Page 1 of 2 12 LastLast
Results 1 to 10 of 12
  1. #1
    Member Spyware Fighter zep516's Avatar
    Join Date
    Dec 2005
    Location
    Pittsburgh, Pa
    Posts
    7,158
    Points
    1301

    Default Can't remove 2 RO-entries?

    They will not go away after fixed check in safe mode anyone no why, they don't appear to point to anything and do not cause a problem I'm just curious about it.

    Xp home, latest version of hijack.


    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =


    zep.

  2. #2
    Member
    Join Date
    Dec 2002
    Posts
    12,000
    Points
    1191

    Default

    zep:

    Should not be a problem removing as far as know. But as you said they point to no where.

    Run HJT again and go into the "config">back ups

    Are they listed in the back up files?

    BG

  3. #3
    Member Spyware Fighter zep516's Avatar
    Join Date
    Dec 2005
    Location
    Pittsburgh, Pa
    Posts
    7,158
    Points
    1301

    Default

    Yes there listed as back ups every time I have deleted them there backed up and that is supposed to happen correct? Well I can't delete the back ups unless I'm doing it wrong... The only thing I can think of and this makes no sense is to re-install hijack and go into safe mode, like I said there is no problem with the pc...Just fussy with the log now..

    zep.

  4. #4
    Member
    Join Date
    Dec 2002
    Posts
    12,000
    Points
    1191

    Default

    Are you saying that the files are still listed in the HJT log and the backups at the same time? That was what I kind of was asking

    There is generally no reason for the HJT program to be run in the safe mode. Only time I do that is if there is a running process and there is no run entry to stop it. In your case it should not matter safe or normal mode.

    Unless you have other files, in the back up folder that you are not sure of to delete, go ahead and delete the HJT folder. Install a new HJT program and try it again.

    If the lastest version of the HJT program still not working correctly, for what ever reason, try to find an older version of HJT and try it.

    BG

  5. #5
    Member steamwiz's Avatar
    Join Date
    Sep 2003
    Location
    Yorkshire U.K.
    Posts
    14,022
    Points
    2335

    Default

    Hi zep

    those are default windows registry keys ... they should NOT be removed...

    Chances are they are windows managed & that windows is replacing them anyway ...

    Run hijackthis & open the misc tools section

    click the Main button

    you will see 4 default entries towards the bottom ...

    default search assistant & default search customise are the bottom 2 ...

    I'll bet they are blank ?

    past this into both of them
    Code:
    http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
    now reboot & run hijackthis again ...

    steam
    Look here for Ways to keep your computer safe
    M'SOFT MVP -Windows Security 2004/8 .member ASAP -

  6. #6
    Member Spyware Fighter zep516's Avatar
    Join Date
    Dec 2005
    Location
    Pittsburgh, Pa
    Posts
    7,158
    Points
    1301

    Default

    Steamwiz,

    Thanks for clearing that up for me I have been trying to rid those, because they don't point any where and I thought they may be left overs, well there was no way windows was going to let it happen. Those default entries were not blank and appeared to contain the correct data.



    zep.

  7. #7
    Member steamwiz's Avatar
    Join Date
    Sep 2003
    Location
    Yorkshire U.K.
    Posts
    14,022
    Points
    2335

    Default

    Hi zep

    if those entries in hijackthis were not empty then it appears they were not transferred to registry (which is blank)

    Look at my picture below...

    you will see my search assistant is set to google, but the default is the same as the customisesearch entry ...

    Run regedit and browse to the correct location...

    In the right pane, your customisesearch & searchassistant will be blank...

    doubleclick the word customisesearch & in the Value data box which opens, paste or type :-

    Code:
    http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
    then do the same for searchassistant ...

    Reboot & now see what hijackthis says ...

    steam
    Look here for Ways to keep your computer safe
    M'SOFT MVP -Windows Security 2004/8 .member ASAP -

  8. #8
    Member Spyware Fighter zep516's Avatar
    Join Date
    Dec 2005
    Location
    Pittsburgh, Pa
    Posts
    7,158
    Points
    1301

    Default

    Steamwiz,

    My Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\internet Explorer\?

    Yes that is a question mark, reason being I don't have the search entry listed I have "Searchscopes" Listed, clicking does not generate Customize Search nor Search Assistant in the right hand pane.

    My Windows 98SE has the search entry and it generates those 2 Items just as you said it would, but not this xp machine.

    I don't want to take a lot of of time here I know you guys have bigger fish to fry.

    zep.

  9. #9
    Member Spyware Fighter zep516's Avatar
    Join Date
    Dec 2005
    Location
    Pittsburgh, Pa
    Posts
    7,158
    Points
    1301

    Default

    Steamwiz,

    Perhaps it has something to do with this I'm using IE7.



    http://support.microsoft.com/kb/918238


    zep.

  10. #10
    Member steamwiz's Avatar
    Join Date
    Sep 2003
    Location
    Yorkshire U.K.
    Posts
    14,022
    Points
    2335

    Default

    Quote Originally Posted by zep
    Steamwiz,

    Perhaps it has something to do with this I'm using IE7.

    http://support.microsoft.com/kb/918238

    zep.
    Hi zep

    naw ... I have IE7 & I still have the keys you are missing ...

    I was going to make a reg file for you to replace those keys ... but kelly from kellyscorner already has one which will replace those keys & verify\replace other relating to search which may be missing ...

    Go here :-

    http://www.kellys-korner-xp.com/xp_tweaks.htm

    scroll down to :-

    229. Set IE Search to Default

    Download the reg file to your desktop ... doubleclick it & say yes to merge with the registry ...

    reboot to let the changes take effect ...

    Then run hijackthis & see if those entries are still found ... they shouldn't be.

    steam
    Look here for Ways to keep your computer safe
    M'SOFT MVP -Windows Security 2004/8 .member ASAP -

Page 1 of 2 12 LastLast