Posted 01 June 2011 - 11:38 AM
First off thanks for making combofix, it has been amazingly helpful to me at removing some really nasty rootkits and malware.
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; MS-RTC LM 8; MS-RTC EA 2)
It parses the string looking for ".NET CLR 3.5" and if it doesn't find it it alerts the user that they need to install .NET 3.5.
The problem is that after running combofix the navigator.useragent function only returns:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
The only way that I have found to fix it is to reinstall .NET. So, my question is, is there a reason that combofix needs to reset that string, or is it a side-effect of something else that it does? Also, I just wanted to make you aware of this in case you didn't know. But if it's by design it's not a big deal to reinstall .NET whenever I use combofix, as that's not something I need to do often.