problem with IE: "Shell"/"Res" Cross Zon
|
Jul. 16, 2005, 04:45 AM
Post: #1
|
|||
|
|||
problem with IE: "Shell"/"Res" Cross Zon
Hi. I have posted at the following site http://castlecops.com/p589631-.html#589631 regarding a fault with a filter. I am using Grypens filter set.
The problem relates to about:blank entries in hijackthis logs. It converts this; Quote:R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kduiq.dll/sp.html#93256 to this; Quote:R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar /> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page /> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank I have unchecked that particular filter in order for me to correctly view the logs. Thanks guys. |
|||
Jul. 16, 2005, 05:16 AM
Post: #2
|
|||
|
|||
It's matching the "res" parts of the HJT logs
Replace "IE: "Shell"/"Res" Cross Zone Exploit [Kye-U]" and "Prevent file access [Siamesecat] {Modified by Kye-U}" with the following filters: Code: [Patterns] I will include this in my next release. (Perhaps I'll have to implement a bypass list...) |
|||
« Next Oldest | Next Newest »
|