Question about Browser Hijackers/Spyware etc.

[Firus]

I just had a remote client complain about our company newsletter redirecting him to a site that is not ours. Now, I know that browser hijacker software can easily do such things, but this one is different than any I have seen. He sent me a screen shot of the page he is getting redirected to and it has our company name in the title and keeps the exact same URL in the address bar as the real link from the newsletter. But it is definately not our page, it has a bunch of links to "free shipping" and "building supplies", the usual junk.

My question is, are spyware/browser hijackers really getting this smart? I am going to suggest that he run a check with AdAware/Spybot/Hijack This etc. I mean, I am almost hoping that it is spyware, because if its not, what else could it be? And why only for this one link on our newsletter?? I feel like such a noob getting stumped like this, could you guys enlighten me on this one?

thanks

 

[jkoon]

My guess is it is spyware/virus and it is showing the address that the person types/clicks but actually displaying another page (kind of like doing a nested page within the page, or a multiple frames type thing).

The one thing I?m not sure about is why its only your address link. Perhaps its only addresses that are clicked which open a new browser window or some other type of scenario like that?

 

[Firus]

Yes, it has me really confused, but what makes it worse is the user is a client and I can't really do much except make suggestions from here. I told him to enlist the help of their help-desk/techsupport, so hopefully he listens If it gets resolved I will post the results later.

In the mean time, if anyone has any suggestions, I'm all ears (or eyes)...