IE crashes when exiting - limited account

[Guest]

I have a customer's pc running xp home sp2 w/all windows critical/security
updates as of 10/29/04. When I exit IE6.0.2900.2180 while logged in on a
limited account, IE crashes every time (IE has encountered an error). If I do
the same while logged in on an account with admin priveleges, no problem.
The original reason that the machine came into the shop was to be cleaned of
scumware infection, and hijackthis shows there is nothing odd being loaded in
global registry sections that would apply to a limited account .

I have seen some reports of this same problem on the internet, but no one
seems to know what the cause is or how to fix it. In one case, the problem
had not been seen on the limited account, and then it appeared and exhibits
the same characteristics as what I am seeing, so it might be that this
surfaces as a result of some update (sp2?)

I do have an xp home sp2 bench machine that does not exhibit the error on a
limited account, but it does not have the post-sp2 updates, so I will try
that next week.

 

[Don Varnau]

Hi,
I would be looking for malware even though the HijackThis log looks clean.
BHODemon 2.0: http://www.definitivesolutions.com/bhodemon.htm would be a
good first step.
Then [1] CWShredder [2] Ad-awareSE [3] Spybot
See: http://mvps.org/winhelp2002/unwanted.htm
Additional information at:
The Parasite Fight http://www.aumha.org/a/quickfix.htm
More security tips at http://www.aumha.org/a/parasite.htm
Bugs, Glitches & Stuffups: http://www.mvps.org/inetexplorer/Darnit.htm

You might also disable, for diagnostic purposes, any legitimate program that
would be interacting with IE. Look at ad-blockers, AV, security/privacy
programs, etc. One of those programs may need to be reinstalled or may need
an update to work with SP2.

Hope this helps,
Don

 

[Guest]

I hadn't mentioned it, but it is my standard procedure to run cwshredder and
spybot 1.3 w/latest signatures. I haven't seen a case where hijackthis failed
to list a BHO, etc, since it parses these things from the registry. Do you
know otherwise?

No adblockers/popupstoppers were running. If it were a conflict with some
program that is not somehow sp2 compliant, it would seem strange that it
would only surface when logged onto the limited account, which in theory at
least, is less permissive of what is allowed to run.

This machine is no longer in the shop and the customer stated that she does
not surf using the limited account, so no further action is possible at this
time, with that machine.

Jerry

Hi,
I would be looking for malware even though the HijackThis log looks clean.
BHODemon 2.0: http://www.definitivesolutions.com/bhodemon.htm would be a
good first step.
Then [1] CWShredder [2] Ad-awareSE [3] Spybot
See: http://mvps.org/winhelp2002/unwanted.htm
Additional information at:
The Parasite Fight http://www.aumha.org/a/quickfix.htm
More security tips at http://www.aumha.org/a/parasite.htm
Bugs, Glitches & Stuffups: http://www.mvps.org/inetexplorer/Darnit.htm

You might also disable, for diagnostic purposes, any legitimate program that
would be interacting with IE. Look at ad-blockers, AV, security/privacy
programs, etc. One of those programs may need to be reinstalled or may need
an update to work with SP2.

Hope this helps,
Don
--
MVP IE/OE
Please reply to the newsgroup so that others may participate.

I have a customer's pc running xp home sp2 w/all windows critical/security
updates as of 10/29/04. When I exit IE6.0.2900.2180 while logged in on a
limited account, IE crashes every time (IE has encountered an error). If I do
the same while logged in on an account with admin priveleges, no problem.
The original reason that the machine came into the shop was to be cleaned of
scumware infection, and hijackthis shows there is nothing odd being loaded in
global registry sections that would apply to a limited account .

I have seen some reports of this same problem on the internet, but no one
seems to know what the cause is or how to fix it. In one case, the problem
had not been seen on the limited account, and then it appeared and exhibits
the same characteristics as what I am seeing, so it might be that this
surfaces as a result of some update (sp2?)

I do have an xp home sp2 bench machine that does not exhibit the error on a
limited account, but it does not have the post-sp2 updates, so I will try

that next week.