Re: IE Browser redirection

From: Dave (noone_at_nowhere.com)
Date: 07/17/04


Date: Sat, 17 Jul 2004 21:16:28 -0000

this is probably because there is a program running that replaces the
registry keys as fast as you delete them. scan some more, use other
programs, you need to find the malware that is writing the registry keys,
they don't just show up on their own.

"Del Reedy" <delreedy@earthlink.net> wrote in message
news:ijgKc.1746$iK.750@newsread2.news.atl.earthlink.net...
> Hi
>
> I'm having a problem with IE6.
>
> When I attempt to connect to any website with IE6, at the bottom
> it says "attempting to connect to 127.0.0.1", then I get the error:
> "The page cannot be displayed"
>
> After doing some google research I think this is possibly the result of
> of a partially uninstalled pop-up blocking program (which I wouldn't
> know the name of).
>
> There is a registry entry (below) which I think directs all of Internet
> Explorer's http requests to a proxy server on the localhost. Although
> nothing seems to be listening on 8080, which explains the blank page.
>
> Hijackthis shows the following entry
>
> HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyServer
> = http=localhost:8080
>
> Which I suspect is the reason why, when I open IE it tries to connect to
> 127.0.0.1.
>
> If I delete the registry entry above it gets written back the next time I
> open IE.
>
> If I delete the entry above and immediately rescan with hijackthis a few
new
> ones appear:
>
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
>
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
> R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
> Settings,ProxyOverride = <local>
>
> Even if I delete the new ones, later when I run IE the original one will
get
> written back.
>
> So the problem is that I can't seem to get rid of this entry, and it's
> driving me crazy.
>
> HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyServer
> = http=localhost:8080
>
> What can I do to prevent this or discover the program that is changing the
> registry entries?
>
> Thanks in advance.
>
>



Relevant Pages

  • Re: Registry question
    ... RegMaid.exe Helps Clean Up the Registry ... Microsoft Visual C++, 32-bit Learning Edition, version 6.0 ... RegMaid provides information about entries that are believed to be ... server file entry cannot be found by the system. ...
    (microsoft.public.windowsxp.general)
  • Re: MS Backup
    ... Okay, I had to go to bed too:) Now, no cd is nothing to worry about. ... reason you don't have that entry in your registry is because you don't have ... >> msnewsgroups..on the right, then go to the toolbar, click on view>current ...
    (microsoft.public.windowsxp.basics)
  • Re: Word opens slowly
    ... See http://support.microsoft.com/?kbid=329820 "How to use Office programs with the Norton AntiVirus Office plug-in" for more information. ... I have done three fresh install, scanning first, then defragging, then cleaning the registry before reinstalling Office. ... HKEY_CLASSES_ROOT\word\10.0 Delete the entire 10.0 entry. ...
    (microsoft.public.word.application.errors)
  • Re: C:WINDOWSafitelaguzeyaweb.dll
    ... entry the "right" way:. ... an associated orphaned startup parameter or registry entry ... tool called Autoruns. ...
    (microsoft.public.windowsxp.basics)
  • Re: HP Scanjet 5400cse
    ... Do you have any help on the registry update. ... that I must uninstall again; clean up residual folders, ... Create a new folder on your desktop and name it registry backups, ... select export now navigate to the folder you created and save this entry ...
    (microsoft.public.windowsxp.general)