Re: What's this? (strange address in browser)

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Thanks very much! I've been out of the country and am now looking for old
postings, so I hope this thank you makes it to you!

"Robert Aldwinckle" <robald@xxxxxxxxxxxxx> wrote in message
news:eTphqZWMFHA.2788@xxxxxxxxxxxxxxxxxxxxxxx
> "Laurel" <FakeMail@xxxxxxxxxxx> wrote in message
> news:uT0k3IIMFHA.2648@xxxxxxxxxxxxxxxxxxxxxxx
>>I typed in www.d-a-l.com/help, and it says the page may have been removed,
>> but the address in the browser is what you see below. What's all the
>> ?%20
>> stuff? Is that normal?
>>
>> http:///?%20www.d-a-l.com/help
>
> No it is not normal. It may indicate that you have a search bar hijacker
> (or had one which hasn't been completely removed).
>
> Here is some background information to help you understand what
> could be happening.
>
> When you enter something from the Address bar without
> a protocol prefix it may be recognized as a partial URL
> (probably using those Prefix values that Frank pointed you to)
> and a DNS lookup is attempted. If that fails the request is passed
> first to your AutoSearch provider. I suspect that this is a symptom
> of that happening.
>
> The normal way of explicitly invoking the AutoSearch provider
> from the Address bar is to prefix search arguments by ?, go, or find,
> followed by a space. That's what you are seeing: a question mark
> followed by a space followed by a search argument.
> Perhaps the implementation of passing an implicit request to the
> AutoSearch provider is to simulate the user having done one?
> Then normally the search request however made would be
> converted into a real HTTP request for the AutoSearch provider.
>
> In the event that your AutoSearch provider is also inaccessible
> (e.g. DNS is down) you would next see your partial URL prefixed
> by www. and suffixed first (for US users) by .com. This is the
> first step of an anachronism called AutoScan which is actually
> what people invoke directly when they press Ctrl-Enter after typing
> just a site's domain name. The rest of AutoScan cycles through
> the remaining patterns listed under
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\UrlTemplate
>
> Perhaps you noticed those patterns in your Status bar
> as they were being tested?
>
> The final step after the final AutoScan lookup fails is to go back
> to the AutoSearch provider again and display that URL in the
> Address bar to the user. It suprises me that we don't see more
> questions about that URL and instead see so many for the one
> which (I am speculating) is an implicit request. Perhaps all it
> means is that there is an indication that AutoSearch is allowed
> but when it comes time to generate the URL the value which
> supplies its pattern is missing or void.
>
> By design you should be able to recover from the above
> scenario by using the Reset Web Settings... button
> (in Options, Programs tab). However, some claim that
> hijackers just use this as an opportunity to reinstall their
> own search. YMMV.
>
>
> HTH
>
> Robert Aldwinckle
> ---
>
>
>


.

Quantcast