Web Content Zones missing in MSIE 6.02

Hello,
I believe my daughter has destroyed my computer, by visiting Japenese anime sites, but luckily Netscape has allowed me to get here if somebody can lend a hand with information.

Currently, if MSIE is launched, I get a "Activex is not enabled" warning, and after checking "OK", the browser just sits blank, flashing, and saying it's loading the homepage, but appears to be downloading SOMETHING, but a page never shows, so I close out, in case it's downloading some garbage.

When I go to the browsers settings, to change the zone setting, the box is blank and shows no zones at all, so I can't adjust the settings.

I've tried to run Macafee that is installed, but it too says activex isn't running, so it doesn't work. I also tried going to housetrend, but it won't work with Netscape 7.02, eventhough I installed the proggy it said would make it work.

So I can't scan for a virus, but boy it's acting like one. I've run spybot and adware and it cleaned what it found, but how do I get these Content zones back, so I can set security?
Thanks for any help.
Bill

 

Hye Bill....Welcome to Wilders,

While there is definetly a way to hide all Zone icons....I have never run across a post in the malware forums for instance concerning all icons missing

Having said that I'll kick off by asking a few questions and go from there.

Since you mention 6.02 I'll assume XP ?
If so....and if this PC has more than one user profile does it happen on all profiles ?

Will you mind going to various known sites....take your pick....sports, news, what not and tell us what icon you see in the bottom right corner of IE at those sites Please.

 

Hi Bubba, and thanks for the response.

I'm sorry - I should have given some particulars - I'm actually running Windows Millineium Edition, with MSIE 6.02.

Here's what I get when trying some sites:

ESPN.com or Yahoo.com - I get a fast "flashing" of the page, saying it's loading, but nothing ever loads - it's almost like it's trying to download, at a high rate of speed, numerous items, but it's just a white page. I close out, because it appears it might not be "good". The zone, in the right hand bottom, says "unknown zone". There's no icon or anything.

Funny enough, if I go to Symantec.com, it loads fine, and no problems.

Cnn.com, I get the flashing page again - just saying it's opening the page, over and over, with "downloading page" in between the flashes.

Any ideas?
Thanks,
Bill

 

In regards to Symantec....what Zone icon is showing bottom right when visiting that site?

Also....does CNN show an icon ?

For future reference the "unknown zone" does not have an icon. What that means is that certain items in the HTML code on that page references sites that are in your Restricted Zone.

In regards to WinME....there is only one user profile\logon ?

Before assuming wrongly that this is malware related have you attempted an IE repair ?

 

There is no icon on the bottom right at all, no matter where I go.

I only have one login user profile also.

I don't know how to run a repair on MSIE.
Thanks,
Bill

 

Hmmm....Ok. Well I am going to ask you to look in your registry at something if you do not mind. Please tell me what numbers you see in the right hand side while looking at the example pic below.

If you have never been in the registry go to Start button\Run....then type regedit

"http"=dword:00000003
"https"=dword:00000003
"ftp"=dword:00000003
"file"=dword:00000003
"@ivt"=dword:00000001

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults

 

Hi Ronjor,
Ran the 2nd option, completed the copy and rebooted - no changes.

Bill

 

In that HKEY, I don't have a directory called "Internet Settings" after "CurrentVersion" - Choices are: Applets, Control Folder, Explorer, GrpConv, Multimedia, Policies, Runonce, Telephony, and ShellNoRoam

I searched the registry for "Zonemap" and found it under HKEY_Local_Machine

The numbers match your photo.
Thanks,
Bill

Edit: Just to clarify, and path I found the Protocol Defaults is: HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults

 

Just came across this, but is this ok to delete the ENTIRE key like that?...I assume it will be recreated or something?

http://support.microsoft.com/?kbid=186890

Would like your guys opinions before I delete.
Thanks,
Bill

 

I was able to get THAT housetrends to work, and according to it, I don't have a virus, so the only other thing I can assume, is that some of the adware/malware that was on here, that was removed by search and destroy, adaware, etc, altered the browser security settings, and "locked them", before they were removed.

How can I get those zones back, so I can adjust my settings. My resident Macfee still can't work because activex is locked off, and I still can't use MSIE.
Thanks,
Bill

 

Hey Bill,

Unfortuantely I am not that well versed on WinMe and how it handles certain things. What has me scratching my head and Google searching is the fact that you are not seeing a Current_User Internet Settings key. That is IMHO one of the problems and until I can stumble on that info I am personally clueless at the moment.

It is as if all Internet Explorer settings have a policy set somewhere to use the Local_Machine settings but I am almost positive there should still be a Current_User key for Internet Explorer settings. Hopefully a WinMe user will drop by and shed some light on the missing puzzle piece

If you go into Add\Remove programs and select Internet Explorer does it then give you an option to attempt a repair ?

 

Yes, I ran the repair and it said it couldn't and to reinstall all components, which I did. It still didn't work. I've run that hijack program and looking through it and comparing some stuff to this forum, there a a couple entries in the log that might be from that URLSEARCHHOOK problem.

The first entry is this: R3 - URLSearchHook: (no name) - {0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file)


The 2nd interesting thing that shows in this log, is this:

O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone


Now, knowing I didn't move this, I don't know how to get it "back" to where it should be - is there some registry repair program or something?
Thanks,
Bill

 

That was one of the reasons I asked earlier about the Protocol Defaults key because I had a itchy feeling that would be the case. I made the choice at that time to not ask for a HJT log but to go the other route. What has me scrarching my head is the fact that you said earlier there was no Current_User Internet Settings key which is where HJT should have got that info from In case you were not aware....those 015 entries are saying to use MyComputer settings anytime you visit an HTTP site.

Long story short those 015 entries need to be fixed by HJT which will then place the proper number in respect to the below entries posted above.

"http"=dword:00000003
"https"=dword:00000003
"ftp"=dword:00000003
"file"=dword:00000003
"@ivt"=dword:00000001

3 means to use the Internet Zone settings unless a site has been placed in the Trusted\Restricted Sites list.

That in it self is not the end of your story IMHO and I am of the opinion that your issue would be best looked at by those HJT malware remover experts. Unfortunately we no longer provide that service , as per this announcement. Your best bet would be to post a log @ Castle Cops or some of the other Forums mentioned in the above Announcement.

 

OK, I'll post it over there - thanks alot for your help!
Bill

 

You are Welcome and Good Luck. Please keep us informed if you do not mind and if you wish to place a link where you posted I'll do what I can to assist further.

 

Thanks - here it is - I'm still stuck

http://castlecops.com/p642208-Web_Content_Zones_missing.html#642208

On a side note, I googled the following phrase and found I'm not the only one that has had this:

Googled: "O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone"

But I don't see a solution though, in people that have had the problem!
Thanks,
Bill

 

Hey Bill,

While you await further assistance by the good folks at CastleCops would you do a Edit\Find in your registry for all instances of @ivt Please. Make note of what location you find it in only for the locations that are showing a data value of 1....similar to the examples below in bold.

"http"=dword:00000001
"https"=dword:00000001
"ftp"=dword:00000001
"file"=dword:00000001
"@ivt"=dword:00000001

Also....would you mind exporting the below registry key that is in bold and uploading that file as an attachment to a post in this thread. You will be saving the file with a name you choose. It will make it a .reg file so before you upload it as an attachment change the .reg file extension to .txt Please.


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

 

Hi Bubba,
Ok - a search on IVT with a value of 1, was found at:

My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
CurrentVersion\Internet Settings\Zonemap
ProtocolDefaults

This is the first export I've done from the Registry editor, so I think it's right. See attached.
Thanks,
Bill

 

Sorry Bill I did not explain that to well

I used @IVT for ease of search on your part. Along with that find should have been the other entries(http,https,ftp,file). It's the location of those entries where they have a value of 1 that I was attempting to ask for. Sorry I was not clear in my request

As for the Billspolicyfile.txt file you uploaded....it was fine in regards to nothing in there should be causing a problem. Thanks for uploading it.

 

Hi Bill175,

Curious how you were making out over at CC .... is cox.net in fact your ISP (014 entry)? If so, no worries but could somehow be tied into the next item that caught my eye and one you should ask *steamwiz* about .......
your 017 entry. Mind you I'm no expert and your post is still young, so we shall see.

Edit: I decided to pull the screenie, no need ... CC's handling it.


GF

 

Hi GF,
Yes, Cox is my ISP - I'll mention that - thanks.
Bill

 

Since the poster above chose to "pull the screenie"....the post that was here is no longer applicable.