View Single Post
Old 06-06-2005, 12:22 PM   #17 (permalink)
Scorpex
Analyst, Security Team
 
Join Date: Mar 2005
Location: NY
Posts: 350
OS: XP Pro/Home SP2


Send a message via ICQ to Scorpex
I was able to duplicate your problem by deleting my HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\URL key. I deleted it and ran a scan in HijackThis and I had the same empty O13 entries that you have and HijackThis was unable to fix them. I reinstalled the URL key and the entries were gone from HJT.


Click Start >>Run and then type regedit - Click OK

Go to File->Export
Type in a file name and at the bottom of the window it should say Export Range, you need to select ALL and then save the registry somewhere as a backup.




Right-click the url.txt attachment below and click ‘Save Target As’
Change the name to url.txt (by default it wants to call it attachment.txt)
Save it to your desktop.


Once it's on your desktop:
You need to rename the url.txt file. Change it to url.reg

You’ll get a warning asking if you really want to change it – click YES

Double click the url.reg and it will ask you if you want to add the information to the registry – Click YES

Then another box will pop up saying the information has sucessfully been added to the registry. Click OK


Run a scan in HijackThis and let us know how you made out.


4SG
Attached Files
File Type: txt url.txt (760 Bytes, 5 views)

Last edited by Scorpex; 06-06-2005 at 12:40 PM.
Scorpex is offline