Chacham's Journal: Chronicle: told someone i turned off Internet Explorer

I help support a local organization's computers. I think the secretary's computer's winsock is infected, but i'm afraid to fix it just now, because it might mess it up. So, i disabled IE with a bogus proxy server, and expected them to use Firefox.

I just got an email from someone saying he can't connect to the Internet from that computer. After finding out what happened, i explained to him that i "turned off Internet Explorer" on that computer. I should be ashamed of myself. But, it got the message across quickly and clearly.

Why ashamed?

[Shadow Wrought]

Effectively communicating something technical to a non-technical person is nothing to be ashamed of, IMHO. If you start your "oil change" business, you'll be doing quite a bit of it!

Re:

[Chacham]

Heh. That's a good point.

But there is a difference. Even my interlocutor would know that "oil change" is a euphemism. "turning off" sounds like it might be accurate!

Re:

[Cyberdyne]

But there is a difference. Even my interlocutor would know that "oil change" is a euphemism. "turning off" sounds like it might be accurate!

I would just have said disabled instead - which would be accurate, yet also nice and simple.

Re:

[Chacham]

Not a bad idea. I'll have to think about that one.

wuh?

[Bill Dog]

I think the secretary's computer winsock is infected

"Computer winsock"? Unless you know something I don't, FF goes thru the same Windows Sockets API on Windows as IE does, since that's how the OS exposes TCP sockets.

Re:

[Chacham]

Last time i saw this problem, only IE opened up spam windows. When i reinstalled it (some package i had found at the time) the issue went away. But Firefox never did have the issue. I do not know why.

Same seems to be true here. When using IE, it keeps opening up windows with URLs with strange characters. Firefox doesn't seem to have the issue. The reason i think it's the Winsock, is that Autoruns [microsoft.com] shows some interesting entries in the registry. IIRC, inetcntrl14.dll quite a few times. They have B-secure, so

Re:

[Marxist Hacker 42]

Try HijackThis or CCleaner, they can give you more information- and you can always do a google search on the entry.

They can also remove the entry for you while providing a backup .REG file.

Re:

[Chacham]

i did the search, very little showed up. i know i could back it up, but disabling IE was easier.

I do appreciate the advice though. I may just follow it next week when i find i have more time.