Re: "ehttp.cc" insertion in URL

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Bill Sanderson (Bill_Sanderson_at_msn.com.plugh.org)
Date: 02/17/04 

Date: Mon, 16 Feb 2004 22:42:30 -0500

If you go here:
h t t p://ehttp.cc/ehttp.h t m l
(without the extraneous spaces I inserted to prevent clicking on the link.)

there are links to install and uninstall .REG files.

Here's the uninstall .reg:
----------------------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
@="http://"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"www."="http://"
"www"="http://"
-----------------------------

You might want to go to those registry locations and observe the entries,
and compare them to a healthy machine, and make the appropriate changes.

Here is what the INSTALL reg file looks like:
---------------------------------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
@="http://ehttp.cc/?"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"www."="http://ehttp.cc/?"
"www"=http://ehttp.cc/?
------------------------------------------------------
So--you are reversing those changes.

"Gary Brown" <anonymous@discussions.microsoft.com> wrote in message
news:10b2701c3f44b$a5118820$a001280a@phx.gbl...
> Every time I enter a URL in IE, the string "ehttp.cc" is
> inserted between the "http://" and what I have typed.
> When this happens, new links appear in the Favorites
> dropdown list, etc. I can stop the insertion by entering
> every URL with "http://" first.
>
> Some IT security professional discussion groups have
> posts on this, but the anti-virus companies do not seem
> to mention it. Anyone know of a way to remove this thing?