IE Search companion issue

[Rearview]

I have a problem similar to some I've seen on here, but I don't think it is the same...

I have been rolling out Win XP Pro SP1 on all the desktops at my company. It seems that when some users (not all) use the IE Search companion, they will suddenly become unable to access the Internet until they reboot. For a couple of users, their profile on that computer cannot seem to access the Internet at all, even after reboot. But other users on that machine have no problems. The only solution I have found for these people was to delete their profile on their PC and have them log in again, creating a new profile. I do not believe their PCs have been "hijacked" or anything... We have current patches installed, and updated Symantec Corporate Antivirus software on all PCs. Users do not have privlages to install software, so spyware shouldn't be an issue. Any other ideas on why using the search companion screws up their Internet?

 

[bcastner]

Are there any error messages when they try to browse?
Can you ping

http://www.yahoo.com

or another website, or does the ping time out?

 

[Stumpy02000]

I encountered the same problem recently with a client. The investigation showed that while the host file included the goggle search engine, there were other host addressees present that I could not identify. I didnt identify anything special with the host file scripting, so what I did was opened notepad, C&P the contents of the clipboard to the open notebook file and saved as host.txt
I also noted the file extension on the host file, writing simply the file extention in the host text file under comments, restore as host. (and the proper extension there.)
Then I deleted the old host file and rebooted the computer.
Standard minimum ten count and powered up. Logged on the identity and went to goggle. After arriving there, I set clients home page to it and was done.
Good Luck

 

[Rearview]

I found nothing in the HOSTS file on these PCs. It is also hard for me to duplicate the problem, since I told the clients to stop using the IE Search companion and just go to a search engine such as google or yahoo, they have not been having the problems anymore... It ONLY seems to be the search companion feature that causes problems. I will have to go out to one of the affected PCs and check it out myself I suppose...

 

[bcastner]

I would check a problem client profile for the Qhosts issue. Because it writes so much to HKCU instead of HKLM, it could well be something you have to deal with:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html

It is the profile side of things that concerns me. That means the issue is isolated to the registry entries for HKCU; or c:\windows\systems32\, and its subfolders.
or c:\windows\ and its subfolders.