Weird Problem - Any Windows XP Experts Here?

[Ann Omness]

Beginning December 13th, my Internet Explorer will no longer display pages done in php. They come up as a blank white page. I've run scans with six or eight antivirus/antitrojan/antispyware programs and none of them find whatever is causing this. I'm not the only one who started having this problem on that same day. I found one forum where several people were complaining about it. No answers, though. Until I can get it fixed, I'm using Firefox to browse php pages, but I don't much like it.

Anybody know how to fix a problem like this, aside from reinstalling Windows?

[urb]

There's a few things you could do before considering re-installing Windows... like a System Restore back to December 12th.

[Mattinblack]

Sounds like you caught a nasty case of browser help object. BHO's are what allow 3rd party addons like google toolbars etc to work but can be misused or just (as in this case probably) badly programmed. Get MS anti spyware off the site and look in advanced tools, there is a section to list BHO's if you select them one at a time the right hand window will tell you if microsoft 'knows' them. Delete all that it doesnt. If you been surfing porn with IE dont be surprised if you have got 10-15 unknowns. Various less scrupulous sites use them for tracking since unlike cookies they cant be turned off or removed easily. Do a spyware scan and delete anyway if you dont already have microsoft spyware installed.

[Emperor]

PHP is processed on the server, what your browser gets from a PHP page is straight HTML from the server.

Will a page like this work: SomeSite.com/SomePage.php

...does it only happen on pages like this: SomeSite.com/SomePage.php?id=100

It is indeed weird.

Emperor

[Ann Omness]

Originally Posted by urb

There's a few things you could do before considering re-installing Windows... like a System Restore back to December 12th.

How do I do that, and what does that do in regard to programs I've installed since then, or email messages in my mail program, stuff like that?

[Ann Omness]

MattinBlack, I've done the BHO thing. Even downloaded a bunch of specific BHO killers that are supposed to do a better job than the more generic tools like Spy Doctor and MS Anti Spyware. It seems like every program finds something that none of the others did, but none of them fix my problem. I have Norton Antivirus and Spy Doctor running all the time. I run full scans with each of them at least once/week, and I run all the other anti-adware/anti-spyware programs once/week for full scans. That chore takes six hours the day I do it. If this problem is cause by a trojan of some sort, it's not something that any of them can find.

[SirMoby]

Programs -> Accessories -> System Tools -> System Restore

I've never heard of such a thing and since php is processed on the server your issue may really be something else.

[Ann Omness]

Originally Posted by Emperor

PHP is processed on the server, what your browser gets from a PHP page is straight HTML from the server.

Will a page like this work: SomeSite.com/SomePage.php

...does it only happen on pages like this: SomeSite.com/SomePage.php?id=100

It is indeed weird.

Emperor

On some rare occasions, I've had a page come up just fine that had a php extension. I can't access commerce sites that use php. I can't access any site made with php-nuke. I can't access the blogs that use php. I have some html websites with php includes in them, and those work just fine for me.

[MeatPounder]

Originally Posted by Ann Omness

How do I do that, and what does that do in regard to programs I've installed since then, or email messages in my mail program, stuff like that?

Well you can go the long way...navigate to start menu>all programs>accesories>system tools>system restore

Or you cand simply click run oon the start menu and paste in this %systemroot%\system32\restore\rstrui.exe in the box that pops up.

Either way in the window that pops up you select restore my computer to an earlier time...then click next
then go back one month on the calendar...and look at december.
You can only restore to a time that a restore point was saved, and those dates will show in bold. Select the closest one before the 13th you can restore to.

Remember the restore will not delete any saved files, but it will change your computer to the way it was on that date.
Any thing you INSTALLED after that date probably won't work...and you may end up with files and settings you thought you had gotten rid of returning...but that will usually get rid of any baddies that happened to your box as long as it didn't infect your restore files.

[urb]

Originally Posted by Ann Omness

How do I do that, and what does that do in regard to programs I've installed since then, or email messages in my mail program, stuff like that?

Basically what MeatPounder said.

It's worth a try before you start re-formatting hard drives.

Saved files and emails will still be there, but any programs installed or downloaded updates will be removed.

[Mattinblack]

Originally Posted by SirMoby

Programs -> Accessories -> System Tools -> System Restore

I've never heard of such a thing and since php is processed on the server your issue may really be something else.

I realise PHP is processed on the server but since even if PHP scripting is turned off one would see something so long as the file exists on the server my conclusion is it is most likely nothing to do with the server. If we were given a URL and we can see something then this would kill the server as a culprit.

BHO's intercept the page in the browser BEFORE the browser displays the page. This is how some of the adware replaces the adverts on a page with their own. In fact any content can be replaced and modified. I have had a reaction between two competing BHO's that caused blank pages to be displayed, this was my reason for changing to firefox.

[DJilla]

I know this is a bit off topic BUT, sometimes you see a thread here about someone ripping content from someone else, etc. etc..

The last week or so I've been trying to undo some changes in the XP network security definition files (MMC) that won't cooperate. SOOOOO, of course I'm searching the boards.. whatever, I was flabbergasted over seeing the same posts from one board on at like a hundred others, exactly the same content not even a comma changed.

PHP problem weird... never seen it before sorry! Seems like an easy solution to restore back to Dec 12, extreme to reformat. I've always liked the tools section in the old favorite Spybot to give you some info about what's going on:

http://www.safer-networking.org/en/download/

[docholly]

Not to hijack this thread either but perhaps the issues stem from what's happening over here http://greenguysboard.com/board/showthread.php?t=27192

Never know where those BHO are going to POP up when you are surfing.

[Ann Omness]

I've emailed myself your instructions for restoring to an earlier date. Thanks! I'll have to psych myself up for that, since it sounds like I'll be restoring some malicious codes that I found and fixed earlier this week, along with the programs that found and fixed them.

[Ann Omness]

Originally Posted by docholly

Not to hijack this thread either but perhaps the issues stem from what's happening over here http://greenguysboard.com/board/showthread.php?t=27192

Never know where those BHO are going to POP up when you are surfing.

That's a possibility. There's a rumor going around that one of the advertisers put malicious code on their page specifically to target people participating in that program. The very limited number of infections would explain why the anti-spyware programs don't have it in their definitions files (they've never seen it) and it would also explain why the only forum where I've found other complaints about this problem is a forum used by people doing the "get paid to surf" thing. And it would explain why all the infections that did happen all happened on the same day, because the program bans advertisers immediately who do things like that.

The other most likely culprit comes from reviewing sites at Blue Wave that surfers have reported as bad sites. When I scan my system after doing those reviews, I usually find 12-18 new infections.

[GunnCat]

There's also a possibility of a hardware problem, or a bad installation of IE that cannot be fixed.

[GenXer]

You may have to swallow your pride and take it to a computer place where some certified people can fix it for you.

[SexycityBrian]

If you dont fine the problem and need more help you can do two things
one get hijackthis and run it to see what if finds
http://www.majorgeeks.com/download3155.html
next you can do ctrl alt Del then click the processes tab write down everting running. If you want you can even send me the results or post them and I will look to see what I can find that doesnt belong there. I have had to do this several times when anti virus and adware removers dont work to find a problem.

brian at sexycity.com

[MadMax]

Before Cleo has a chance to go all Apple on you ....

You'll completely avoid problems like this by switching to Firefox.
http://www.mozilla.com/firefox/

[Ann Omness]

Brian, already tried the majorgeek hijackthis stuff. Here are my running processes:

Eudora.exe
taskmgr.exe
getright.exe
RoboTaskBarIcon.exe
swdoctor.exe
MSGTAGStatus.exe
LogitechDesktopMessenger.exe
zlclient.exe
CCAPP.EXE
msmsgs.exe
jusched.exe
getright.exe
ADUserMon.exe
PRONoMgr.exe
SOUNDMAN.EXE
explorer.exe
realsched.exe
ati2evxx.exe
alg.exe
CCSETMGR.EXE
svchost.exe
Imgicon.exe
svchost.exe
atiptaxx.exe
svchost.exe
svchost.exe
svchost.exe
ati2evxx.exe
lsass.exe
services.exe
ADService.exe
IEXPLORE.EXE
vsmon.exe
EM_EXEC.EXE
wdfmgr.exe
symlcsvc.exe
NPROTECT.EXE
winlogon.exe
csrss.exe
NPFMNTOR.EXE
smss.exe
NAVAPSVC.EXE
AppServices.exe
spoolsv.exe
CCEVTMGR.EXE
SPBBCSvc.exe
SNDSrvc.exe
System
System Idle Process

[Ann Omness]

MadMax, I'm already using FireFox now to see the pages that Internet Explorer won't display and to navigate commerce sites. I'd like that to be a temporary workaround, because Firefox seems pretty primitive.

[MadMax]

Originally Posted by Ann Omness

MadMax, I'm already using FireFox now to see the pages that Internet Explorer won't display and to navigate commerce sites. I'd like that to be a temporary workaround, because Firefox seems pretty primitive.

Perhaps, but it's the bells and whistles in IE that create all the security problems since they're not coded well enough to make the program safe

There are a lot of great extensions for FF that can get you lots of the features you're used to in IE and a lot IE will never be able to offer

[DJilla]

Originally Posted by SexycityBrian

next you can do ctrl alt Del then click the processes tab write down everting running.
brian at sexycity.com

Ooops! I think u mean 'CTRL ALT SHIFT'

[tickler]

Hey Ann, when you say comerce sites. What do you mean exactly?

I had a problem a few months back, when my security file got corrupted. It was preventing me from accessing secure "https" pages correctly.

[GunnCat]

Originally Posted by Ann Omness

Brian, already tried the majorgeek hijackthis stuff. Here are my running processes:

Eudora.exe
taskmgr.exe
getright.exe
RoboTaskBarIcon.exe
swdoctor.exe
MSGTAGStatus.exe
LogitechDesktopMessenger.exe
zlclient.exe
CCAPP.EXE
msmsgs.exe
jusched.exe
getright.exe
ADUserMon.exe
PRONoMgr.exe
SOUNDMAN.EXE
explorer.exe
realsched.exe
ati2evxx.exe
alg.exe
CCSETMGR.EXE
svchost.exe
Imgicon.exe
svchost.exe
atiptaxx.exe
svchost.exe
svchost.exe
svchost.exe
ati2evxx.exe
lsass.exe
services.exe
ADService.exe
IEXPLORE.EXE
vsmon.exe
EM_EXEC.EXE
wdfmgr.exe
symlcsvc.exe
NPROTECT.EXE
winlogon.exe
csrss.exe
NPFMNTOR.EXE
smss.exe
NAVAPSVC.EXE
AppServices.exe
spoolsv.exe
CCEVTMGR.EXE
SPBBCSvc.exe
SNDSrvc.exe
System
System Idle Process

There are some things in there that seem alarming at first glance. I would kill these run Hijack and remove those from your startup list:

PRONoMgr.exe
ADService.exe

If you want some help, I can remotely connect to your pc sometime and look over things there, but I still stand by my original statement that it's a hardware error/bad install. Good luck.