virus?

I've seen a strange behavior lately on quite a few of my desktops (about 120 of them so far) that looks like a virus but I haven't been able to detect it with Kaspersky, Nod32, or Security Essentials Offline.

A little about my network:
Windows XP
2003 Active Directory
IE 8
Kaspersky AV
Roaming Profiles
Untangle (with AD script)

The Problem:
When some of my users go to video streaming sites like discovery.com, youtube, etc. IE gobbles up about 1GB of RAM and throws an error that a script on the page is causing IE to perform poorly. We tried blowing away the user's profile, re-imaging the computer... the problem persisted. I'm thinking Shockwave, Flash, some new HTML command that isn't supported by IE 8, Java, Windows update... maybe an issue with Untangle.

My staff has been chasing this for about a week and their lack of results has brought be back to the [H] where I know a respectable number of great techs hang out.

Have any of you seen this weirdness? I'd love to hear your suggestions on what else I might try.


Oh, and I know this isn't an enterprise support forum. I'm just hoping to ask a diverse, knowledgeable population that might have some insight.

I 've seen this issue or something similar.

Update your Adobe flash version and go into the Kaspersky console to modify your Kaspersky AV configuration, I believe the setting is called "streaming buffer" to 5 seconds. The default setting is 1 second.

If it walks like a duck, quacks like a duck, and swims like a duck normally I'd call it a duck. In this case, it's a swimming, bowlegged, quacking chicken.

Turns out the issue is related to the FaceBook content delivery network and a script that runs ads on several common websites. Untangle is blocking a portion of the script, which then causes it to blow up and take IE with it. I suppose this could be a case for allowing my users to access FaceBook.

Thanks for the input!

DarkOne_BW said:

If it walks like a duck, quacks like a duck, and swims like a duck normally I'd call it a duck. In this case, it's a swimming, bowlegged, quacking chicken.

Turns out the issue is related to the FaceBook content delivery network and a script that runs ads on several common websites. Untangle is blocking a portion of the script, which then causes it to blow up and take IE with it. I suppose this could be a case for allowing my users to access FaceBook.

Thanks for the input!

Click to expand...

We're seeing the same issue with several clients running Barracuda Web Filters. The filter blocks part of the script and causes the clients browser to consume all available RAM and then just shit the bed.