Intranet opens up searchportal.information.com

[tonycard1170]

Small office domain has an library intranet website. Two computers on network show information.com when they try to open library. I have scanned both, done the HJT, combofix and nothing. We use OpenDns so I bypassed that by giving it a static dns server address. I have flushed dns and run a scan and it will work for about an hour and then when they try to open it again redirects back to information.com. Doesn't matter if I log in with normal user or admin. All other computers on network are able to open up library website without problems. Help!!

 

[archwayguy]

Can they still access the intranet site by typing it in after this occurs? What is the homepage set to? Are they using a proxy? What browser & version?

 

[tonycard1170]

No they cant connect to it after it occurs. No proxy is used. Tried it both on ie6 and firefox, same results.

 

[tonycard1170]

Any ideas guys? I really need some help on this issue. Please!!

 

[tlcscousin]

It sounds like a variant of the smitfraud.A quick google search on remove searchportal yields quite a few links to removal.