Reticulated/Only_IE.html