Going to Kill a User

[Geek King]

And funnily enough, not the usual one.

After much time spent cleaning viruses off her computer when she decided the current screen savers were "too boring," I'm down to one problem I just can't seem to nail down. I thought I'd ask for help, if anyone has some ideas.

XP machine, IE6 (not the newer 7), all current updates applied. IE is putting itself into 'work offline' mode when attempting to open a website. The computer is on the network, and I can ping the DNS, the gateway, and Google. So I can get outside the network, just not with IE. Oh, and IE works from safe mode. I am suspecting malware of some sort, but can't seem to find reference to a fix that works yet.

I have run Spybot and Hijack This! against it so far, although I havn't had time to submit a report to the hijack boards--I got had to sit through six hours of presentations on CCTV cameras today. Kill me. Please. I plan on trying some other sweepers in the morning.

Before you spout up, Firefox is not an option. Some programs we use don't work with it, so I can't just foist her off to it for now. And before you tell me to cut her permissions, I'll just tell you I can't due to another program. I really wish we had some alternatives, but the market for what these programs do is tiny, so we're stuck with them.

Help appreciated. I'm going to go shoot something. Online.


Though, I'm tempted...

[rvdammit]

Only thing that jumps to mind is use Firefox to check that it is IE being fubared rather than something else.

[clowninasack]

I've had some luck by running the "internet connection wizard" from internet options > connections in a similar situation. Something was wonky and that wizard seemed to fix it.

[LostMyMind]

I can't see a malware that hides itself that well in normal mode not start-up to hide itself in safemode. However, try msconfig (compare it's startup with hijackthis). Do a selective bootup. Remove one item at a time from the startup list. Restart and if the removal of the one item lets IE6 connect again. Then that is your "malware" or offending program. (Some malware are now hiding from hijack this too. To get around this just rename the exe to some gibberish)

If none of the start-up programs is causing the problem. I think it's probably an registry problem. I would try clowninasack's suggestion. Otherwise, you'll have to hunt down every single registry entry that IE6 uses and delete them to force IE6 to remake them.

[Pedersen]

First guess? Check for a proxy server. If there's one set, and IE6 can't contact it for some reason, who knows what could happen.

[technical.angel]

PM me the hijack log?

[Geek King]

Well, the computer gods smiled on me, and the user had full functionality yesterday morning. I'm not sure what changed overnight, but everything is working now. Yes, I did reboot the day before. Both a quick restart and a shutdown with a full minute wait before turning it back on. I'm getting full credit for the fix by the building staff, so I should be glad that they don't know any better.

...but its going to drive me crazy that I don't know what the problem was.

Thanks for the suggestions, all!

[lordlundar]

I make a note to what's in one of my study guides:

"90% of all software problems can be solved by either restarting the machine or reformatting the machine."

It's a quote that has yet to fail me.

[technical.angel]

I think I put the latter at about 98.5%.