2 replies to this topic

[fhurst]

In Spybot - Search & Destroy's browser pages report, is this entry:

%SystemRoot%\system32\blank.htm


There used to be another blank page entry left after the trojan cleanup that I ran, but when I went to copy it for this post it was gone.
It didn't have the % SystemRoot% stuff, it just said something ...blank page. I wish I could remember.

Which one, if not both, is legitimate, or is one of them the remnants of a hijacker that I removed?

cheers! ;D
fhurst

[roadrage]

Hello:fhurst
Hope this help's you.
Could these be the file's in question

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINNT\System32\blank.htm

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
about:blank

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
%SystemRoot%\system32\blank.htm

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar
about:blank

NOTE: Here are some valid default settings:

"Default_Page_URL"="http://www.microsoft...r=6&ar=msnhome"

"Default_Search_URL"="http://www.microsoft...ie&ar=iesearch"

"Search Page"="http://www.microsoft...ie&ar=iesearch"

"Start Page"="http://www.microsoft..._PVER}&ar=home"


These for the most part are legit untill they are modified , which is what Malware and Trojan's like to do, see example below, the bold is a bad modifed entry.

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.underloli...ion=in&ACC=751"

[fhurst]

Hello:fhurst
Hope this help's you.
Could these be the file's in question
--snip--

Thanks roadrage,

I think it was the about:blank that was missing. I found out that there was an about:blank trojan going around, but I don't think I had it.

The about:blank, that I had listed in Spybot S&D, I thought, was one I chose as my default home page from the Browser's options settings, and it should not have disappeared like that. So my question should have been: "Which one of those you posted is the blank page from the IE's options settings", but since I don't know the difference between one and another I guess I need to learn what all of them are.

Since my post, I have, on and off, made Opera or Firefox my default browser. Does Spybot S&D list these in it's "browser pages report", or are all those listings for IE alone?

Currently the only reason I use IE is to view pages I can't view in the other two browsers and to update XP.

I went through all the security settings for Internet Options and turned everything off, I turn them on for updates and that's it. Since then the only spybots I have had to deal with have all been noncritical.

Edited by fhurst, 28 August 2004 - 08:19 PM.