Hi all

I have and XP Pro client on a Win2003 Server network.
Logging in as a recently created user and IE starts up.

Is there a setting in IE itself which controls this?

So far I have looked in the Documents and Settings startup folder for this
user - not there
Checked the all users folder (even though IE doesn't launch for other
users) - not there

Where else could this be called?
This user has only existed on the system for about 2 days with minimal
Internet access, so I would be surprised if this was a virusy sort of thing!

TIA

Phil

"TheScullster" <phil@dropthespam.com> wrote in message
news:XwmdnddYfOY9-NfeSa8jmw@karoo.co.uk...
> Hi all
>
> I have and XP Pro client on a Win2003 Server network.
> Logging in as a recently created user and IE starts up.
>
> Is there a setting in IE itself which controls this?
>
> So far I have looked in the Documents and Settings startup folder for this
> user - not there
> Checked the all users folder (even though IE doesn't launch for other
> users) - not there
>
> Where else could this be called?
> This user has only existed on the system for about 2 days with minimal
> Internet access, so I would be surprised if this was a virusy sort of
> thing!


Use msconfig.exe to see what startup items you have. SysInternals' AutoRuns
lists some startup locations that msconfig does not. Have you checked the
user's startup (login) script, if they have one?

--
__________________________________________________
E-mail: Remove "NIX" and add "#LAH" to Subject.
__________________________________________________

"Vanguard (NPI)" wrote
>
> Use msconfig.exe to see what startup items you have. SysInternals'
> AutoRuns lists some startup locations that msconfig does not. Have you
> checked the user's startup (login) script, if they have one?
>
Thanks for that!
Looked in MSConfig, but didn't see IE start up entry.
What is Wincomm? Could this be problem?

Strange thing - when I gave the user admin rights to allow MSConfig, IE did
not start up.
Remove admin permissions and it starts up again at user Logon.

Any other thoughts?

TIA

Phil

Please include all of previous message(s) in your replies to the newsgroup.

wincomm.exe is a process which is registered as the w32.agobot.bg worm!
http://www.processlibrary.com/directory/files/wincomm/

> This user has only existed on the system for about 2 days with minimal
> Internet access, so I would be surprised if this was a virusy sort of
> thing!

Now you know. An unpatched machine running without a firewall can get
infected within seconds of connecting to the 'net!

Before You Connect a New Computer to the Internet
http://www.cert.org/tech_tips/before_you_plug_in.html

Protect Your PC
http://www.microsoft.com/athome/security/protect/

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/archive/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or http://aumha.net/viewforum.php?f=30
for expert analysis, not here.**

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Security, Shell/User)


TheScullster wrote:
> "Vanguard (NPI)" wrote
>>
>> Use msconfig.exe to see what startup items you have. SysInternals'
>> AutoRuns lists some startup locations that msconfig does not. Have you
>> checked the user's startup (login) script, if they have one?
>>
> Thanks for that!
> Looked in MSConfig, but didn't see IE start up entry.
> What is Wincomm? Could this be problem?
>
> Strange thing - when I gave the user admin rights to allow MSConfig, IE
> did
> not start up.
> Remove admin permissions and it starts up again at user Logon.
>
> Any other thoughts?
>
> TIA
>
> Phil

"PA Bear" wrote:

>
> wincomm.exe is a process which is registered as the w32.agobot.bg worm!
> http://www.processlibrary.com/directory/files/wincomm/
>

> Now you know. An unpatched machine running without a firewall can get
> infected within seconds of connecting to the 'net!
>

Thanks PA Bear I will look into this.
The machine is behind a company CheckPoint firewall, has up to date virus
software and I was in the process of updating windows/office in readiness
for a new user when this problem occurred.

Phil