Windows security settings problem

[ncSkeet]

Whenever I try to run certain programs, a small message window pops up with the following - "Your current security settings do not allow this file to be downloaded." This has been happening for the last week or so. It happens not only when I'm online and using a browser (I generally don't have a problem with it when I'm online. My primary browser is Firefox 1.0.4), but also when I'm not online. For example, it'll happen when I try to open certain "Help" files. The message also appears when I attempt to run CWShredder. It also happens when I try to use my newsreader, SharpReader. The SharpReader program itself will run, and I can click on a news link, but it will not then download and display the news story in the message pane. Instead, the "security settings" message window will appear. I've gone into "Internet Options" in Internet Explorer and made sure the settings are on their default levels, and have even tried some other, less secure personal settings in case that was causing the problem, all to no avail. I've also done much the same with Firefox's settings. I've checked "Security settings" at MSN but have found nothing that helps. Does Windows have security settings that can be checked for problems? (I'm using XP Home SP2 with .NET Framework 1.1 on a Compaq Presario S4000NX with 2.4 GHz Intel Celeron CPU, 504mb RAM, 40Gb hard drive.) I've lost the ability to use some of my favorite programs, so any help would be greatly appreciated.

ncSkeet

[merlin_2]

Run.......spysweeper from webroot.com.......what happens if you use internet explorer......six.....

[ncSkeet]

I don't have spysweeper, but I did run AdAware, Microsoft Anti-Spywar, AVG Free, Spybot S&D, A Squared, and Spyware Blaster, none of which found anything. If I use IE6, it generally works fine, except for one thing - at one time I had IE set to open with no homepage (to open with a blank page), but after I started having this problem it would show the "about:blank" in the location bar, and I would get the  "Your current security settings do not allow this file to be downloaded" message, and also a "What do you want to do with this HTML file?" message, to which I had to answer "save" to get it to go any farther, but then I would get the "security settings" message and be unable to use the browser. But after I changed it back to open/start with my previous homepage (Yahoo), IE would start up with no messages or problems and work just fine. Complicated? You bet...

[Fed]

Is all your anti virus/spyware stuff up to date?
Some time ago Adaware was seeing 'about:blank' as a bug because there was a bug of that name in the wild.

[ncSkeet]

Yep...I manually update it all every day.

[Fed]

Here is a direct download link to Hijackthis, see if you can download & run it.
Save the link to go back and get your log checked.
Paste your log in here too and we may be able to see what's going on.
http://www.hijackthis.de/index.php?langselect=english

[ncSkeet]

When I try to post the entire logfile, I'm told the "message is too long", so I'm going to try to post it in 2 separate posts -

Part 1:

Logfile of HijackThis v1.99.1
Scan saved at 11:03:12 PM, on 5/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\taskswitch.exe
C:\PROGRA~1\WINPAT~1\WinPatrol.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Buzzsaw\Buzzsaw.exe
C:\Program Files\Capio Utility Manager\CapioUtilityMgr.exe
C:\Program Files\Rainlendar\Rainlendar.exe
C:\Program Files\YPOPs\ypops.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\JGsoft\EditPadLite\EditPad.exe
C:\Program Files\Capio Utility Manager\Programs\C_Cmdr.exe
C:\Program Files\HiJackThis\HijackThis.exe

[ncSkeet]

Part 2:

Logfile of HijackThis v1.99.1
Scan saved at 11:03:12 PM, on 5/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\taskswitch.exe
C:\PROGRA~1\WINPAT~1\WinPatrol.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Buzzsaw\Buzzsaw.exe
C:\Program Files\Capio Utility Manager\CapioUtilityMgr.exe
C:\Program Files\Rainlendar\Rainlendar.exe
C:\Program Files\YPOPs\ypops.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\JGsoft\EditPadLite\EditPad.exe
C:\Program Files\Capio Utility Manager\Programs\C_Cmdr.exe
C:\Program Files\HiJackThis\HijackThis.exe

[ncSkeet]

Well, it's gonna have to be 3 posts-

Part 2:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 64.246.62.201 http://www.bootlegzone.com
O1 - Hosts: 207.171.175.35 http://www.amazon.com
O1 - Hosts: 193.86.103.19 guru.grisoft.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: iFinger plugin / Browser helper object - {A114D52B-870C-4F15-8021-B6D7F91A054B} - C:\PROGRA~1\iFinger\plugins\IE.ifp
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Global Startup: Buzzsaw.exe.lnk = C:\Program Files\Buzzsaw\Buzzsaw.exe
O4 - Global Startup: Capio Utilities.lnk = C:\Program Files\Capio Utility Manager\CapioUtilityMgr.exe
O4 - Global Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
O4 - Global Startup: ypops.exe.lnk = C:\Program Files\YPOPs\ypops.exe
O8 - Extra context menu item: &Acronym Finder lookup... - http://www.acronymfinder.com/iesearch/
O8 - Extra context menu item: &Highlight - C:\WINDOWS\WEB\highlight.htm
O8 - Extra context menu item: &Links List - C:\WINDOWS\WEB\urllist.htm
O8 - Extra context menu item: &Web Search - C:\WINDOWS\WEB\selsearch.htm
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\system32\wweb32.dll/lookup.html
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Program Files\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Encarta &Definition - http://encarta.msn.com/encnet/features/dictionary/quickDictionary.htm
O8 - Extra context menu item: I&mages List - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: Open Frame in &New Window - C:\WINDOWS\WEB\frm2new.htm
O8 - Extra context menu item: Zoom &In - C:\WINDOWS\WEB\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\WINDOWS\WEB\zoomout.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\System32\SHDOCVW.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

[ncSkeet]

Part 3:

O15 - Trusted Zone: http://*.conxion.com (HKLM)
O15 - Trusted Zone: www.excite.com (HKLM)
O15 - Trusted Zone: http://*.windowsupdate.com (HKLM)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O18 - Protocol: aim - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: shell - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSEC.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Don't know how part 1 got reposted as part 2...must have hit a buttom without realizing it.

Got this from the automatic scan:

        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)                 Unnecessarily
Unnecessarily               The entry Messenger has been identified as safe.               If the entry 'Messenger ' is not needed anymore, it should be fixed.
Unnecessary (deactivated) entry that can be fixed.
       O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)               Unnecessarily
Unnecessarily               The entry Windows Messenger has been identified as safe.               If the entry 'Windows Messenger ' is not needed anymore, it should be fixed.
Unnecessary (deactivated) entry that can be fixed.

O18 - Protocol: aim - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll                 Possibly nasty
Possibly nasty               Only a few Hijackers are listed here. The most popular are 'cn' (CommonName) , 'ayb' (Lop.com) and 'relatedlinks' (Huntbar) . They should be fixed.               
       O18 - Protocol: shell - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll               Possibly nasty
Possibly nasty               Only a few Hijackers are listed here. The most popular are 'cn' (CommonName) , 'ayb' (Lop.com) and 'relatedlinks' (Huntbar) . They should be fixed.               
       O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll               Unknown
Unknown       

[Fed]

I ran your logs & got quite a load of nasties, scan again & save the logfile, then go back to the site, browse your computer for the saved file & analyse it at the site.
You then need to carefully read the results and remove the things you're sure are nasty.

I was going to make some suggestions but it's your computer so you will have a better idea what should or shouldn't be there.

[ncSkeet]

I've checked everything out that was listed as nasty or unknown, and none of them are anything to be concerned about. For example, the.dll's checked out as harmless, and the "msmsgs.exe (file missing)" is there probably because I have the messenger disabled. These:

O1 - Hosts: 64.246.62.201 http://www.bootlegzone.com    
Nasty   This entry should be fixed immediately!   Must be fixed!  
 O1 - Hosts: 207.171.175.35 http://www.amazon.com    
Nasty   This entry should be fixed immediately!   Must be fixed!  
 O1 - Hosts: 193.86.103.19 guru.grisoft.com    
Nasty   This entry should be fixed immediately!   Must be fixed!  

are changes I've deliberately made to my HOSTS file. The rest are explainable and not nasty.

ncSkeet

[Fed]

You have good AV programs there but it's horses for courses, can you download, update & run 'ewido', I have had very good results with this when all else has failed.
I still feel it's a virus.

[ncSkeet]

Thanks for the suggestion, but I would prefer not to have to download anymore anti-spyware software, particularly something that will disable itself after a few eeks. I'll keep looking around, though...

[Fed]

You could uninstall it afetr use.

[ncSkeet]

I'm just wondering...are there any other security settings for Windows that can be customized? It's almost as though something happened to change settings that were already in place. Like I said, this has only been happening for a week. Prior to that, I had no problems like this at all.

ncSkeet

[Fed]

Can you find the execute file for cwshedder, check it's properties/security & see if you have permission to use it with the user you are logged in with?

[ncSkeet]

I'm the only one who has ever used this computer, so I'm always logged in as administrator.

[Fed]

Have you tried to open cwshedder while you're offline

[ncSkeet]

I just recently changed to DSL so I'm pretty much always online, but I went ahead and disconnected to try your suggestion, and it made no difference. One of the odd things about all this is that I get the "Your current security settings do not allow this file to be downloaded" message even when I'm not trying to download anything, as in the case with CWShredder. I've discovered that I get the message also when I try to access my services from Administrative Tools, and when I first open ICQ and MSN Messenger. When trying to open MSN Messenger, I get a dialogue window that says "File Download - Security Warning" at the top, with the question "Do you want to Save this file?" with a description of the "file" in question - "Name: blank - Type: unknown file type - From: About:blank". I have 2 options; I can click on "Save" or "Cancel". If I click on "Save" it starts my download manager, which I close out, and then MSN Messenger opens. If I click on "Cancel", MSN opens then as well. Again, I'm not trying to download anything at all, just open a program. I don't even have to be on the internet for it to do this. The computer seems to interpret a certain type of file/program as a download, and I don't know why.

Thanks for your help...ncSkeet

[pcdoc4christ]

I'm just wondering...are there any other security settings for Windows that can be customized? It's almost as though something happened to change settings that were already in place. ...

Skeet:

Sure!  Just let us know if you using Windows XP Home, Windows XP Pro, Windows 98 SE or something else.

Regards,
Doc

[Fed]

G'day Doc, good to see your input here.  
He's using XP

(I'm using XP Home SP2 with .NET Framework 1.1 on a Compaq Presario S4000NX with 2.4 GHz Intel Celeron CPU, 504mb RAM, 40Gb hard drive.)

I've just re-read this thread from the start (for the 10th time) and I'm still convinced it's a virus problem.  
Maybe even a tiny virus trying to download a bigger nastier virus and his security settings are protecting his computer from this.
Clearly, opening cwshedder should not start the computer downloading anything.

ncSkeet, have you run cwshredder?
I still advise giving Ewido a try and also http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Hang in there.  

[pcdoc4christ]

Oh, man!  How'd i miss that?  Thanks, FED.  

I think you're right about the virus.  Changing some of the security settings might not even work if the virus changes them back upon rebooting.  It might be worth a try, though.  Unfortunately, many of the security features of XP Pro are not easy to configure in XP Home.



Skeet:

FED's suggestion to try a free, online virus scan is something you should consider.  No anti-virus program is perfect, and what your AVG may have missed Panda Active Scan may find.  

Other free online virus scans:

http://www.google.com/search?sourceid=navclient&ie=UTF-8&rls=GGLD,GGLD:2004-51,GGLD:en&q=free+online+virus+scans

Take my advice and take FED's advice!  

[ncSkeet]

First I tried the Panda online scan, which found several cases of this in some old emails - Virus:Exploit/iFrame. It also found the following viruses: Virus:W32/Mydoom.A.worm - Virus:W32/Sober.C.worm  - Virus:W32/Gibe.C.worm  - Virus:W32/Netsky.Z.worm...all of them also in old emails. It deleted them all, but doing so did not solve my problem. I then downloaded and scanned with the ewido security suite, but that found no infections. It seems like a good program, though, and depending on what is disabled after the 14 day trial, I'll probably keep it for added protection, since it so far has clashed with none of my existing protection. I will probably wait until tomorrow to try another of the online scans, because it took almost an hour for the Panda scan.

Thanks again for the suggestions...ncSkeet

[dl65]

ncSkeet......I have been following you issue with intrest.....and several things jumped out at me ......
The first thing was that AVG didnt see those viruses .......Are you certain you have the mail scanning feature turned on and it is active.
The other thing that comes to mind is it might be a good idea to turn off your system restore feature as pests just love to hide in there and then reinfect the pc .....
Then reboot into safe mode and bring out the big guns again and rescan .  Use your AV , Antispyware , Ewido .....then once your satisfied its clean turn on system restore .

Cheers
dl65  

[Fed]

dl65, welcome aboard the ncSkeet roller coaster  

[dl65]

Hey Fed .......Do I need to use my seat belt ......

Something really odd going on here .......because those viruses should have been picked up by AVG ......

cheers
dl65  

[Fed]

Tightening my seatbelt now  
Here's my theory...

AVG hasn't found anything because there is no virus on the computer.... yet.

There is 'something' on Skeet's computer that is trying to download a virus but his computer security settings are preventing the download.

This is not a recommendation to Skeeter but I would allow the download and then try & deal with the consequences.

If you read the earlier posts, Skeeter was also trying to lower his security to allow this and now I'm coming around to his way of thinking.  

I guess I'm saying it's hard to kill a virus if you don't have it yet.

[ncSkeet]

dl65 - I do not have the email scanning option for AVG turned on. It was more of an annoyance than anything else, so I disabled it. I use Thunderbird and it has a very good filter system (not to mention ZoneAlarm), plus I won't open any email that I'm not sure of, and even with those I'll often use AVG's manual scan. And I do regular AVG system scans, as well as scan with the other anti-malware progs. As for the emails that Panda discovered - they were all around 2 years old and were part of an old unused (and now deleted) profile in Firebird's entry under "Documents and Settings." I knew they had nothing to do with my current problem as soon as I saw what they were, but was still glad to be able to be rid of them. Like you, I wondered why AVG never found them, seeing as how they have been there forever. I'll post the complete scan results if you want to see them. Also...I already have Window's system restore feature turned off; I disabled it months ago and started using ERUNT. I also did the safe mode scan, to no avail.

ncSkeet

[ncSkeet]

Just another quick update in case anyone is still following this - I did another online scan with Trend Micro's scanner which found nothing. Then, using Microsoft's instructions, I tried to make "My Computer" visible in the security settings of "Internet Options", but after making the necessary changes to the registry, nothing happened...no "My Computer" icon is showing. I don't know that this would have helped, but I would like to have tried it.

I'm about to just accept that nothing can be done and learn to live with it...ncSkeet

[merlin_2]

ncSkeet sorry! but can you upadte this post to what your problems are! life is short....maybe help is at hand..

[Fed]

Just another quick update in case anyone is still following this

I'm sure plenty of people are following this.

How do you feel about letting the file download & see what happens?

[ncSkeet]

 "How do you feel about letting the file download & see what happens?"

Which file is that? I don't really understand what you mean. I'm not trying to download any files.

ncSkeet

[Fed]

I'm sure you're not trying to download any files but it sure looks like your computer is trying to.

Whenever I try to run certain programs, a small message window pops up with the following - "Your current security settings do not allow this file to be downloaded."

[ncSkeet]

I think I figured out what you meant. About the "Save" button that brings up my download manager if clicked on - after the download manager (FreeDownloadManager) comes up, the program that I was trying to run in the first place opens up. There is actually nothing to be downloaded...it's just a quirk of this problem.

Put another way, FDM automatically launches if I click on the "Save" button, but unlike the times when there is a legitimate download, no download starts. I just close FDM down after that, and the program I initially clicked on starts up.

I know it's confusing...

ncSkeet

[Fed]

And maybe it's your security settings that are preventing the download?
Put up with it for another day in case it's a really new virus (someone has to be first) and then update and virus/spyware check again.
If nothing shows, let's try & drop your security down enough to let it download???

[ncSkeet]

And maybe it's your security settings that are preventing the download?
Put up with it for another day in case it's a really new virus (someone has to be first) and then update and virus/spyware check again.
If nothing shows, let's try & drop your security down enough to let it download???

There is actually no download - the download thing is simply one of the quirks of the bigger, real problem, which is: Whenever I try to run certain programs, a small message window pops up with the following - "Your current security settings do not allow this file to be downloaded." This has been happening for the last week or so. It happens not only when I'm online and using a browser (I generally don't have a problem with it when I'm online. My primary browser is Firefox 1.0.4), but also when I'm not online. For example, it'll happen when I try to open certain "Help" files. The message also appears when I attempt to run CWShredder. It also happens when I try to use my newsreader, SharpReader. The SharpReader program itself will run, and I can click on a news link, but it will not then download and display the news story in the message pane. Instead, the "security settings" message window will appear. I've gone into "Internet Options" in Internet Explorer and made sure the settings are on their default levels, and have even tried some other, less secure personal settings in case that was causing the problem, all to no avail. I've also done much the same with Firefox's settings. I've checked "Security settings" at MSN but have found nothing that helps. I've lost the ability to use some of my favorite programs. I don't have spysweeper, but I did run AdAware, Microsoft Anti-Spywar, AVG Free, Spybot S&D, A Squared, and Spyware Blaster, none of which found anything. If I use IE6, it generally works fine, except for one thing - at one time I had IE set to open with no homepage (to open with a blank page), but after I started having this problem it would show the "about:blank" in the location bar, and I would get the  "Your current security settings do not allow this file to be downloaded" message, and also a "What do you want to do with this HTML file?" message, to which I had to answer "save" to get it to go any farther, but then I would get the "security settings" message and be unable to use the browser. But after I changed it back to open/start with my previous homepage (Yahoo), IE would start up with no messages or problems and work just fine. I just recently changed to DSL so I'm pretty much always online, but I went ahead and disconnected to try your suggestion, and it made no difference. One of the odd things about all this is that I get the "Your current security settings do not allow this file to be downloaded" message even when I'm not trying to download anything, as in the case with CWShredder. I've discovered that I get the message also when I try to access my services from Administrative Tools, and when I first open ICQ and MSN Messenger. When trying to open MSN Messenger, I get a dialogue window that says "File Download - Security Warning" at the top, with the question "Do you want to Save this file?" with a description of the "file" in question - "Name: blank - Type: unknown file type - From: About:blank". I have 2 options; I can click on "Save" or "Cancel". If I click on "Save" it starts my download manager, which I close out, and then MSN Messenger opens. If I click on "Cancel", MSN opens then as well. Again, I'm not trying to download anything at all, just open a program. I don't even have to be on the internet for it to do this. The computer seems to interpret a certain type of file/program as a download, and I don't know why.

But to emphasize - There is actually no download - the download thing is simply one of the quirks of the bigger, real problem, which is: Whenever I try to run certain programs, a small message window pops up with the following - "Your current security settings do not allow this file to be downloaded."

ncSkeet

[Fed]

6.00am here *yawn*
While I'm thinking check this out http://www.hijackfree.com/en/download/
I'll be back when I get to work.

[Cary_GRant]

Here's my 2 cents with my fix solution: I firmly think it is not a spyware or malware problem, but rather a problem with missing or corrupted entries from your browser/download manager. Often times when you delete a program that manages others such as downloads (BitTorrent for example) and you delete the parent program while there is a file waiting, it can be damned hard to get rid of the jaded file.

Did you recently uninstall (or about the time when this started to happed, or change your download manager?)

Anyways, here's my fix. May seem like a lot of trouble but do it anyways: unistall FFox, Uninstall ANY download manager you have, then uninstall and reinstall IE. you will ok after that. You essentially have to trick your PC into thinking that everything is as it should be. .. Just my 2 cents. I think your registry is corrupted.

[Fed]

Thanks Cary, you've put a whole new view on the problem.
Do you think skeet could follow your suggestions excluding IE and give it a try first?

[Fed]

Skeet, all I can think of is to run with Cary's suggestions and see what happens then, as we are getting no where at the moment.
BTW, when you lowered your security in IE did you lower both 'Internet' and 'Local Intranet'?

[ncSkeet]

OK, here's where I am with this now...I uninstalled FF and FreeDownloadManager, then reinstalled them, which made no difference. Then, not knowing how to uninstall IE (there's no option for that in "Add/Remove Programs"), I called a tech friend of mine (actually an instructer at school whom I had for "Computer Upgrade & Repair"), and he freaked and said that if my registry was corrupted that I should not be uninstalling  IE, that doing so and then trying to reinstall it could make the problem even worse, possibly to the point of not being able to operate my machine. While I had him on the phone, I briefly described the problem I was having, and he too thinks something is corrupted, and that I would probably have to do a total reinstall of Windows - which is what I have been trying to avoid.

As for A-squared - I recently tried to download and install their "Hijackfree" program, and for some reason it would not install on my computer...don't remember why, just that I told myself I wouldn't try that again. This was before my current problem started, although thinking about it now, it may have been a early sign that something was amiss.

I did lower my security on both the "Internet" and "Local intranet" when I first tested all of that, and it didn't help.

ncSkeet

[Fed]

Did you reboot after uninstalling?
Did you try it while FF & Download manager were uninstalled?

[ncSkeet]

Did you reboot after uninstalling?
Did you try it while FF & Download manager were uninstalled?

Not the first time, but I tried it just now...no difference.

I guess it's like I said earlier...I'm just going to have to learn to work around it. Either that, or do a total reinstall.

Thanks...ncSkeet

[Fed]

I don't know about your free download manager but I use a small program to download with that allows me to resume a download after an interuption, it's called getright.
I just checked it, (something I've never bothered with before) and it has a screen to check 'download status', I guess to see if any downloads are incomplete.
Does your download manager have anything like this?
Maybe you need to cancel a pending entry?

Another thought, do any of these alerts come up when you're in safe mode?
Can you use msconfig to disable all startup programs, try it, then one by one enable the startup programs to find out where it's all starting from?

[ncSkeet]

I don't know about your free download manager but I use a small program to download with that allows me to resume a download after an interuption, it's called getright.
I just checked it, (something I've never bothered with before) and it has a screen to check 'download status', I guess to see if any downloads are incomplete.
Does your download manager have anything like this?
Maybe you need to cancel a pending entry?

Another thought, do any of these alerts come up when you're in safe mode?
Can you use msconfig to disable all startup programs, try it, then one by one enable the startup programs to find out where it's all starting from?

FDM also has those options, and I checked for any "stuck" downloads, but found none. And the "alerts" come up also in safe mode.

ncSkeet

[Fed]

Two more things to try...

Check your event viewer for anything unusual.

Download & run 'Registry First Aid'.
http://www.rosecitysoftware.com/reg1aid/
It's slow because the free one makes you re-run it many times to fix all the problems but it's worth it.

There has to be an answer for you somewhere.