My IE 6 / Windows 2000 security is broken

J

Jerry McEwen

Greetings, if I go to a site and add a filename or /folder name that
doesn't exist, I get this error message:

"Your current security settings prohibit running ActiveX controls on
this page. As a result, the page may not display correctly."

This happens on both www sites and locally as I test websites.

I use Apache 1.3.29, not IIS, and ApacheÕs default 404 page contains
no ActiveX. A valid address such as http://localhost/Salon/ comes up
just fine (with a directory listing, I have no default page set in
httpd.conf), but if I add some garbage to the end, such as
http://localhost/Salon/bogus, I get the ActiveX error message.

I am on Win2000 Pro with all current updates. IE is 6.0.2800.1106 and
security is set to default (medium). Security settings on default
(medium) have always allowed ActiveX in the past. I started with
medium/default and then changed every setting that was not "allow" to
"prompt." I even ran my security down to low and I still get the error
message.

Before you tell me how bad IE is, Firefox is my default browser and
Eudora is my default email app, but I still need for IE to work
correctly.

Does anyone know how to fix this? Thanks!
 
R

Robert Aldwinckle

ApacheÕs default 404 page contains no ActiveX.

It must contain something which is being misinterpreted as ActiveX?

Sample server?

A valid address such as http://localhost/Salon/ comes up
just fine (with a directory listing, I have no default page set in
httpd.conf), but if I add some garbage to the end, such as
http://localhost/Salon/bogus, I get the ActiveX error message.
Click to expand...

Try disabling the FTP folder view feature?
 
J

Jerry McEwen

It must contain something which is being misinterpreted as ActiveX?
Click to expand...

I have no default 404 page in my Apache config, so the only thing this
could be calling would be in shadowdoc.dll (or whatever it's called)
or something similar. In other words, it's part of my OS/IE.

Sample server?
Click to expand...
http://thisishome.net/ is mine.

http://thisishome.net/dddd doesn't exist and should call the 404, but
instead invokes the ActiveX error message.
Try disabling the FTP folder view feature?
Click to expand...

Thanks, but that did not change anything.
 
R

Robert Aldwinckle

Jerry McEwen said:
I have no default 404 page in my Apache config, so the only thing this
could be calling would be in shadowdoc.dll (or whatever it's called)
or something similar. In other words, it's part of my OS/IE.
Click to expand...

Are you still using the Show friendly HTTP error messages option?

Here is what I get with the below invalid link:

<View Source>
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>404 Not Found</TITLE>
</HEAD><BODY>
<H1>Not Found</H1>
The requested URL /dddd was not found on this server.<P>
<P>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.
<HR>
<ADDRESS>Apache/1.3.31 Server at www.thisishome.net Port 80</ADDRESS>
</BODY></HTML>

</View Source>


telnet confirms that this is what your server sends for this request.


HTH

Robert
---
 
J

Jerry McEwen

Are you still using the Show friendly HTTP error messages option?

Here is what I get with the below invalid link:

<View Source>
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>404 Not Found</TITLE>
</HEAD><BODY>
<H1>Not Found</H1>
The requested URL /dddd was not found on this server.<P>
<P>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.
<HR>
<ADDRESS>Apache/1.3.31 Server at www.thisishome.net Port 80</ADDRESS>
</BODY></HTML>

</View Source>


telnet confirms that this is what your server sends for this request.


HTH

Robert
Click to expand...

Thanks, Robert, I don't have access to httpd.conf on thisishome.net,
but I do locally. I don't find the word "friendly" in that document,
but maybe this will help you help me.

http://localhost/ARC_Pickup is valid;
http://localhost/ARC_Pickup/dddddd is not.

My Apache error log shows the same thing in both IE and Firefox, which
is this:

[Sun Nov 14 12:20:21 2004] [error] [client 127.0.0.1] File does not
exist: f:/webs/_webs/arc_pickup/dddddd

I get the default page cannot be found in IE with this image:
res://C:\WINNT\system32\shdoclc.dll/pagerror.gif

In Firefox, I get the default 404;
Not Found
The requested URL /ARC_Pickup/dddddd was not found on this server.

Apache/1.3.29 Server at jerry Port 80
(ServerName = jerry)

I don't know whether or not that tells you anything, do you care to
see my httpd.conf? If so, it's at
http://www.coolcats.com/news/httpd.conf.txt

Thanks again. :)
 
R

Robert Aldwinckle

Thanks, Robert, I don't have access to httpd.conf on thisishome.net,
but I do locally. I don't find the word "friendly" in that document,
but maybe this will help you help me.
Click to expand...

That is the text label for an IE option in the Options, Advanced tab.
The unfortunate default is to have it checked which is what your
symptom is implying that you have. Since the "friendly 404"
is extracted from a .dll and since there are new rules regarding security
zones it's possible that there is now a conflict with it which results
in an erroneous message. If you uncheck it then IE will show you the
HTML that your server is sending with the 404 response.
That HTML is what I included in my previous reply labelled View Source
and it appears to be what FireFox is showing you by default too.


HTH

Robert
---
 
J

Jerry McEwen

I should also note that I get error messages in Word '97 help. When I
open help and click on any link, I get the related text, but also get
the ActiveX warning, even with IE's security settings run as low as
they will go.
 
J

Jerry McEwen

I should also note that I get error messages in Word '97 help. When I
open help and click on any link, I get the related text, but also get
the ActiveX warning, even with IE's security settings run as low as
they will go.
Click to expand...

Oops, I meant Word 2000.
 
J

Jerry McEwen

That is the text label for an IE option in the Options, Advanced tab.
Click to expand...

I *knew* that sounded familiar, now it is unchecked.
The unfortunate default is to have it checked which is what your
symptom is implying that you have. Since the "friendly 404"
is extracted from a .dll and since there are new rules regarding security
zones it's possible that there is now a conflict with it which results
in an erroneous message. If you uncheck it then IE will show you the
HTML that your server is sending with the 404 response.
That HTML is what I included in my previous reply labelled View Source
and it appears to be what FireFox is showing you by default too.
Click to expand...

Well, thanks, now the friendly URL thing is no longer a mystery to me,
but I just learned that I see the same ActiveX error message in Word
2000 Help (F1). Help has these little back/front arrows <> and they
too invoke the message.

I obviously haven't figured out how to fix this and appreciate all
your help. My gut feeling, which may be wrong of course, is that there
is a corrupt or wrong version file or some VBScript engine problem.

I don't have a lot of software on this machine (Dreamweaver MX,
Fireworks MX, Photoshop 7, Pagemaker 7, TopStyle) and everything was
working fine until a week ago. I have had the same programs running on
various computers for several years without problems, so I really
think this has to do with a corrupt file. I would be happy to be wrong
or right as the case may be, if only I could get this fixed. I really
do need to have IE working properly.

Thanks, Robert.
 
R

Robert Aldwinckle

....
Well, thanks, now the friendly URL thing is no longer a mystery to me,
but I just learned that I see the same ActiveX error message in Word
2000 Help (F1). Help has these little back/front arrows <> and they
too invoke the message.
Click to expand...

Unlike the first one this symptom is probably justifiable;
so although the symptoms are the same the problems they represent
are probably quite unrelated.

First of all, make sure that you are using Default security settings
for the zone concerned. Is it showing Internet zone before you
click on a link or something else?

Next, what version of hhctrl.ocx do you have?
I don't have your OS but at one point each time a cumulative update
for IE came out I had to reapply 811630 and re-register that module
in order to get certain Help functions to work.

<title>KB811630 - HTML Help Update to Limit Functionality When It Is Invoked with the window.showHelp( ) Method</title>

Notice that hhctrl.ocx is an ActiveX extension so in this case if your
security settings disallow ActiveX your problem symptom is correct.

In some cases reinstalling 811630 may be enough to apply the mod.
(e.g. the re-registration was something I did not have to do every time
I reapplied it.) I'm now on XPsp2 which thankfully has these versions
superseded. I notice that the article claims that the problem was
first corrected in your OS by W2000sp4; so if you have that and the
correct modules try the re-registration yourself:

regsvr32 hhctrl.ocx


HTH

Robert
---
 
R

Robert Aldwinckle

....
Well, thanks, now the friendly URL thing is no longer a mystery to me,
but I just learned that I see the same ActiveX error message in Word
2000 Help (F1). Help has these little back/front arrows <> and they
too invoke the message.
Click to expand...

Unlike the first one this symptom is probably justifiable;
so although the symptoms are the same the problems they represent
are probably quite unrelated.

First of all, make sure that you are using Default security settings
for the zone concerned. Is it showing Internet zone before you
click on a link or something else?

Next, what version of hhctrl.ocx do you have?
I don't have your OS but at one point each time a cumulative update
for IE came out I had to reapply 811630 and re-register that module
in order to get certain Help functions to work.

<title>KB811630 - HTML Help Update to Limit Functionality When It Is Invoked with the window.showHelp( ) Method</title>

Notice that hhctrl.ocx is an ActiveX extension so in this case if your
security settings disallow ActiveX your problem symptom is correct.

In some cases reinstalling 811630 may be enough to apply the mod.
(e.g. the re-registration was something I did not have to do every time
I reapplied it.) I'm now on XPsp2 which thankfully has these versions
superseded. I notice that the article claims that the problem was
first corrected in your OS by W2000sp4; so if you have that and the
correct modules try the re-registration yourself:

regsvr32 hhctrl.ocx


HTH

Robert
---
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

My IE 6 / Windows 2000 security is broken (repost w/ more info:) 2
Win2000: Cannot view web content in folders 3
Security settings 6
Current Security Setting & ActiveX ???? 3
ActiveX 1
ActiveX error 2
Security Settings 2
ActiveX Problems 1

Top