browser hijack by tribalfusion?

I just noticed that all my browser was real slow and I couold only get to certain pages...I then noticed that page requests were being filtered to tribalfusion.com then passed along to my requested page.

System info:
Windows 2000
ZoneAlarm Pro
IE6

I updated and ran the following:

Pestpatrol - found and removed tribalfusion cookie
Adaware - found Alexa and removed
HiJackThis - found nothing unusual
Registry Mechanic
Full virus scan with Nortons - nothing
Full virus scan at Trend Micro -nothing

None of the above helped. The sites I do get to look wrong so I looked at source code...all sites I can get to have a javascript src at top for 'http://127.0.0.1/js.cgi'.... This code seems to be added to all pages to reference a local javascript file. I searched my system and could not locate the file. Then I search my registry and found references to tribalfusion and that js file. I removed these items but it did not correct the problem. I have looked at my host file and it looks fine haviing just the 127.0.0.1 localhost listing. I am at a loss as to what the problem could be.

I am able to get email, ftp etc. seems to only be affecting browsing.

Any help would be so so greatly appreciated...trying to get work done at night from the affected computer....
jamesr1411Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

SheharyaarSaahilCommented:
Hello jamesr1411 =)

>> http://127.0.0.1/js.cgi'

I think this code is added by ZoneAlarm to block the pages.... so just try disabling it or to uninstall it to check for the problem !!
coz sometimes firewall settings gets changed, and uninstalling and reisntalling or restoring the default options can set them back to default values :)
0
RohnishIT EngineerCommented:
get rid of zone alarm!
Try Giant antispyware. I swear by it!
0
Paul SDesktop Support Manager / Network AdministratorCommented:
run MWAV to verify that your system is free from threats

http://www.paulscomputerservice.net/index.php?body=./software/malwareinstructions.php
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
SanNas31Commented:
Sometimes its the 'value added' items such as popup blocking that cause the problem.
To do that - additional JS code can be added to your web pages viewed, without your knowledge.
If your firewall / AV has additional popup blockers, try turning them off
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Software Firewalls

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.