Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

No web access with IE - Firefox OK


  • Please log in to reply
1 reply to this topic

#1 joemcmahon

joemcmahon

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:45 AM

Posted 17 May 2010 - 02:58 PM

I'm trying to clean up a friend's laptop, and I'm discovering a strange behavior for IE. Any site I try to bring up in IE fails with a "connection" error - UNLESS - the site has a username and password field on it, in which case the site's page renders properly. I'm sure the laptop is infected with some type of trojan. I've run various spyware detection/removal utilities, but to no avail.

I've uninstalled IE 7 and installed IE 8 thinking this might clear it up, but, alas, no. Using Firefox, I'm able to bring up any site with no problems. I'm avoiding username/password sites for now.

Any help or suggestions is greatly appreciated.

Edit: Moved topic from XP to the more appropriate forum, due to mention of probable malware presence. ~ Animal

BC AdBot (Login to Remove)

 


#2 joemcmahon

joemcmahon
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:45 AM

Posted 18 May 2010 - 06:23 PM

Well, I found the problem. Turns out that the spyware/malware must have been partially removed, and left some baggage at the door. The LAN settings for IE had a proxy server address defined for HTTP requests. Its value was 127.0.0.1 port 5555. The "Secure" proxy server address was not defined, and therefore HTTPS requests went out OK. There must have been a program running listening to port 5555 for HTTP requests, and doing its dastardly dirty deeds before forwarding the request on to its final destination.

I found this out rather serendipitously. When installing SpyBot, it failed to "phone home" for updates, and the error message generated by the SpyBot installer highlighted the failed 127.0.0.1:5555 attempt.

It's too bad that the spyware/malware removal programs are not looking for these localhost proxy server settings - and, at the least, issuing a warning.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users