Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

O24. What is this, please?


  • This topic is locked This topic is locked
10 replies to this topic

#1 Reena

Reena

  • Members
  • 391 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:04:39 AM

Posted 24 January 2009 - 07:13 AM

When I run HiJack This I see I have an entry:

O24 - Desktop Component 0: (no name) - (no file)

I have tried Control Panel.........Display........Desktop..............Customize..............Web

and I have no web pages listed.

Should I be worried about this O24 entry, please? My thanks in advance.


I inadvertantly posted this in the "Infected" section and was told that was wrong. I hope this is the "right" section. I have always had fantastic help from Bleeping Computer experts, particularly in the Highjack This section.

BC AdBot (Login to Remove)

 


#2 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:39 AM

Posted 24 January 2009 - 09:44 AM

Hello Reena,

Welcome to Welcome to BC HijackThis forum.

This is nothing to worry about. You probably have used autoruns to remove a default empty desktop component file.

If you restore it to its default the Hijackthis entry doesn't show that item any more. To restore it:

Open a notepad (Start > Run and type in Notepad ) make sure the wordwrap under Format menu is not selected.
Copy and paste the text in code box into it.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
  00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
  00,00,01,00,00,00
  • Save the file to the desktop as regfix.reg
  • Make sure the Save as type field says All files.
  • Locate regfix.reg on the desktop and double-click on it and confirm.
  • A window pops up asking if you are sure to add the file to the registry. Click Yes.
  • You get another window popup saying that regfix.reg successfully added to the registry.
Note: You have to turn off any registry protector software you have in order the changes to be taken place.

Now if you go to Control Panel > Display > Desktop > Customize > Web in place of an empty place you see My Current Home Page which is the default and could not be removed from there. But you should not remove it again with autoruns.

Edited by farbar, 24 January 2009 - 09:50 AM.


#3 Reena

Reena
  • Topic Starter

  • Members
  • 391 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:04:39 AM

Posted 24 January 2009 - 10:16 AM

Thank you Farbar.

All went well until I got to the last stage. I was then told :

"Cannot import. Specified file is not registry script. You can only import binary registry files from withing registry editor."



#4 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:39 AM

Posted 24 January 2009 - 10:39 AM

Thank you Farbar.

All went well until I got to the last stage. I was then told :

"Cannot import. Specified file is not registry script. You can only import binary registry files from withing registry editor."


It should work. Could you rename the regfix.reg to regfix.txt and post the content.

#5 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:39 AM

Posted 24 January 2009 - 10:41 AM

In addition tell me also what is your OS.

#6 Reena

Reena
  • Topic Starter

  • Members
  • 391 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:04:39 AM

Posted 24 January 2009 - 03:18 PM

Could you rename the regfix.reg to regfix.txt and post the content.


When I do this I end up with :


[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

No instructions follow!

Windows XP (Home Edition)
AdAware SE
Malwarebytes' Anti-Malware
Super AntiSpyware Pro
Avira Anti-Virus Personal (Free)

My thanks

Reena(UK)

#7 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:39 AM

Posted 24 January 2009 - 06:44 PM

Reena,

The script I have suggested have also this line which is missing in your regfix.reg:

Windows Registry Editor Version 5.00

So if you do it once again and make sure all the contents of the code box is included it will work. Let me know how it went.

Edited by farbar, 24 January 2009 - 06:46 PM.


#8 Reena

Reena
  • Topic Starter

  • Members
  • 391 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:04:39 AM

Posted 25 January 2009 - 07:14 AM

I still get :

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

When I used the term regfix.reg the first time all went "well" until the last part. Now, all I get is the text and no means of adding it to the registry.

#9 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:39 AM

Posted 25 January 2009 - 07:47 AM

OK it is all about doing the steps as described in my first post. At the first attempt you did not copied all the content of the code box. At the second attempt the regfix was not a registry (xxx.reg) file but a (xxx.txt) file. When I asked you to rename the reg file I wanted to show you dat the content was not what it meant to be an why it did not work.
So please remove any regfix file with any extension from your desktop and follow the steps in my first post. It will do it.

#10 Reena

Reena
  • Topic Starter

  • Members
  • 391 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:04:39 AM

Posted 25 January 2009 - 10:33 AM

Farbar : Thank you for your patience.

It worked, just as you said it would.

My THANKS

#11 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,730 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:39 AM

Posted 25 January 2009 - 11:05 AM

You are welcome Reena, glad I could help.

This thread will now be closed.

If you should have a new issue, please start a new topic.

Happy computing!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users