Pr0n popups on a machine that shouldnt have em...

[TallBill]

Uh... someone was lookin at porn on a machine that they shouldnt have... i got sent in to secure it.... randomly ever few hours IE 5.5 would open up and direct itself at a certain adult site.... dialing properties would come up, but i couldnt tellf if it was actually trying to connect or not because i was connected to the pc via pc anywhere... anyways.. i cleaned up all temp files... checked the registry/services/programs/downloads... i cant find out why this IE box is popping up.

 

[DaiShan]

sometimes the user may inadvertantly download a file that they think does one thing, but actually dials one of these sites, normally I think there is a toll assosciated with dialing these site as well. Ask about any recent file downloads? do a search for programs after a certain date? ask that user about any programs they intentionally downloaded/ which directory they actually downloaded too.

 

[HappyPuppy]

Fire the user and run over the infected harddrive repeatedly with your SUV!

 

[Sir Fredrick]

Might want to look into lavasoft ad-aware...not sure if it helps with that sort of stuff specifically, but it's worth a try.

 

[Balt]

Have you tried running Ad-Aware to remove it?

Link

Might not work but it doesn't hurt to try.

 

[TallBill]

jhmm.. i actually looked at the download directory .. it was bare.... i guess i can try ad aware... btw, the paperwork is already being pushed for the person to be fired

 

[spanky]

did u check msconfig (assuming ur OS can use msconfig), so see if anything funky is starting up with the pc?

 

[TallBill]

its an NT 4.0 box.. i dunno how to check the startup files, but i'll give a look

 

[googly]

Sheesh! There's a sucker born every minute, innit? This is the Hi-Tech equivalent of dialling a 1-900 number...

 

[rudder]

yeh my brother-in-law is a pr0n hound. He let his nephew use his computer and guess what.... same thing happened. Ad-Aware did not find it. I eventually found and executable and think that solved the problem. It was a hard bastard to find. It happened again recently but I think he keeps going back to those sites and he doesn't know sh!t about computers and clicks on anything. If he didn't fix my car for me, I swear I would charge him $$$ for just being stupid.

 

[bunker]

If the guy's being canned why not just ghost the machine? Save yourself a bunch of time/headaches.

 

[TallBill]

ok.. still frickin there.. found all kinds of odd-ball registry settings... and i cant ghost the pc... its the backoffice pc of a live restaraunt site. Its in use around the clock and functioning with several systems.

 

[bunker]

Do you see any odd-ball processes running? Check the task manager and look at all the processes, if you see something strange disable it in the services under administrative tools and see if it stops.

 

[AKA]

Just look in the add/remove programs.. they actually put an entry in there most of the time.
Then go into IE options and set it to never dial a connection.
Check startup folder. (Im sure you already have)
Look for it in a program folder.. alot of them do have their own uninstall utitlity.
Run a full virus scan.