Solved

IE 6 woks in two login accounts but not in third

Posted on 2007-04-05
16
221 Views
Last Modified: 2013-12-08
In two named Windows login accounts (Win XP Home SP2), IE 6 works. In the Guest login account it does not. It appears that no SPyware or Virus's are on ths PC although an exhaustive search has not been done.

Please suggest how to fix this. ComcastCable modem has been power cycled.

Regards-Mike
0
Comment
Question by:mgross333
  • 8
  • 4
  • 3
  • +1
16 Comments
 
LVL 11

Expert Comment

by:AnthonyP9618
Comment Utility
Define what you mean by IE working and not working.

Where IE is not working:
Can you not even open IE?  
Can you not browse sites?

Have you tried creating a new account and testing it there?
0
 
LVL 97

Accepted Solution

by:
war1 earned 400 total points
Comment Utility
mgross333,

If 2 out of 3 Windows accounts work, remove the 3rd account and create a new guest account.  The Guest account is corrupt.  IE6 should work in the newly created account.
0
 
LVL 15

Expert Comment

by:qz8dsw
Comment Utility
Going by here,
http://techrepublic.com.com/5208-6230-0.html?forumID=47&threadID=192747&messageID=1991710

"If you have XP the Guest account is generally pretty well tied down by design. you could move the account into a more powerful group if you need to use it. The guest account should genereally be disabled."

Which fits with what I know about it. The guest account should generally be disabled as it is a common and known username which is open for attacks.
Do as war suggested, create a new account and assign it the privilidges you feel is needed.

Terry
0
 

Author Comment

by:mgross333
Comment Utility
PLEASE READ BEFORE REPLYING INCLUDING THE PERSON WHO POSTED AFTER THIS. I REQUEST THAT THAT PERSON **ALSO** REPLY AGAIN AFTER READING WHAT IS BELOW.

This is for a customer who called me on the phone (after I was at the PC an hour earlier tonite).  IE 6 works fine in two named Windows login accounts.
In the Windows Guest account, IE (when clicked) opens and displays the "server not found etc." message you get when there is no internet connection OR you enter a non-existant URL.

In the IE address bar is http://search.qsrch.com.

If a different URL is typed into the address bar (like www.yahoo.com or ANY OTHER URL), an error appears saying that 'IE can not open the serach page".  

NO FIREWALLS ARE RUNNING; THIS HAS BEEN CHECKED BY THE CUSTOMER WITH ME GIVING DIRECTIONS ON THEN PHONE. AOL security is installed but the firewall has been turned off. Mcafee is installed but NOT the Mcafee firewall. Windows firewall service is not enabled (or started) so it has neither an on or off status. Mcafee VirusScan (the real one) and AOL Antivirus are running.

I am going to this job site tomorrow (Friday) morning and will have NO more information before then.

The idea of creating another account is ONLY USEFUL in that, if it works, I could tell the person who uses the Guest account to now use the new account (that IE now works in) and to copy his My Docs directory files and folders over to the the My Docs directory ot the new account. IE A WORKAROUND !! (but in practical terms the customer would probably accept it).

I AM LOOKING FOR IDEAS BASED **ONLY** ON WHAT IS POSTED HERE NOW.

Regards,
  Mike

0
 

Author Comment

by:mgross333
Comment Utility
In my post immediately above this one change
INCLUDING THE PERSON WHO POSTED AFTER THIS
TO
INCLUDING THE TWO PEOPLE WHO POSTED BEFORE THIS (i.e war1 and qz8dsw).

War1 and Qz8dsw,

 there is a lot more detailed information in my long post immediately above this one that you did not have when you replied. PLEASE READ THAT (i.e the IE "search" error and the odd search.qsrch.com IE home page) and then POST AGAIN PLEASE.

Regards-Mike
0
 
LVL 97

Expert Comment

by:war1
Comment Utility
Some website has hijacked your homepage and search.

1. Use the following scanners to find and remove the website.

Ewido
http://www.ewido.net/en/
or
Spy Sweeper
http://mysite.webroot.com/forms/Infoworld
or
SpyBot S&D searches your harddisk for so-called spy- or adbots;
http://security.kolla.de/
or
Adaware
http://www.lavasoftusa.com/software/adaware/

2. Some shopping and porn websites redirects links to their websites using your HOSTS file. Do a search for the HOSTS (without extension) file and remove the entry.

HOSTS file is located in C:\WINDOWS\SYSTEM32\DRIVERS\ETC. It is a hidden file, so you need to unhide hidden files to see it. Go to any folder and select Tools > Folders Options > View. Check "Show hidden files and folders". Click OK.

3. If still no joy, download HijackThis

http://www.majorgeeks.com/download3155.html

Run the program and you will find many entries. Most are OK. Post the log at http://www.hijackthis.de/ and click Analyse, Save.  Post a link to the saved list here.
0
 

Author Comment

by:mgross333
Comment Utility
War1 and other EE experts,

I prefer not to go that route since the other two login accounts work fine (in IE 6 and the AOL application too). PLEASE CONFIRM THAT SIMPLY CREATING ANOTHER WINDOWS LOGIN ACCOUNT AND DELETING THE CURRENT "GUEST" ACCOUNT WILL PROBABLY SOLVE THE PROBLEM JUST AS WELL.

I mean it is not like the entire PC (all accounts) has Spyware; then your suggested approach WOULD HAVE TO BE  used.

I am willing to run Webroot Spysweeper (updated) Quick Scan (checks the usual suspects ONLY, not the entire HD and runs much faster as a result) after deleting the Guest account and creating another login account AND CONFIRMING IT HAS NO IE PROBLEMS.  Despite it's limited scope, in my experience (AND I HAVE A LOT OF EXPERIENCE ACTUALLY ELIMINATING SPYWARE/ ADWARE/ VIRUS PROBLEMS), Webroot Spysweeper Quickscan finds most of what the full scan finds.

I will also start up Mcafee Full Scan just before I leave and tell the customer to follow Mcafee's recomendations about anything it finds (quarnatine or remove, usually).

Regards-Mike
 

0
 

Author Comment

by:mgross333
Comment Utility
I neglected to mention that when I delete the Current Guest account, I will not delete the My Docs directory associated with it (or I will move the files to the new account first). As there files are of value to the person using the current Guest acccount. I will also move over the IE favorites and desktop contents too.

Mike
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 97

Expert Comment

by:war1
Comment Utility
Mike,

The Guest account is probably infected with some mailware.  If it is confine to Guest Account, then creating a new account will likely fix the problem.  Don't move over anything until you confirm that IE works well in the new account.  Then be careful what you move over, as the mailware may be residing in one of the files that you move.
0
 
LVL 15

Assisted Solution

by:qz8dsw
qz8dsw earned 100 total points
Comment Utility
For more information about qsrch

http://whois.ws/whois-com/ip-address/qsrch.com/
It's affiliated with or made by the same people who bring you newdotnet
It injects itself into IE and also winsock.
Tracks and reposts on what you do.
http://vil.nai.com/vil/content/v_136093.htm#tab2
0
 

Author Comment

by:mgross333
Comment Utility
War1,

Well, the problem is that I have to move the stuff over or it will not satisfy the customer; I cannot very well delete his photos, docs, spreadsheets and IE favorites and destkop files and folders, can I. ???That would be "throwing the baby out with the bathwater" if you know what I mean !!

 (Of course I **WILL** check FIRST that IE works in the newly created account).

As a result of your post, I will change my plan to run the Webroot Spysweeper **Full** scan while logged into the new account after moving everything over from the Guest account (see my list above in this post) and THEN deleting the Guest account including the option to delete all associated files (i.e the Documents and Settings/Guest folder tree).

Webroot has probably the best Spyware/Adware scanner in the world (PC World Magazine has top rated it for two years in a row and I have had excellent (occasionally miraculous) expereince with it). It should ELIMINATE ALMOST ALL MALWARE in the files moved from Guest to the newly created account.

And I will start Mcafee Full scan (logged into the newly created account) just before I leave, instructing the customer to do whatever Mcafee recommends for whatever Mcafee Full scan finds when it completes.

I will assign points here after seeing what happens with this approach tomoorow.

Mike
0
 

Author Comment

by:mgross333
Comment Utility
qz8dsw,

I note your last post BUT believe my approach in the post immediately above this one should work without a direct attack on the security threat you have identified. ASSUMING THAT IE 6 WORKS FINE IN THE NEW ACCOUNT OF COURSE.

PLEASE COMMENT ON THIS.

Regards-Mike
0
 

Author Comment

by:mgross333
Comment Utility
qz8dsw,

Based on your post, I could run LSPFIX and remove whatever is in the right coloun (the Remove Column) and it would probably restore internet to the Guest account BUT that would not be the end of it. I would have to get a HJT log and see what is there and this kind of thing can go on and on and on.

Your comments are welcome.

Mike
0
 
LVL 15

Expert Comment

by:qz8dsw
Comment Utility
Hi Mike,

Yes I do agree with your approach.
Webroot Spysweeper most definately and if it is still playing up after that and a reboot then I would use LSPFIX to see if it's still got it's hooks in winsock.
Newdotnet can be quite hard to get rid if.
If you have not already, if you click on the characteristics tab of my second link it gives you an idea what it does.

Terry
0
 
LVL 97

Expert Comment

by:war1
Comment Utility
Mike, any update?
0
 

Author Comment

by:mgross333
Comment Utility
War1,

My return visit is delayed till this morning. I will post here afterwards,

Mike
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

I recently found myself in a Corporate Situation where the client had requested blocking access to any and all websites except his own Domain? Easy? I am sure this would be your answer but their requirement was, this has to be done without using…
I annotated my article on ransomware somewhat extensively, but I keep adding new references and wanted to put a link to the reference library.  Despite all the reference tools I have on hand, it was not easy to find a way to do this easily. I finall…
This Micro Tutorial will demonstrate how to add subdomains to your content reports. This can be very importing in having a site with multiple subdomains.
This Micro Tutorial will demonstrate how nuggets on the Web are formatted by using Chrome Developer Tools. These tools would not only view the site's CSS but it can also modify it and save the CSS to use on your own site.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now