Re: Help! Ad-aware found: Registry--> Possible Browser Hijack attempt

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: PA Bear (PABear_at_mvps.org)
Date: 05/27/04 

Date: Thu, 27 May 2004 13:02:23 -0400

Robert, both current versions of Ad-aware and Spybot are identifying this
and some other keys as /possible/ hijacking*. If user has intentionally
selected a blank homepage (about:blank), the report should be viewed as a
false-positive and ignored.

*CWS.Aboutblank, CWS.Searchx, et alia 

-- 
~PA Bear
Robert Aldwinckle wrote:
>> TODAY, it found it again. My question is: What do I do??!?!?!
>> I'm running WinXP.
>
> It looks as if that proxy if it is going to work has to be running
> somewhere
> on your machine  (e.g. ProxyServer address like 127.0.0.1)
> If so, you could probably see it with
>     netstat  -ao
> (e.g. that would show "listening" PID so then you would match up the PID
> with an imagename using  Task Manager.)
>
> Since you know the port involved you can actually make the output even
> more particular with the following pipeline:
>
>     netstat  -ano  |  find  /i  ":9002"
>
> XP's  netstat   can give you even more detail about the process involved
> including the .dlls it is using.
>
>     netstat  -abvon  -p tcp
>
> However, the -b option seems to slow it down absurdly.
>
> What I would do instead is once I got the PID from the -o option
> I'd use the  tasklist  command and use the  PID  for a filter criterion.
> E.g. say your netstat  told you that the PID was 1234 then the tasklist
> command you would enter would be:
>
>     tasklist  /m  /fi  "PID eq 1234"
>
> That gives essentially the same information much quicker.
>
>
> Since you suspect that "something" is adding those registry entries
> another diagnostic I would use is  RegMon  with an input filter of  Proxy
> (RegMon is freeware from SysInternals.)   This  would be especially easy
> if the changes are being made after boot time but  RegMon  for  NTx  also
> has a way of tracing activity during the boot too.   To set the filter I
> find it simplest just to press  Ctrl-L  then type my input criteria in
> the Include box. Alternatively use the filter icon in the toolbar.
> Unless you find a good reason to use a more inclusive input criterion I
> think you may find that that one
> is sufficient without being overwhelming.
>
>
> Good luck
>
> Robert Aldwinckle
> ---
>
>
> "Debbie" <anonymous@discussions.microsoft.com> wrote in message
> news:uQJBMwfQEHA.3596@tk2msftngp13.phx.gbl...
>> Hello-
>> Two days ago Ad-aware found:
>> Possible Browser Hijack attempt -
>> RegData -HKEY_CURRENT_USER:Software\Microsoft\Internet
>> Explorer\Main"Start Page" ("about:blank")
>> So, I just got rid of it (even the quarantine one) . Then, TODAY, it
>> found it again. My question is: What do I do??!?!?!
>> I'm running WinXP.
>>
>> Thanks

Relevant Pages

  • Re: Help! Ad-aware found: Registry--> Possible Browser Hijack attempt
    ... >> (e.g. that would show "listening" PID so then you would match up the PID ... >> XP's netstat can give you even more detail about the process involved ... >> another diagnostic I would use is RegMon with an input filter of Proxy ... >> Robert Aldwinckle ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: [PATCH 0/3] ftrace: updates for tip
    ... I added a "trace" flags field in the task structure. ... The second patch uses this for the ftrace pid code. ... Regarding the filter functions, ... to only specify the PID, ...
    (Linux-Kernel)
  • Re: PID Controller
    ... I would love to see your solution for the Bode plot below. ... If you ask me for good, I will design the PID function which compensates ... >> How do you use it to determine the filter and the coefficients? ... > higher order loop. ...
    (comp.dsp)
  • Re: PID Controller
    ... >> How do you use it to determine the filter and the coefficients? ... > higher order loop. ... takes some calculations for a small PID augmentation. ... How many customers can tune a lead lag filter ...
    (comp.dsp)
  • Re: PID Controller
    ... algorithm from a block diagram of a controller. ... John Shaw's and Tim Wescott's sites with PID examples. ... 2nd derivative and/or an output filter. ... How do you get the Bode plot? ...
    (comp.dsp)