Favorites within Favorites folder!

[mike2002]

I'm running Wiondows 98SE with IE6.
Lately I've noticed that an entry called Favorites has appeared at the end of the list in my Favorites folder. (The screenshot will clarify).
When I delete it, it reappears again next day.
What's putting it there?

[mike2002]

For Wiondows - read Windows (yes pretty obvious I know!)

Don't know what happened to the screenshot but, hopefully, here it is.

[david eaton]

Hmm......... There are some varieties of foistware/adware that do that sort of thing.

Could you post a Hijack this log, just in case I'm right? Download Hijack this from HERE (http://www.spywareinfo.com/~merijn/files/hijackthis.zip).

OK, I know I'm paranoid. The question is, am I paranoid enough?

[Paul Komski]

Do you have a Links folder in your Favorites?? That is the folder that generally remakes itself inside favorites after it has been deleted. It can be also be renamed; so if links had been renamed to favorites this would explain the phenomenom. There is a registry entry somewhere, which designates/names the Links folder.

Found it, its:- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar and the key is called LinksFolderName.

[mike2002]

david: Have run a check with AdAware - nothing found.

Paul: You're right about the LinksFolderName. I read somewhere recently
about how to remove this 'Links' entry by editing the Registry (can't remember where I saw it!). I thought this method was supposed to remove it permanently, not having it popup under a changed name.

What if I deleted this registry key, would it merely replace itself?

[Paul Komski]

I think the answer is to have an empty string as its value rather than to delete it but you could of course try both - or just rename the key (instead of deleting it) and see if it is recreated.

[mike2002]

I deleted the whole key (backup made) and, so far, it hasn't reappeared.

I found the original 'tip', the instructions are as follows;--

To permanently delete the Links folder in Favourites. Run Regedit, and
navigate to HKEY_CURRENT_USER'Software/Microsoft/Internet Explorer/Toolbar.
Double-click on the LinksFolderName value, clear eveything in the value data box and click OK.
Start IE., right-click on your Internet Explorer Links folder in Favorites, then select Delete.

Thanks once again Paul.

;)

[mike2002]

I spoke too soon!!

It's returned again, even though I've checked on on it a few times, shutting down I.E. inbetween.

Strange thing is, even though there is now a 'Links' item in Favorites, I don't have either a 'LinksFolder' or 'LinksFolderName' anywhere in the Registry.

But, after all, it's inclusion isn't THAT important. It's just that we never like our PCs to get the upper hand!!

[david eaton]

Well, Ad-aware is good, but it doesn't detect everything! Maybe it is a feature of windoze, but I would still like to see a Hijack this log.

[mike2002]

david: Just for you I downloaded Highjack This. Here are the results of a scan.

Logfile of HijackThis v1.97.6
Scan saved at 20:36:33, on 16/11/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
C:\PROGRAM FILES\CPAL\CPBRWTCH.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\POPUPREMOVER\POPRCONTROLLER.EXE
C:\PROGRAM FILES\HIGHCRITERIA\TOTALRECORDER\TOTRECSCHED.EXE
C:\PROGRAM FILES\RAMBOOSTER\RAMBOOSTER.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\CPAL\CPAL.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {3D2C1DA4-BCD3-4317-9548-2E08BD222FF0} - C:\PROGRA~1\POPUPR~2\POPUPS~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Cookie Pal] "C:\PROGRAM FILES\CPAL\CPBrWtch.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [PopupRemoverCtrl] C:\Program Files\PopupRemover\PopRController.exe
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [RamBooster] C:\PROGRAM FILES\RAMBOOSTER\RAMBOOSTER.EXE
O4 - Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37913.6434259259
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[david eaton]

Looks like Ad-aware got it all! Well, thanks for the log anyway.:D

[shanmuga]

As a work around, you can hide "Links" from favorites listings by setting the folder attribute to hidden.The directory called Links will be recreated if it does not exist inside Favorites when you re-boot.

Relevant KB article (http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/q179/5/99.asp&NoWebContent=1c)

[mike2002]

shanmuga: At the last count I deleted this item From the Registry, then it re-appeared in IE even though the Registry entry didn't exist.
So I deleted the Links folder in IE and, so far, it hasn't returned.

[Paul Komski]

Registry entries such as this (and others such as those that point to the shell folders and to the OE store folders and address book) recreate the directories/files after they have been deleted. However, deleting/changing the registry keys wont delete any directories that already exist in an equivalent manner; these need to be deleted separately - after rebooting - after having modified/deleted the registry keys, if you wish to remove them.

With respect to such "system folders" - it should be noted that some of them can be moved (by R-dragging the folder to where you want it to reside and choosing move) and the underlying registry entry will be updated. Others (for example the cookies folder) wont update the underlying registry key, which has to be manually updated to reflect the new position of the folder it points to.

Hiding the Links folder is a nice workaround (unless, like me, you always show all hidden files). ;)