Internet explorer is highjacked to sedo.com

[Mark]

Hello,
Has anyone seen this before?

I have a user that when she connects to the internet through a wireless card
at home through Comcast. When she clicks on IE 6, she should recieve an
error that the page could not be displayed because she is not connecting to
the network through VPN, but what she gets is re-directed to SEDO.COM. She
can change the address and get to other sites after this. I have searched
the registry and ran spyware software and still cannot find why this page
comes up everytime. When she connects to VPN, she does get the correct home
page. Thanks for any help.

 

[Robert Aldwinckle]

Hello,
Has anyone seen this before?

Always disclose the OS involved. This has little to do with IE,
more to do with the networking setup and probably a DNS issue.
E.g. I suspect you aren't using the same DNS in both cases.
Use nslookup to check.


---

 

[Mark]

Sorry, the OS is Windows XP PRO SP2. I am not sure what you are saying with
nslookup, the way our companies images are setup for the computers, we do not
set DNS on them.

 

[Robert Aldwinckle]

(cross-post added to XP Networking)

Sorry, the OS is Windows XP PRO SP2. I am not sure what you are saying with
nslookup, the way our companies images are setup for the computers, we do not
set DNS on them.

Ok. I guess the DNS is established by DHCP? But won't the addresses
returned be different for the different connections?

Try a search? Press Win-F1; enter nslookup...
Usually you would use nslookup in a cmd window with a site name.
Each time it will also show you the IP address of the DNS server it used
to get whatever it found (or didn't find.)

In fact, if you just Run... nslookup (e.g. press Win-R and enter that)
it will show you the DNS server address in a new cmd window,
so you don't even have to know how to get a standard command prompt. ; )

So, do that with both your connection cases and see if you are using
a different DNS each time...

You could actually go further and try to simulate your (assumed) problem
with the lookup for your home page. Tip: use the set debug subcommand
of nslookup to get more detail for the actual lookup in each case.
If you see reference to the sedo.com site (instead of a failed lookup)
you could have an explanation for your symptom.


Good luck

Robert
---