Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Internet pages displayed as intranet


  • Please log in to reply
36 replies to this topic

#1 badmonkey

badmonkey

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:08:14 PM

Posted 30 November 2004 - 06:50 PM

Dear Bleeping Newsgroup,

in my regular user account in IE all internet pages (google, cnn, etc...) are in my local intranet security zone even though they naturally shouldn't be. In all of my other accounts (admin. and other regular user) on that machine, those same webpages are correctly classified as being in the internet zone.

I have run Ad-Aware, Spybot S&D, Antivirus and also posted my HijackThis log on aumha with no problems found.
(http://forum.aumha.org/viewtopic.phpt=8204&start=0&postdays=0&postorder=asc&highlight=)

When I googled around I found the same problem being asked at experts-exchange, but I would need to sign-up and pay a monthly fee to see the answer.

Any ideas would be greatly appreciated.

badmonkey

Windows XP SP2

BC AdBot (Login to Remove)

 


#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:14 AM

Posted 01 December 2004 - 05:04 PM

Do me a favor and post a hijackthis log so I can see what is running on your computer. When you have posted it, post the link to it here as a reply and I will take a look.

Also if you click on Tools, Internet options in IE, and then click on security and then click on the Local Intranet icon and press the Sites button..tell me what is checked

#3 badmonkey

badmonkey
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:08:14 PM

Posted 01 December 2004 - 08:29 PM

Thanks for the prompt reply.

I posted what you requested (HJ Log), after having run a full system scan with Ad-Aware and Spybot S&D.

As for what is checked in the /Internet Options/Security/Local Intranet/Sites
all check boxes have a check in them. I have tried all possible combinations of checked/unchecked per request of aumha to no avail. Sorry :thumbsup:

Hope this helps.
Badmonkey

#4 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:14 AM

Posted 01 December 2004 - 10:03 PM

Forgot to ask if you are running xp pro or home

#5 badmonkey

badmonkey
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:08:14 PM

Posted 01 December 2004 - 10:16 PM

XP Pro SP2

I like being hyperupdated :thumbsup:

#6 raw

raw

    Bleeping Hacker


  • Members
  • 2,577 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas
  • Local time:11:14 PM

Posted 01 December 2004 - 10:37 PM

Welcome to BC. Couldn't resist posting after i saw your user name.:thumbsup:

Posted Image

rawsig.png

 rawcreations.net          @raw_creations


Current systems: WHAT OS, BackTrack-raw, PCLinuxOS, Peppermint OS 6, Kali Linux

and a custom Linux From Scratch server hosting a bunch of top secret stuff.


#7 badmonkey

badmonkey
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:08:14 PM

Posted 01 December 2004 - 10:44 PM

:flowers:

bring it on!

:thumbsup:

#8 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:14 AM

Posted 01 December 2004 - 11:18 PM

What is it about monkeys and unix users!!! Still dont get it, but all my sysadmins have monkeys all over the place..

Are you using a proxy?

Gonna look into group policy settings tomorrow when I can get on a XP pro machine. Do me a favor and bump this topic if you do not hear from me

#9 badmonkey

badmonkey
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:08:14 PM

Posted 01 December 2004 - 11:56 PM

hehe, well unix people love monkeying around with code

for me it is just because you put a piece of electronic equipment in my hands and I will monkey with it for hours :thumbsup:

The closest thing I have to a proxy server is a router that I am behind (this problematic machine is a home pc).

I noticed the problem about a week or so after I upgraded to SP2. The pop-up blocker worked fine. But then one day I noticed that it wouldn't block ANY pop ups anymore (even on the highest setting). After googeling around I found out that the blocker doesn't block pop ups either for trusted sites or sites in the local intranet zone. That is when I noticed that all of my websites were being displayed in the local intranet zone. It's not such a big deal - I use firefox now as well (just sick and tired of dealing with this malware problem) - I just don't like it when things don't work the way they should. Naturally the brute force way would be to just recreate my regular user account - but I just would like to know how this happened.

Bye the way, what do you mean with

Do me a favor and bump this topic if you do not hear from me


Thanks,
badmonkey

#10 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:14 AM

Posted 02 December 2004 - 02:32 PM

Bump means to just make a reply to this topic that contains the word bump, so that I get an email reminding me to get off my butt and research this more :thumbsup: Effectively what your post above just did...

I think i found it. Open regedit and tell me what you have the following registry value set to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\\http

Is it set to 1 by chance? Change it to 3 and you should now have all your sites in the normal Internet zone.

#11 badmonkey

badmonkey
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:08:14 PM

Posted 02 December 2004 - 04:47 PM

I just checked and saddly it is already set to 3. Sorry :thumbsup:

#12 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:14 AM

Posted 02 December 2004 - 05:09 PM

GRRRRRRRR............ i thought we had this one!

What are they all set to ? Is it set to, 3,3,3,3,1,0?

#13 badmonkey

badmonkey
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:08:14 PM

Posted 03 December 2004 - 05:00 PM

Sorry for not responding sooner - I didn't get an email notifying me of a new post :thumbsup:

Anyway, here are the various keys in the order they appear:

(Default) = nothing
@ivt = 1
file = 3
ftp = 3
http = 3
https = 3
shell = 0

all of the keys are REG_DWORD except for (Default) which is a REG_SZ

Badmonkey

#14 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,542 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:14 AM

Posted 03 December 2004 - 05:08 PM

What is the value of this key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\\DisplayName

and

HKEY_USERS\S-1-5-21-73586283-1343024091-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\IntranetName

#15 badmonkey

badmonkey
  • Topic Starter

  • Members
  • 50 posts
  • OFFLINE
  •  
  • Local time:08:14 PM

Posted 03 December 2004 - 05:41 PM

For the first key:

Internet

(sorry no luck there)

As for the second key - it doesn't exist. I only have:

S-1-5-21-1957994488-16771283-1202660629-1005

S-1-5-21-1957994488-16771283-1202660629-1005_Classes

S-1-5-21-1957994488-16771283-1202660629-1007

(don't know where you got that key from) but here are the values:

...-1005: IntranetName = 1

...-1007: IntranetName = 1

Hope this helps in some way :thumbsup:

Badmonkey




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users