Browsers (IE6, Firefox, etc...) won't load certain pages

[bate_nasko]

Browsers (IE6, Firefox, etc...) won't load certain pages. Need help

Hi all,

My sister has Windows XP Home Edition on her desktop pc and recently she is having problems loading certain pages in any browser (Neither ie nor mozilla firefox works). For example, pages like the one below won't load completely:

http://www.hallmark.com/webapp/wcs/...DsList=-2;-102001;-102270;-102022&partNumber=

This is the page where a hallmark card is personalized. The fill-in menus don't load at all...


Another example is a page like www.expidia.com. When I try to load it on her computer, using either IE6 or MozF, I get the following message:

Please allow cookies
Cookies must be enabled before you can continue. To enable cookies, you need to.... [basically, set internet options/privacy/ to medium-high at the max]

Well, the problem is that that the privacy level is already set at medium and cookies should be accepted, but the problem still persists.

Any suggestions about what I should do to fix the problem? Thanks in advance for the help.

 

[tomrca]

open tools-optoions- and reset your options in privacies in firefox.perhaps that may correct

 

[Vigilante]

In IE, Tools-Options, Security Tab, can you click the "Default Level" button? Click this button for each of the icons on the top.

 

[bate_nasko]

Setting privacy or security settings to default doesn't work

Hi again,

Thank you for the replies. Of course, I tried to set the privacy and security settings to the default levels even before I posted here and it didn't work. Tried it again and there is no result.

I also updated windows and re-registered some .dll files (like Softpub.dll Wintrust.dll Initpki.dllDssenh.dll Rsaenh.dll Gpkcsp.dll Sccbase.dll Slbcsp.dll Cryptdlg.dll), as some other forums have suggested for opening secure sites and that didn't help either. Also tried turning off Windows Firewall for a while...

Any other suggestions? I am clueless as to what might be causing the problem. I doubt that it is the settings of one of the browsers, because the problem is the same with all of them. Any help will be highly appreciated. Thanks in advance.

 

[greenflash]

ur having this problem in both IE and firefox?

have u tried System restore to a previous fine working state?

 

[bate_nasko]

Can't restore windows to any previous point either

Yes, the problem occurs with all browsers (ie, firefox, navigator, advanced browser....). Tried to restore windows to a prevoius point and got the a message "Cannot restore Windows to [whatever] date". Tried a couple of dates in the last three months and it doesn't work with any of them...

Any other suggestions? thanks a lot...

 

[Vigilante]

Then the problem obviously lies lower down on the OSI model. If it effects all browsers then it is likely in your DNS. Perhaps do you have a proxy set? Is your hosts files clean?

Read this about posting a HJT log: https://www.techspot.com/vb/topic19133.html

HJT usually will usually show proxy and hosts entries.

 

[bate_nasko]

The HJT log file

I am posting the hijackthis log file. I have no idea how to read it. I thought hijcack this helps only with ad- and spy-ware; how is it going to help in my case?
Thanks again for the help.

 

[Vigilante]

HJT is a "general" scanner that finds things in a LOT of different areas in your system commonly used by malware. Most of which is good stuff, but bad stuff can lurk within, as is your case. Observe.

Running processes:
C:\WINDOWS\system32\ps2.exe (part of aurora spyware I believe)
C:\Program Files\Atguard\iamserv.exe (virus!!)

Open Task Manger (right click task bar or press CTRL-SHIFT-ESC)
Then END TASK on those two files, make sure they don't come back.

As for HJT, put a check in the boxes next to these and fix them.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
c:\Program Files\Common Files\Microsoft Shared\Stationery\Blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
c:\Program Files\Common Files\Microsoft Shared\Stationery\Blank.htm
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O23 - Service: WRQ IAM (iamServ) - WRQ, Inc. - C:\Program
Files\Atguard\iamserv.exe
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner -
C:\WINDOWS\system32\msCMTSrvc.exe

-----------------

Once the processes are closed and you fix the entries with HJT; double check that they don't come back, if they do, you'll have to do more advanced techniques. Here is some homework for you!

Learn about HJT - http://www.bleepingcomputer.com/forums/index.php?showtutorial=42
It's a big page and will take time to load.

Help cleaning Aurora: https://www.techspot.com/vb/topic27710.html

Help with coolwebsearch: https://www.techspot.com/vb/topic17297.html

Try to follow all instruction. Whenever you find a bad file, write it down and make sure it is deleted.

Hope that helps.

 

[RealBlackStuff]

Do NOT delete those PS2.exe and IAMSERV.exe!

They are perfectly legal!

Just run CWShredder first and let HJT 'fix' all the R0, R1 and O16 entries.

 

[bate_nasko]

Eureka!!! Problem solved

I was starting to get a bit frustrated with the problem but finally solved it...

As it turned out, the program AtGuard was most probably causing the problem. Thanks Vigilante, for turning my attention to the file iamserv.exe. I figured it wasn't a virus because RealBlackStuff suggested it and because when I googled the file I saw that trojans try to block it (plus, it was in the AtGuard directory and antivirus software wasn't detecting it)... Still, I tried to terminate iamserv.exe from the task manager and observed that internet was working properly but the sites that weren't loading fully before or that required cookies now were not loading at all (browser was loading them with no progress). So I figured that iamserv.exe file might have something to do with it and since it was at the AtGuard folder and I am sure my sister doesn't use the program, I simply uninstalled it...

That is it. Now all pages load properly. MANY THANKS for the help and suggestions!!!

 

[Vigilante]

Okay, my bad. I didn't spend a ton of time researching. I see atguard is a firewall. But when I looked up iamserv.exe I just got pages and pages with references to a virus, so naturally I assumed...

As for PS2, ya it's part of HP upon further checking. But I can tell you for sure that there is a certain spyware, perhaps CWS or something else, which uses the "PS2" name for one of its files. Again I assumed.

Guess I won't be to quick next time. Sorry, and glad it's fixed!