hijacked browser

[Boyds]

This is rampaging through my company. Started this morning as near as I can tell and is spreading quickly through our systems. Right now it's only effecting certain web pages.

Here's an example of what happens. I open my homepage which comes up fine. I type

http://www.ups.com

and I get a searchpage with a bunch of advertisements on it but the page says it's ups.com. If I type ups's ip address the real ups.com comes up.

I've run spybot, hijack this, adaware, symantec corp ed 9.0, adsspy, cwshredder, bugoff, emco malwarebouncer, microsoft antispyware. All the latest versions with updated defs.
Nothing found at all.

Any help would be appreciated.

 

[diogenes10]

Hijacked hosts file?


Possible replacement hosts file here:

http://www.mvps.org/winhelp2002/hosts.htm

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[Boyds]

Not a hijacked hosts file. Tried the file but no go. We've noticed that the issue comes and goes. It's almost like the dns has gone crazy. I'll update if I find anything.