Certificate error on majority of websites

Hi,

I've had a look through the suggested threads and while my issue is similar, the suggested solutions (Time/Date, update certificates) did not work for me.

What happened:
I had Adblock IE installed for the 30 day trial and uninstalled it using Revo (as was suggested here following my previous malware issues).
I then ran CCleaner on mostly default settings, though I also opted to clear:
Index.dat
Autocomplete history
Saved passwords
Recent docs, run, search autocomplete, MRU, network passwords
Old prefetch
Menu Order
Environment Path
User assist history
IIS log files
Hotfix uninstallers

Ever since, nearly every website I visit I get the IE information bar telling me that there was a problem with the site's certificate and certain content was blocked for my safety.

This seems to affect the majority of websites that I visit with exception of:
CNN
Microsoft (main site only)

Also affected are:
Google
Outlook Web Access standard (not lite)
Gmail standard (not basic hmtl)
Microsoft Update

In fact, I just got locked out of my gmail account when I tried to swap back to Standard view to empty the trash because it kept attempting to access my account and failed due to the error.

I have previously updated the website certificates via Microsoft Update back in June this year and I've verified that both my windows and BIOS time and date are correct.

I was able to access windows update last night and got the newest updates (not certificates though) but again have been unable to do so today or the day before yesterday. Seems very sporadic...

I've run malware and rootkit checks and they have come up empty.

So I am very much at a loss at what I should do now as it very much limits what I can do on the web.

I run:
WinXP MCE SP3
Internet Explorer 8


Thanks in advance

 

Ok i would start out bye running threw this thread.Read & Run me first thread.
http://forums.majorgeeks.com/showthread.php?t=35407

If you find any thing go to the malware forum and request help to remove any thing.

Sounds like you might have some kinda Virus or malware on computer.

Did you Run threw the Read and Run thread first.

And Try a Different Browser like Fire fox to see if your still getting these issues.

 

As I wrote, I had malware previously and was given the all clear after it was resolved and have kept everything at near max security since.
I regularly run SAS and MBAM as well as GMER to check for malware and have not had anything flagged up.

The issue did not exist prior to uninstalling the adblocker via Revo followed by running oc CCleaner.

Therefore, it is not caused by malware (or at least detected malware)

In the meantime, I've re-run the root certificate update for April 2012 from the microsoft website but the issue persists.

My best guess is that it is an issue caused by the deletion of one or more files/regkeys via Revo/CCleaner which may have been used by the Adblock program that's causing my current issues, and replacing those somehow will fix it.

 

First try this if you have not.

http://support.microsoft.com/kb/923737

 

Thanks for the suggestion.

I have just done this but the problem remains

I've tried inprivate browsing and running without addons as well but no luck.

I'm thinking more that it might have been CCleaner deleting something important now since I didn't have the problem right after uninstalling with Revo if I remember correctly. I was browsing a few pages in between uninstalling and using CCleaner

[edit]
In fact, after the FixIt thing, attempting to visit windowsupdate completely locks up Internet Explorer after the autoredirect as opposed to just doing nothing

 

Well I didn't make a backup there :/
None of the things it found in the reg scan seemed to differ from the usual MRU and leftover windows update things.

I wonder though what could cause many but not all sites to throw certificate errors and whether there is something i can reinstall/change to fix those?

 

As a troubleshooting step, I have installed Firefox today and have not had any of the certificate error issues.

As such, it seems to be confined to my Internet Explorer installation.

Is there any way for me to fix this short of reinstalling Windows?

Would uninstalling IE8 (which would auto-rollback to IE7) and reinstalling IE8 be of any use given that I have tried the FitIt for IE8 already to no effect?

 

Download Complete Internet Repair and run in an admin account. Only check the button next to IE and press Go.

http://majorgeeks.com/Complete_Internet_Repair_d7183.html

Edit: An incorrect date and time on the computer will also cause the problem.

 

I've tried that now.
Before reboot: IE8 doesn't work at all
After reboot: Get a windows error message saying it blocked execution of explorer.exe due to some security breach ?!
Internet Explorer works but has the same problem as before

The date and time on my windows and BIOS are correct as far as I can tell and synchronize normally with the nist time server

I should note that this particular forum also doesn't have any certificate error popup. Seems most https sites and some http sites are affected for me.

 

I would start a new thread in the Malware Removal Forum after reading the sticky post Read Me First. Then Post your logs. If they are clean then post back here.

 

I haven't had that popup message when I started up this morning, so maybe it was a one-off thing related to running ComIntFix changing reg entries.

Considering I rebooted before installing it and had no issues, it is extremely unlikely to be malware related.

 

See if the steps shown here solve the problem. As a last resort, you could do a system restore to a date before you used CCleaner. When you cleaned Environmental Path, what was cleared?

http://support.microsoft.com/kb/968089

Edit: Do you still have certificates shown when you go to IE options under the content tab?

 

Thanks for getting back to me.

I do have certificates shown in the content tab, but they look different from the ones that are listed on my work PC (probably normal). If these were to somehow be corrupted, how would I fix those? I tried downloading and running the April2012 Root cert update from MS again to no avail.

For the KB link:
Compatibility view did let me use windowsupdate for a moment, but the error bar was still displaying. It didn't let me use the full version of Gmail or OWA.
Delete history: did all that, sadly no use
No Add ons: Did that as well, didn't help
Date/Time: Did that more than once and they are correct.
Reset Settings: Did that in IE as well as via the FixIt and didn't work.
System Restore: Its disabled on my Home PC - primarily because I never found a use for it and it makes infections harder to control. So sadly can't do that

I just noticed I didn't post the exact error message in the information bar yet, so here it is:
"To help protect your security, Internet Explorer has blocked this website from displaying content with security certificate errors. Click here for options."

Note I get the error information bar even if I untick the 3 certificate related boxes in the advanced options and also if I add the website to my Trusted sites, i.e. I can't get around it.

 

I was going mention adding the site to the trusted list and you did the options in the Advanced section so you pretty much covered everything. I can't seem to find anything related to fixing certificates. Does this problem occur with another browser?

Does your path statement in Environment Variables look okay. You said you cleaned that.

 

Hi,

I'm not sure about how an environment path is supposed to look.
Currently I have 2 entries there:
TMP
TEMP

Both pointing to local settings Temp folder

In the box below the field with Path has this:
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\PROGRAMME\INTEL\WIFI\BIN;C:\WINDOWS\system32\WindowsPowerShell\v1.0

The problem does not occur with Firefox which I installed as a troubleshooting step, only with IE8

 

Somehow I believe your certificates got corruptted for some reason. Under the content tab, does it help when you press Clear SSL state under the content tab?

I found a couple of links about exporting and importing certificates but I am not sure if that would help or not. It would require deleting the certificates and them importing from another computer. I would definitely create a restore point before doing that or back up the registry with something like ERUNT.

 

I forgot to mention that your path statement looks okay.

 

I tried the SSL cache clearing but it didn't change anything unfortunately.

Considering the certificates on my work computer seem very different, I would probably need to ask a friend with XP and IE8 to send me his certificates?

Or is there a way of uninstalling/reinstalling IE that would fix this? Or is this something that I would need to reinstall windows for?

 

If you had an install disk with the same SP, you could try a repair install.

The only link I found regarding exporting and importing certificates was this. The other I had was certificate specific.

http://www.ejbca.org/sensornet/IEHowTo/ManagingCertificateIE.html

I could not find anything regarding resetting certificates.

If the above did not work then I would probably say you need a reinstall.

Edit: there was this link on restoring a deleted certificate. You could delete each certificate one by one and then restore it but am not sure if this would solve the problem. The link shows the location of the certificates.

http://www.ehow.com/how_5071148_restore-deleted-certificate.html

Edit: Another option to try before a reinstall would be to uninstall IE8.

 

I'll try the certificate option. Just have to find someone to send me certificates...

I tried uninstall/reinstall of IE8 but sadly didn't fix the issue.
Even while I was on IE7 after the uninstall the issue persisted.

 

I think its mostly solved now.

I deleted my local trusted root and untrusted certificates (which strangely seems to have gotten rid of the normal trusted certificates as well) and copied over the trusted root and untrusted certificates from my work PC.
Then I reinstalled the MS Root Apr 2012 over the top.

Slight problem does seem to be that a lot of entries in the trusted root sections are now duplicated.

I am no longer getting the certificate error messages and can use windows update seemingly fine again (or at least it worked just now).

OWA is still wonky on the standard view. Sometimes it works, sometimes it gets stuck after loading the mailbox view and doesn't let me click anything, freezing a while later, which requires a termination of IE.

While importing the certificates, I noticed some strange categories I haven't seen in the IE options view. Any idea what those are?


[edit]

Seems I was happy too early. Its back.
In fact, all I did was install the recent IE8 security update and then shut down the OWA instance that got frozen and then on the next start of IE, I got the certificate errors all over again.
I just have no idea why I didn't have them for a good 15 mins before that

 

Another thought: On the one link I posted, it notes the location of the certificates in the registry. I believe when you delete the certificate from IE, Windows still keeps them in the registry. Maybe that is why you got the duplicates. You could delete the certificates in IE and also the registry then import them again to see what happens.

If that does not solve the problem, I would just wipe the drive and do a reinstall. Sorry I could not help with the problem.

 

dip0,
Thanks for your careful and well-written explanation of the problem. I have read through the thread here and am experiencing similar symptoms. I have been looking at some of the same things you have but no success yet.

Did you ever find a solution?