(probable) spyware highjack of IE 6.0 - help!

Discussion in 'Computer Support' started by systemtool, Feb 29, 2004.

  1. systemtool

    systemtool Guest

    I recently noticed that IE 6.0 would load strange things if I omitted
    the www or the http prefix from known good web locations when typing
    in the location bar.

    If I take a URL that works in Netscape 7.1, or works if I click a link
    to it from IE 6.0, and type that url in the location bar, one of two
    things will happen:

    1. Sometimes, the browser will take me to another part of the web site
    that the url points to (but NOT my desired URL; some other url on that
    web site).

    2. Sometimes, Windows will give me this error: "Windows can't find
    [the exact thing I typed in the location bar]. Check the spelling and
    try again, or try searching for the item by clicking the Start button
    and then clicking Search"

    Here are some things I've tried:

    a) Checking my registry. It's okay. I followed the procedure in
    http://www.mvps.org/inetexplorer/answers_8.htm#extension and the
    values were correct without any tweaking from me.

    b) Clearing my IE cache (temporary internet files). I did this. It
    didn't fix the problem.

    c) Check my hosts file. There are no entries in the hosts file for
    sites that I'm having trouble with.

    d) Check for spyware. I ran the current versions of Ad-Aware and
    Spybot, both with newly-updated reference files. Ad-aware found a ton
    of stuff, mostly related to WildTangent (blast it all, I gave in and
    installed AIM for my kids, and that crap came with the latest
    version). Spybot then found one other thing. All spyware has been
    removed. I ran both programs again and it came up clean.

    e) My computer is virus free - NAV with virus definitions updated
    through 2/25.

    f) I ran a current version of Stinger. That found nothing funny.

    g) I ran hijackthis. A log file will be at the end of this post.

    Please give me some new ideas to try... my wife has been waiting for
    me in bed for three hours while I've tried and failed to fix this!

    hijackthis logfile:
    ++++++++++++++++++++++++++++++++
    Logfile of HijackThis v1.97.5
    Scan saved at 1:41:08 AM, on 2/29/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\MOUSE\SYSTEM\EM_EXEC.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
    C:\WINDOWS\SYSTEM\HPZTSB04.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
    C:\WINDOWS\RunDLL.exe
    C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS
    SHARED\WKCALREM.EXE
    C:\PROGRAM FILES\PYRENEAN\EDEXTER\EDEXTER.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\AGENT\AGENT.EXE
    C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
    C:\PROGRAM FILES\POWERARCHIVER\POWERARC.EXE
    C:\WINDOWS\TEMP\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    http://keyword.netscape.com/keyword/%s
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: (no name) - {4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} -
    C:\PROGRAM FILES\E-BOOK SYSTEMS\FLIPVIEWER\FPLAUNCH.DLL
    O2 - BHO: (no name) - {1a5a2ea0-3477-11d8-b43d-00500485e140} - (no
    file)
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
    O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton
    Utilities\NPROTECT.EXE
    O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead
    Photo Express 2 SE\ChkFont.exe
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
    O4 - HKLM\..\Run: [Norton Auto-Protect]
    C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
    O4 - HKLM\..\Run: [Norton eMail Protect] C:\PROGRAM FILES\NORTON
    ANTIVIRUS\POProxy.exe
    O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
    C:\WINDOWS\SYSTEM\hpztsb04.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE"
    -atboottime
    O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common
    Files\Real\Update_OB\evntsvc.exe -osboot
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton
    Utilities\NPROTECT.EXE
    O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL
    deskcp16.dll,QUICKRES_RUNDLLENTRY
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
    Office\Office\OSA9.EXE
    O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program
    Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O4 - Startup: TimeSync.lnk = C:\Program Files\Tools For Selling\Time
    Synchro\TSYN.EXE
    O4 - Startup: eDexter.lnk = C:\Program
    Files\Pyrenean\eDexter\eDexter.exe
    O4 - Startup: PowerReg Scheduler V3.exe
    O8 - Extra context menu item: &Add animation to IncrediMail Style Box
    - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Dell Home (HKCU)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) -
    http://office.microsoft.com/productupdates/content/opuc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
    Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
    O16 - DPF: {7B461720-5910-45A3-B617-3B53A972F209} (Pixami-PhotoWorks
    Upload UI Control) -
    http://services.photoworks.com/Pixami/PixamiSFWUploader.cab
    O16 - DPF: {0DD4833D-DFFA-11D3-94D7-0050DAC353B6} (DndCtrl Class) -
    http://www.ofoto.com/OfotoDND.cab
    O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print
    ActiveX Plug-in) - http://di.imgag.com/imgag/cp/install/AxCtp.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
    http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37705.4612384259
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX
    Control) -
    http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI
    Registry Information Class) -
    http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    systemtool, Feb 29, 2004
    #1
    1. Advertising

  2. systemtool

    CalamityKen Guest

    systemtool typed:
    > I recently noticed that IE 6.0 would load strange things if I omitted
    > the www or the http prefix from known good web locations when typing
    > in the location bar.
    >
    > If I take a URL that works in Netscape 7.1, or works if I click a link
    > to it from IE 6.0, and type that url in the location bar, one of two
    > things will happen:
    >
    > 1. Sometimes, the browser will take me to another part of the web site
    > that the url points to (but NOT my desired URL; some other url on that
    > web site).
    >
    > 2. Sometimes, Windows will give me this error: "Windows can't find
    > [the exact thing I typed in the location bar]. Check the spelling and
    > try again, or try searching for the item by clicking the Start button
    > and then clicking Search"
    >
    > Here are some things I've tried:
    >
    > a) Checking my registry. It's okay. I followed the procedure in
    > http://www.mvps.org/inetexplorer/answers_8.htm#extension and the
    > values were correct without any tweaking from me.
    >
    > b) Clearing my IE cache (temporary internet files). I did this. It
    > didn't fix the problem.
    >
    > c) Check my hosts file. There are no entries in the hosts file for
    > sites that I'm having trouble with.
    >
    > d) Check for spyware. I ran the current versions of Ad-Aware and
    > Spybot, both with newly-updated reference files. Ad-aware found a ton
    > of stuff, mostly related to WildTangent (blast it all, I gave in and
    > installed AIM for my kids, and that crap came with the latest
    > version). Spybot then found one other thing. All spyware has been
    > removed. I ran both programs again and it came up clean.
    >
    > e) My computer is virus free - NAV with virus definitions updated
    > through 2/25.
    >
    > f) I ran a current version of Stinger. That found nothing funny.
    >
    > g) I ran hijackthis. A log file will be at the end of this post.
    >
    > Please give me some new ideas to try... my wife has been waiting for
    > me in bed for three hours while I've tried and failed to fix this!
    >
    > hijackthis logfile:
    > ++++++++++++++++++++++++++++++++
    > Logfile of HijackThis v1.97.5


    You are two levels down.

    <snip good stuff so that it is easier to remove bad stuff>

    > C:\WINDOWS\TEMP\HIJACKTHIS.EXE


    Important: Create a folder on the C: drive called C:\HJT.
    You can do this by going to My Computer (Windows key+e) then double click on
    C: then right click and select New then Folder and name it HJT.
    Download into this folder.
    http://www.majorgeeks.com/download.php?det=3155

    When you run HijackThis from C:\HJT folder and have it "Fixed checked" it
    will create a backup file of modifications to use if restore is necessary.
    The TEMP folder is used by install application to keep temporary files
    untill installed. The TEMP folder should be cleaned out frequently as it
    becomes filled with unneeded files.

    > O2 - BHO: (no name) - {1a5a2ea0-3477-11d8-b43d-00500485e140} - (no file)


    > O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A


    > O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

    Office\Office\OSA9.EXE

    > O8 - Extra context menu item: &Add animation to IncrediMail Style Box
    > - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
    CalamityKen, Feb 29, 2004
    #2
    1. Advertising

  3. systemtool

    systemtool Guest

    On Sun, 29 Feb 2004 08:40:18 -0500, "CalamityKen" <>
    wrote:

    >systemtool typed:
    >> I recently noticed that IE 6.0 would load strange things if I omitted
    >> the www or the http prefix from known good web locations when typing
    >> in the location bar.
    >>
    >> If I take a URL that works in Netscape 7.1, or works if I click a link
    >> to it from IE 6.0, and type that url in the location bar, one of two
    >> things will happen:
    >>
    >> 1. Sometimes, the browser will take me to another part of the web site
    >> that the url points to (but NOT my desired URL; some other url on that
    >> web site).
    >>
    >> 2. Sometimes, Windows will give me this error: "Windows can't find
    >> [the exact thing I typed in the location bar]. Check the spelling and
    >> try again, or try searching for the item by clicking the Start button
    >> and then clicking Search"
    >>
    >> Here are some things I've tried:
    >>
    >> a) Checking my registry. It's okay. I followed the procedure in
    >> http://www.mvps.org/inetexplorer/answers_8.htm#extension and the
    >> values were correct without any tweaking from me.
    >>
    >> b) Clearing my IE cache (temporary internet files). I did this. It
    >> didn't fix the problem.
    >>
    >> c) Check my hosts file. There are no entries in the hosts file for
    >> sites that I'm having trouble with.
    >>
    >> d) Check for spyware. I ran the current versions of Ad-Aware and
    >> Spybot, both with newly-updated reference files. Ad-aware found a ton
    >> of stuff, mostly related to WildTangent (blast it all, I gave in and
    >> installed AIM for my kids, and that crap came with the latest
    >> version). Spybot then found one other thing. All spyware has been
    >> removed. I ran both programs again and it came up clean.
    >>
    >> e) My computer is virus free - NAV with virus definitions updated
    >> through 2/25.
    >>
    >> f) I ran a current version of Stinger. That found nothing funny.
    >>
    >> g) I ran hijackthis. A log file will be at the end of this post.
    >>
    >> Please give me some new ideas to try... my wife has been waiting for
    >> me in bed for three hours while I've tried and failed to fix this!
    >>
    >> hijackthis logfile:
    >> ++++++++++++++++++++++++++++++++
    >> Logfile of HijackThis v1.97.5

    >
    >You are two levels down.
    >
    ><snip good stuff so that it is easier to remove bad stuff>
    >
    >> C:\WINDOWS\TEMP\HIJACKTHIS.EXE

    >
    >Important: Create a folder on the C: drive called C:\HJT.
    >You can do this by going to My Computer (Windows key+e) then double click on
    >C: then right click and select New then Folder and name it HJT.
    >Download into this folder.
    >http://www.majorgeeks.com/download.php?det=3155
    >
    >When you run HijackThis from C:\HJT folder and have it "Fixed checked" it
    >will create a backup file of modifications to use if restore is necessary.
    >The TEMP folder is used by install application to keep temporary files
    >untill installed. The TEMP folder should be cleaned out frequently as it
    >becomes filled with unneeded files.
    >
    >> O2 - BHO: (no name) - {1a5a2ea0-3477-11d8-b43d-00500485e140} - (no file)

    >
    >> O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A

    >
    >> O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

    >Office\Office\OSA9.EXE
    >
    >> O8 - Extra context menu item: &Add animation to IncrediMail Style Box
    >> - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm


    Okay, I followed the above instructions explicitly. The
    hijackthis.exe file I downloaded was the same one I had in a couple
    spots on my computer, temp folder included. But now, it's in c:\hjt

    My odd IE behavior continues. Fixing that is what I'm really after
    (although, obviously, having a spyware-free, nonhijacked PC is the top
    priority).

    Here's the newest logfile. I couldn't readily see any differences
    from before:

    +++++++
    Logfile of HijackThis v1.97.7
    Scan saved at 9:27:34 AM, on 2/29/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\MOUSE\SYSTEM\EM_EXEC.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
    C:\WINDOWS\SYSTEM\HPZTSB04.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
    C:\WINDOWS\RunDLL.exe
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS
    SHARED\WKCALREM.EXE
    C:\PROGRAM FILES\PYRENEAN\EDEXTER\EDEXTER.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\EUDORA\EUDORA.EXE
    C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
    C:\PROGRAM FILES\AGENT\AGENT.EXE
    C:\HJT\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    http://keyword.netscape.com/keyword/%s
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: (no name) - {4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} -
    C:\PROGRAM FILES\E-BOOK SYSTEMS\FLIPVIEWER\FPLAUNCH.DLL
    O2 - BHO: (no name) - {1a5a2ea0-3477-11d8-b43d-00500485e140} - (no
    file)
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
    O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton
    Utilities\NPROTECT.EXE
    O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead
    Photo Express 2 SE\ChkFont.exe
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
    O4 - HKLM\..\Run: [Norton Auto-Protect]
    C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
    O4 - HKLM\..\Run: [Norton eMail Protect] C:\PROGRAM FILES\NORTON
    ANTIVIRUS\POProxy.exe
    O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
    C:\WINDOWS\SYSTEM\hpztsb04.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE"
    -atboottime
    O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common
    Files\Real\Update_OB\evntsvc.exe -osboot
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
    powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton
    Utilities\NPROTECT.EXE
    O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL
    deskcp16.dll,QUICKRES_RUNDLLENTRY
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
    Office\Office\OSA9.EXE
    O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program
    Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O4 - Startup: TimeSync.lnk = C:\Program Files\Tools For Selling\Time
    Synchro\TSYN.EXE
    O4 - Startup: eDexter.lnk = C:\Program
    Files\Pyrenean\eDexter\eDexter.exe
    O4 - Startup: PowerReg Scheduler V3.exe
    O8 - Extra context menu item: &Add animation to IncrediMail Style Box
    - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Dell Home (HKCU)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) -
    http://office.microsoft.com/productupdates/content/opuc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
    Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
    O16 - DPF: {7B461720-5910-45A3-B617-3B53A972F209} (Pixami-PhotoWorks
    Upload UI Control) -
    http://services.photoworks.com/Pixami/PixamiSFWUploader.cab
    O16 - DPF: {0DD4833D-DFFA-11D3-94D7-0050DAC353B6} (DndCtrl Class) -
    http://www.ofoto.com/OfotoDND.cab
    O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print
    ActiveX Plug-in) - http://di.imgag.com/imgag/cp/install/AxCtp.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
    http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37705.4612384259
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX
    Control) -
    http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI
    Registry Information Class) -
    http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    systemtool, Feb 29, 2004
    #3
  4. systemtool

    systemtool Guest

    For others who may have problems with IE not assuming www or http prefixes

    I had posted previously to these news groups about a problem I'd had
    with IE 6. I was attributing it to spyware, but it turns out that I
    was wrong.

    In simple terms, if I typed some web locations into the IE location
    bar without a prefix of www or http://, one of two bad unwanted things
    would happen:

    1. Sometimes, if I'd type, for example:

    ----> placeiwanttobrowseto.com

    I would wind up having IE take me instead to

    ----> http://placeiwanttobrowseto.com/unwanteddirectory.html

    2. But let's say I *did* want to go to
    placeiwanttobrowseto.com/unwanteddirectory.html and typed exactly that
    into the location bar. Then, I'd get an immediate Windows message
    saying "Windows cannot find
    placeiwanttobrowseto.com/unwanteddirectory.html. Check the spelling
    and try again, or try searching for the item by clicking the Start
    button and then clicking Search"

    Just for giggles, I did a Start menu "find files or folders" search
    for placeiwanttobrowseto. Darned if there wasn't an IE "favorite"
    with that name. AND, the favorite was actually set to point to
    http://placeiwanttobrowseto.com/unwanteddirectory.html

    Now I never remember setting up a favorite like that. Perhaps some
    spyware altered an existing favorite. But when I deleted the
    favorite, the problem went away and IE 6 resumed working flawlessly.

    I'm posting this because I'd seen a lot of people posting questions
    about why their browser would do odd things if they omitted the www or
    the http:// prefix, but I never saw a fix that worked for me. Well, I
    had the problem, and so I'm hoping at least one other person out there
    might see this and have my fix help.
    systemtool, Mar 1, 2004
    #4
  5. systemtool

    systemtool Guest

    I figured out my problem. It was a messed up IE favorite, and
    deleting that favorite fixed the problem.

    See the new posting, "For others who may have problems with IE not
    assuming www or http prefixes" in this newsgroup for more details.
    systemtool, Mar 1, 2004
    #5
  6. systemtool

    SaltPeter Guest

    Re: For others who may have problems with IE not assuming www or http prefixes

    "systemtool" <> wrote in message
    news:...
    > I had posted previously to these news groups about a problem I'd had
    > with IE 6. I was attributing it to spyware, but it turns out that I
    > was wrong.
    >
    > In simple terms, if I typed some web locations into the IE location
    > bar without a prefix of www or http://, one of two bad unwanted things
    > would happen:
    >
    > 1. Sometimes, if I'd type, for example:
    >
    > ----> placeiwanttobrowseto.com
    >
    > I would wind up having IE take me instead to
    >
    > ----> http://placeiwanttobrowseto.com/unwanteddirectory.html
    >
    > 2. But let's say I *did* want to go to
    > placeiwanttobrowseto.com/unwanteddirectory.html and typed exactly that
    > into the location bar. Then, I'd get an immediate Windows message
    > saying "Windows cannot find
    > placeiwanttobrowseto.com/unwanteddirectory.html. Check the spelling
    > and try again, or try searching for the item by clicking the Start
    > button and then clicking Search"
    >
    > Just for giggles, I did a Start menu "find files or folders" search
    > for placeiwanttobrowseto. Darned if there wasn't an IE "favorite"
    > with that name. AND, the favorite was actually set to point to
    > http://placeiwanttobrowseto.com/unwanteddirectory.html
    >
    > Now I never remember setting up a favorite like that. Perhaps some
    > spyware altered an existing favorite. But when I deleted the
    > favorite, the problem went away and IE 6 resumed working flawlessly.
    >
    > I'm posting this because I'd seen a lot of people posting questions
    > about why their browser would do odd things if they omitted the www or
    > the http:// prefix, but I never saw a fix that worked for me. Well, I
    > had the problem, and so I'm hoping at least one other person out there
    > might see this and have my fix help.


    Try this, type "placeiwanttobrowseto" in address bar and CTRL + Enter.
    SaltPeter, Mar 1, 2004
    #6
  7. systemtool

    H Leboeuf Guest

    Re: For others who may have problems with IE not assuming www or http prefixes

    You were hacked by some parasites.

    Look at your security setting and issues on this page.

    Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
    http://mvps.org/winhelp2002/unwanted.htm

    --

    Henri Leboeuf
    Web page: http://www.generation.net/~hleboeuf/index.htm


    "systemtool" <> wrote in message
    news:...
    > I had posted previously to these news groups about a problem I'd had
    > with IE 6. I was attributing it to spyware, but it turns out that I
    > was wrong.
    >
    > In simple terms, if I typed some web locations into the IE location
    > bar without a prefix of www or http://, one of two bad unwanted things
    > would happen:
    >
    > 1. Sometimes, if I'd type, for example:
    >
    > ----> placeiwanttobrowseto.com
    >
    > I would wind up having IE take me instead to
    >
    > ----> http://placeiwanttobrowseto.com/unwanteddirectory.html
    >
    > 2. But let's say I *did* want to go to
    > placeiwanttobrowseto.com/unwanteddirectory.html and typed exactly that
    > into the location bar. Then, I'd get an immediate Windows message
    > saying "Windows cannot find
    > placeiwanttobrowseto.com/unwanteddirectory.html. Check the spelling
    > and try again, or try searching for the item by clicking the Start
    > button and then clicking Search"
    >
    > Just for giggles, I did a Start menu "find files or folders" search
    > for placeiwanttobrowseto. Darned if there wasn't an IE "favorite"
    > with that name. AND, the favorite was actually set to point to
    > http://placeiwanttobrowseto.com/unwanteddirectory.html
    >
    > Now I never remember setting up a favorite like that. Perhaps some
    > spyware altered an existing favorite. But when I deleted the
    > favorite, the problem went away and IE 6 resumed working flawlessly.
    >
    > I'm posting this because I'd seen a lot of people posting questions
    > about why their browser would do odd things if they omitted the www or
    > the http:// prefix, but I never saw a fix that worked for me. Well, I
    > had the problem, and so I'm hoping at least one other person out there
    > might see this and have my fix help.
    H Leboeuf, Mar 1, 2004
    #7
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?R2FsZW4=?=

    Wireless USB Adapters: A Probable List Of Supported Brands

    =?Utf-8?B?R2FsZW4=?=, Sep 27, 2005, in forum: Windows 64bit
    Replies:
    2
    Views:
    1,655
    Mirko
    Sep 28, 2005
  2. PeterOut

    spyware.bearshare found by "Spyware Detector"

    PeterOut, Oct 27, 2007, in forum: Computer Support
    Replies:
    21
    Views:
    936
    Dustin Cook
    Nov 13, 2007
  3. PeterOut

    spyware.bearshare found by "Spyware Detector"

    PeterOut, Oct 27, 2007, in forum: Computer Security
    Replies:
    18
    Views:
    975
    Jim Watt
    Nov 14, 2007
  4. dfinc
    Replies:
    1
    Views:
    900
    Kayman
    Jan 23, 2009
  5. richard

    Walking wrong is probable cause?

    richard, Apr 9, 2010, in forum: Computer Support
    Replies:
    9
    Views:
    708
    gangle
    Apr 10, 2010
Loading...

Share This Page