IE6 Internet Options Restriction

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Godzilha82

Thread Starter
Joined
Jan 8, 2003
Messages
33
IE6, toolbar, tools, internet options, this operation has been cancelled due to restriction on this computer. This is the version, location, option and error message when I try to access my internet options on the IE tool bar. I cannot access the options from either here or the control panel. How can I change the restrictions to allow me to edit my options. It is my home computer, I'm the only administrator. I've followed similar threads for other OS's. There is no "NoBrowserOption" in the registry.
 

Godzilha82

Thread Starter
Joined
Jan 8, 2003
Messages
33
Thanks for your help Tony, but no luck. I had no returns on both of those searchs. I also went to the MS Knowledge base that you recommended and found something unusual. When I go to the following section in my registry:

HKEY_CURRENT_USER/SOFTWARE/POLICIES/MICROSOFT

There is no folder(?) for Internet Explorer. I only have 2 folders located in the Microsoft folder and they are "Office" and "System Certificates". Any ideas?

Thanks again for your help.

Trevor
 

TonyKlein

Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
These subkeys only exist at that location if restrictions have been imposed.
They're not there in a default Windows installation, so by itself that's normal.

Would you try this, please (quick and dirty):

Close Internet Explorer.

Now download the attached Remove.txt, save as (rename to) Remove.reg, and doubleclick.

Answer 'yes' when you're asked whether you'd like to have the contents of your reg file merged into the registry, and a great number of restrictions, if you have them, will be removed.

If you don't have any, the file won't do anything, so there's absolutely no risk at all.

After running the regfile, you'll want to reboot.


Tell us whether that makes a difference.
 

Attachments

Godzilha82

Thread Starter
Joined
Jan 8, 2003
Messages
33
Thanks again, Tony....still no luck. I still can't get into my internet options from IE6 or from the control panel. Further, for some reason, there is no icon next to "Internet Options" in the "Network and Internet Connections" section of the XP Control Panel. I had an extensive chat with MS tech support last night and what we both think is that possibly I've been the victim of a Trojan....Xupiter or some derivative thereof. The only other symptom that I can relate is that there is an unexplained icon in the IE6 bottom tray (for lack of the correct word) that I can't get rid of. When I do a C drive search for "xt update", I get 2 files returned:

IFxTextureUpdate.class in folder com/ms/fx

When I open the containing folder, I see the same icon that is in the bottom tray of IE6 that I can't explain.

Any Ideas??

Thanks
Trevor
 

TonyKlein

Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
Well, that would point into the direction of the MS article being right: a missing or corrupted inetcpl.cpl.

Would you please do this first:

Go to http://www.spywareinfo.com/downloads.php#det , and download 'Hijack This!'.
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log somewhere, and please show us its contents.

Next, press "Config" > "Miscellaneous Tools", and press "Generate Startuplist Log"

This will generate a text file that will list all running processes, all applications that are loaded automatically when you start Windows, and more.

Go to Edit > select all, copy it and post its contents here as well.
 

Godzilha82

Thread Starter
Joined
Jan 8, 2003
Messages
33
OK Tony, here goes.....

Here's the result of the initial scan:

Logfile of HijackThis v1.90.0
Scan saved at 11:26:43 AM MI, on 1/8/2003
Platform: Windows NT 5.01.2600
MSIE version: 6.0.2800.1106

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://my.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://home.netscape.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://home.netscape.com/home/winsearch200.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default)=http://keyword.netscape.com/keyword/%s
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O10 - Broken Internet access because of LSP provider 'wps.dll' missing
O15 - Trusted Zone: http://free.aol.com
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2002121801/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37626.7547916667
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://www.virtualvegas.com/cab/WONWebLauncherControl.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F89D69D2-0C80-11D4-B67E-0050DA271F38} (eStreamIE Class) - http://www.elanguage.com/media/eStream/eStream.cab
O18 - Protocol: ms-its51 - {F6F1E82D-DE4D-11D2-875C-0000F8105754}

And here's the result of the Startuplist Log:

StartupList report, 1/8/2003, 11:30:49 AM MI
StartupList version: 1.50
Started from : C:\Documents and Settings\Owner\My Documents\SpyBots\Hijack This\hijackthis\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTSVCCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Roxio\GoBack\GBPoll.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\WINDOWS\SYSTEM32\starter.exe
C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Roxio\GoBack\GBTray.exe
C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\Intuit\QuickBooks Basic\Components\QBAgent\qbdagent2002.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\MailWasher\MailWasher.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\My Documents\SpyBots\Hijack This\hijackthis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Owner\Start Menu\Programs\Startup]
OptiCAL Startup.lnk = C:\Program Files\PANTONE COLORVISION\OptiCAL\OptiCAL.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
EPSON Status Monitor 3 Environment Check(2).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
gwum.lnk = C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
Microsoft Works Calendar Reminders.lnk = ?
MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Basic\Components\QBAgent\qbdagent2002.exe
Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE

Thanks again for your Help!

Trevor

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
LDM = C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\INF\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
StubPath = "C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=
HKLM\..\Windows\CurrentVersion\WinLogon: load=
HKLM\..\Windows\CurrentVersion\WinLogon: run=
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=
HKCU\..\Windows\CurrentVersion\WinLogon: load=
HKCU\..\Windows\CurrentVersion\WinLogon: run=
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=
HKLM\..\Windows NT\CurrentVersion\Windows: load=
HKLM\..\Windows NT\CurrentVersion\Windows: run=
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=NVDESK32.DLL

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

*INI section not found*
*INI section not found*
*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\ssstars.scr
*Registry value not found*

Policies Shell key:

HKCU\..\Policies: *Registry key not found*
HKLM\..\Policies: *Registry key not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Task Scheduler jobs:

Norton AntiVirus - Scan my computer.job
Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[sys Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\PCPitStop.dll
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll
CODEBASE = http://download.yahoo.com/dl/installs/yinst.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocx
CODEBASE = http://a840.g.akamai.net/7/840/537/2002121801/housecall.antivirus.com/housecall/xscan53.cab

[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
CODEBASE = http://www.pandasoftware.com/activescan/as/asinst.cab

[Update Class]
InProcServer32 = C:\WINDOWS\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37626.7547916667

[WONWebLauncher Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\WONWebLauncherControl.ocx
CODEBASE = http://www.virtualvegas.com/cab/WONWebLauncherControl.cab

[ContentAuditX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\CONTEN~1.OCX
CODEBASE = http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[eStreamIE Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\IEeStream.dll
CODEBASE = http://www.elanguage.com/media/eStream/eStream.cab

--------------------------------------------------

Enumerating Winsock LSP files:

Protocol #1: wps.dll (file MISSING)
Protocol #2: wps.dll (file MISSING)
Protocol #3: wps.dll (file MISSING)
Protocol #4: wps.dll (file MISSING)
Protocol #5: wps.dll (file MISSING)
Protocol #6: wps.dll (file MISSING)
Protocol #7: wps.dll (file MISSING)
Protocol #8: wps.dll (file MISSING)
Protocol #9: wps.dll (file MISSING)
Protocol #10: wps.dll (file MISSING)
Protocol #11: wps.dll (file MISSING)
Protocol #12: wps.dll (file MISSING)
Protocol #13: wps.dll (file MISSING)
Protocol #27: wps.dll (file MISSING)

--------------------------------------------------
End of report, 10,038 bytes
Report generated in 0.170 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
 

Godzilha82

Thread Starter
Joined
Jan 8, 2003
Messages
33
Thanks Tony,

I couldn't get that to work for some reason. When I open the command prompt and type in command, for some reason I'm given a time reset function that won't let me enter any data. Is there any other way to get the file?

Thanks, Trevor
 
Joined
Aug 17, 2001
Messages
7,486
Check out the System32\dllcache folder. If there's a copy of the file in there, copy it to System32. You want to be sure to get the right version of this file for your IE version.
 
Joined
Aug 17, 2001
Messages
7,486
I see you have upgraded IE so you do not want to use the file version from your install CD.

Also Start>run type command to open the prompt. Then use the expand command .
However, you seem to have XP. You can expand a file using MSCONFIG. But not from the original CD. Use the Folder where SP1 is located.
 

Godzilha82

Thread Starter
Joined
Jan 8, 2003
Messages
33
Mosaic and Tony, thanks, I've fixed the problem! For anyone reading this thread who is interested. I found the inetcpl file in the following location:

C:\WINDOWS\ServicePackFiles\i386.

I copied it into my documents by dragging it from the i386 folder into a folder I named Inetcpl. I then copied from the Inetcpl folder that I created and pasted it back into the i386 folder. For some reason I couldn't do a "right click copy" from the i386 folder, windows said that the file was write protected.

Anywho, 1 problem down, 1 to go....Thanks to both of you guys for your help!
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top