1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

IE6 Internet Options Restriction

Discussion in 'Windows XP' started by Godzilha82, Jan 8, 2003.

Thread Status:
Not open for further replies.
  1. Godzilha82

    Godzilha82 Thread Starter

    Jan 8, 2003
    IE6, toolbar, tools, internet options, this operation has been cancelled due to restriction on this computer. This is the version, location, option and error message when I try to access my internet options on the IE tool bar. I cannot access the options from either here or the control panel. How can I change the restrictions to allow me to edit my options. It is my home computer, I'm the only administrator. I've followed similar threads for other OS's. There is no "NoBrowserOption" in the registry.
  2. TonyKlein

    TonyKlein Malware Specialist

    Aug 26, 2001
  3. Godzilha82

    Godzilha82 Thread Starter

    Jan 8, 2003
    Thanks for your help Tony, but no luck. I had no returns on both of those searchs. I also went to the MS Knowledge base that you recommended and found something unusual. When I go to the following section in my registry:


    There is no folder(?) for Internet Explorer. I only have 2 folders located in the Microsoft folder and they are "Office" and "System Certificates". Any ideas?

    Thanks again for your help.

  4. TonyKlein

    TonyKlein Malware Specialist

    Aug 26, 2001
    These subkeys only exist at that location if restrictions have been imposed.
    They're not there in a default Windows installation, so by itself that's normal.

    Would you try this, please (quick and dirty):

    Close Internet Explorer.

    Now download the attached Remove.txt, save as (rename to) Remove.reg, and doubleclick.

    Answer 'yes' when you're asked whether you'd like to have the contents of your reg file merged into the registry, and a great number of restrictions, if you have them, will be removed.

    If you don't have any, the file won't do anything, so there's absolutely no risk at all.

    After running the regfile, you'll want to reboot.

    Tell us whether that makes a difference.

    Attached Files:

  5. Godzilha82

    Godzilha82 Thread Starter

    Jan 8, 2003
    Thanks again, Tony....still no luck. I still can't get into my internet options from IE6 or from the control panel. Further, for some reason, there is no icon next to "Internet Options" in the "Network and Internet Connections" section of the XP Control Panel. I had an extensive chat with MS tech support last night and what we both think is that possibly I've been the victim of a Trojan....Xupiter or some derivative thereof. The only other symptom that I can relate is that there is an unexplained icon in the IE6 bottom tray (for lack of the correct word) that I can't get rid of. When I do a C drive search for "xt update", I get 2 files returned:

    IFxTextureUpdate.class in folder com/ms/fx

    When I open the containing folder, I see the same icon that is in the bottom tray of IE6 that I can't explain.

    Any Ideas??

  6. TonyKlein

    TonyKlein Malware Specialist

    Aug 26, 2001
    Well, that would point into the direction of the MS article being right: a missing or corrupted inetcpl.cpl.

    Would you please do this first:

    Go to http://www.spywareinfo.com/downloads.php#det , and download 'Hijack This!'.
    Unzip, doubleclick HijackThis.exe, and hit "Scan".

    When the scan is finished, the "Scan" button will change into a "Save Log" button.
    Press that, save the log somewhere, and please show us its contents.

    Next, press "Config" > "Miscellaneous Tools", and press "Generate Startuplist Log"

    This will generate a text file that will list all running processes, all applications that are loaded automatically when you start Windows, and more.

    Go to Edit > select all, copy it and post its contents here as well.
  7. Godzilha82

    Godzilha82 Thread Starter

    Jan 8, 2003
    OK Tony, here goes.....

    Here's the result of the initial scan:

    Logfile of HijackThis v1.90.0
    Scan saved at 11:26:43 AM MI, on 1/8/2003
    Platform: Windows NT 5.01.2600
    MSIE version: 6.0.2800.1106

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://my.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://home.netscape.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://home.netscape.com/home/winsearch200.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default)=http://keyword.netscape.com/keyword/%s
    O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O10 - Broken Internet access because of LSP provider 'wps.dll' missing
    O15 - Trusted Zone: http://free.aol.com
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2002121801/housecall.antivirus.com/housecall/xscan53.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as/asinst.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37626.7547916667
    O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://www.virtualvegas.com/cab/WONWebLauncherControl.cab
    O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F89D69D2-0C80-11D4-B67E-0050DA271F38} (eStreamIE Class) - http://www.elanguage.com/media/eStream/eStream.cab
    O18 - Protocol: ms-its51 - {F6F1E82D-DE4D-11D2-875C-0000F8105754}

    And here's the result of the Startuplist Log:

    StartupList report, 1/8/2003, 11:30:49 AM MI
    StartupList version: 1.50
    Started from : C:\Documents and Settings\Owner\My Documents\SpyBots\Hijack This\hijackthis\HijackThis.EXE
    Detected: Windows XP SP1 (WinNT 5.01.2600)
    Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    * Using default options

    Running processes:

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\Roxio\GoBack\GBPoll.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\Program Files\Sygate\SPF\Smc.exe
    C:\Program Files\Creative\ShareDLL\CtNotify.exe
    C:\Program Files\Creative\ShareDLL\MediaDet.Exe
    C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Roxio\GoBack\GBTray.exe
    C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
    C:\Program Files\Nikon\NkView5\NkvMon.exe
    C:\Program Files\Intuit\QuickBooks Basic\Components\QBAgent\qbdagent2002.exe
    C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
    C:\Program Files\MailWasher\MailWasher.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Owner\My Documents\SpyBots\Hijack This\hijackthis\HijackThis.exe


    Listing of startup folders:

    Shell folders Startup:
    [C:\Documents and Settings\Owner\Start Menu\Programs\Startup]
    OptiCAL Startup.lnk = C:\Program Files\PANTONE COLORVISION\OptiCAL\OptiCAL.exe

    Shell folders Common Startup:
    [C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
    Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    EPSON Status Monitor 3 Environment Check(2).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
    GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
    gwum.lnk = C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
    Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    Microsoft Works Calendar Reminders.lnk = ?
    MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
    NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
    QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Basic\Components\QBAgent\qbdagent2002.exe
    Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE

    Thanks again for your Help!



    Checking Windows NT UserInit:

    [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    UserInit = C:\WINDOWS\system32\userinit.exe,


    Autorun entries from Registry:

    MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
    LDM = C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe


    Enumerating Active Setup stub paths:
    HKLM\Software\Microsoft\Active Setup\Installed Components
    (* = disabled by HKCU twin)

    StubPath = C:\WINDOWS\INF\unregmp2.exe /ShowWMP

    [>{26923b43-4d38-484f-9b9e-de460746276c}] *
    StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

    [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
    StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

    [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
    StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

    StubPath = "C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser

    [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
    StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

    [{7790769C-0471-11d2-AF11-00C04FA35D02}] *
    StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

    [{89820200-ECBD-11cf-8B85-00AA005B4340}] *
    StubPath = regsvr32.exe /s /n /i:U shell32.dll

    [{89820200-ECBD-11cf-8B85-00AA005B4383}] *
    StubPath = %SystemRoot%\system32\ie4uinit.exe


    Load/Run keys from C:\WINDOWS\WIN.INI:


    Load/Run keys from Registry:

    HKLM\..\Windows NT\CurrentVersion\WinLogon: load=
    HKLM\..\Windows NT\CurrentVersion\WinLogon: run=
    HKLM\..\Windows\CurrentVersion\WinLogon: load=
    HKLM\..\Windows\CurrentVersion\WinLogon: run=
    HKCU\..\Windows NT\CurrentVersion\WinLogon: load=
    HKCU\..\Windows NT\CurrentVersion\WinLogon: run=
    HKCU\..\Windows\CurrentVersion\WinLogon: load=
    HKCU\..\Windows\CurrentVersion\WinLogon: run=
    HKCU\..\Windows NT\CurrentVersion\Windows: load=
    HKCU\..\Windows NT\CurrentVersion\Windows: run=
    HKLM\..\Windows NT\CurrentVersion\Windows: load=
    HKLM\..\Windows NT\CurrentVersion\Windows: run=
    HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=NVDESK32.DLL


    Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

    *INI section not found*
    *INI section not found*
    *INI section not found*

    Shell & screensaver key from Registry:

    *Registry value not found*

    Policies Shell key:

    HKCU\..\Policies: *Registry key not found*
    HKLM\..\Policies: *Registry key not found*


    Checking for EXPLORER.EXE instances:

    C:\WINDOWS\Explorer.exe: PRESENT!

    C:\Explorer.exe: not present
    C:\WINDOWS\Explorer\Explorer.exe: not present
    C:\WINDOWS\System\Explorer.exe: not present
    C:\WINDOWS\System32\Explorer.exe: not present
    C:\WINDOWS\Command\Explorer.exe: not present


    Checking for superhidden extensions:

    .lnk: HIDDEN! (arrow overlay: yes)
    .pif: HIDDEN! (arrow overlay: yes)
    .exe: not hidden
    .com: not hidden
    .bat: not hidden
    .hta: not hidden
    .scr: not hidden
    .shs: HIDDEN!
    .shb: HIDDEN!
    .vbs: not hidden
    .vbe: not hidden
    .wsh: not hidden
    .scf: HIDDEN! (arrow overlay: NO!)
    .url: HIDDEN! (arrow overlay: yes)
    .js: not hidden
    .jse: not hidden


    Enumerating Task Scheduler jobs:

    Norton AntiVirus - Scan my computer.job
    Symantec NetDetect.job


    Enumerating Download Program Files:

    [sys Class]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\PCPitStop.dll
    CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

    [YInstStarter Class]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll
    CODEBASE = http://download.yahoo.com/dl/installs/yinst.cab

    [HouseCall Control]
    InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocx
    CODEBASE = http://a840.g.akamai.net/7/840/537/2002121801/housecall.antivirus.com/housecall/xscan53.cab

    [ActiveScan Installer Class]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
    CODEBASE = http://www.pandasoftware.com/activescan/as/asinst.cab

    [Update Class]
    InProcServer32 = C:\WINDOWS\System32\iuctl.dll
    CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37626.7547916667

    [WONWebLauncher Class]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\WONWebLauncherControl.ocx
    CODEBASE = http://www.virtualvegas.com/cab/WONWebLauncherControl.cab

    [ContentAuditX Control]
    InProcServer32 = C:\WINDOWS\DOWNLO~1\CONTEN~1.OCX
    CODEBASE = http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab

    [Shockwave Flash Object]
    InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    [eStreamIE Class]
    InProcServer32 = C:\WINDOWS\Downloaded Program Files\IEeStream.dll
    CODEBASE = http://www.elanguage.com/media/eStream/eStream.cab


    Enumerating Winsock LSP files:

    Protocol #1: wps.dll (file MISSING)
    Protocol #2: wps.dll (file MISSING)
    Protocol #3: wps.dll (file MISSING)
    Protocol #4: wps.dll (file MISSING)
    Protocol #5: wps.dll (file MISSING)
    Protocol #6: wps.dll (file MISSING)
    Protocol #7: wps.dll (file MISSING)
    Protocol #8: wps.dll (file MISSING)
    Protocol #9: wps.dll (file MISSING)
    Protocol #10: wps.dll (file MISSING)
    Protocol #11: wps.dll (file MISSING)
    Protocol #12: wps.dll (file MISSING)
    Protocol #13: wps.dll (file MISSING)
    Protocol #27: wps.dll (file MISSING)

    End of report, 10,038 bytes
    Report generated in 0.170 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only
  8. TonyKlein

    TonyKlein Malware Specialist

    Aug 26, 2001
  9. Godzilha82

    Godzilha82 Thread Starter

    Jan 8, 2003
    Thanks Tony,

    I couldn't get that to work for some reason. When I open the command prompt and type in command, for some reason I'm given a time reset function that won't let me enter any data. Is there any other way to get the file?

    Thanks, Trevor
  10. Mosaic1


    Aug 17, 2001
    Check out the System32\dllcache folder. If there's a copy of the file in there, copy it to System32. You want to be sure to get the right version of this file for your IE version.
  11. Mosaic1


    Aug 17, 2001
    I see you have upgraded IE so you do not want to use the file version from your install CD.

    Also Start>run type command to open the prompt. Then use the expand command .
    However, you seem to have XP. You can expand a file using MSCONFIG. But not from the original CD. Use the Folder where SP1 is located.
  12. Godzilha82

    Godzilha82 Thread Starter

    Jan 8, 2003
    Mosaic and Tony, thanks, I've fixed the problem! For anyone reading this thread who is interested. I found the inetcpl file in the following location:


    I copied it into my documents by dragging it from the i386 folder into a folder I named Inetcpl. I then copied from the Inetcpl folder that I created and pasted it back into the i386 folder. For some reason I couldn't do a "right click copy" from the i386 folder, windows said that the file was write protected.

    Anywho, 1 problem down, 1 to go....Thanks to both of you guys for your help!
  13. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Similar Threads - Internet Options Restriction
  1. Rose789
  2. dragster1981
  3. vbivins
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/112114

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice