Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Combofix question about navigator.useragent

  • Please log in to reply
No replies to this topic

#1 ksenter


  • Members
  • 1 posts
  • Local time:09:00 PM

Posted 01 June 2011 - 11:38 AM

Hey All,

First off thanks for making combofix, it has been amazingly helpful to me at removing some really nasty rootkits and malware.

Recently, we have started using a piece of web based .NET software that requires the Microsoft.NET 3.5 framework to be installed. The way that it checks that it is installed is by checking the navigator.useragent in javascript which returns a string similar to this in IE:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; MS-RTC LM 8; MS-RTC EA 2)

It parses the string looking for ".NET CLR 3.5" and if it doesn't find it it alerts the user that they need to install .NET 3.5.

The problem is that after running combofix the navigator.useragent function only returns:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

The only way that I have found to fix it is to reinstall .NET. So, my question is, is there a reason that combofix needs to reset that string, or is it a side-effect of something else that it does? Also, I just wanted to make you aware of this in case you didn't know. But if it's by design it's not a big deal to reinstall .NET whenever I use combofix, as that's not something I need to do often.

Thanks again.

BC AdBot (Login to Remove)


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users