PDA

View Full Version : Spybot found Alexa settings


Sylvander
05-23-2004, 10:21 AM
I got Spybot to remove Alexa and it made a backup of the registry entry.

I found this on the web http://www.imilly.com/alexa.htm#bug

One of its recommendations was to open the file
"C:\Windows\WEB\Related.htm"
and replace the line
RelatedServiceURL="http://related.msn.com/related.asp?url=";
to
RelatedServiceURL="http://www.google.com/search?q=related:+";
[then restore the registry setting.]

Here's the contents of my "Related.htm" file.
------------------------------------------------------------------------
script

//Build the query
userURL=external.menuArguments.location.href;
RelatedServiceURL="http://www.google.com/ie?as_rq=";

//Perform simple check for Intranet URLs
//this is where the http or https will be, as found by searching for :// but skip res:
protocolIndex=userURL.indexOf("://",4);
serverIndex=userURL.indexOf("/",protocolIndex + 3);
urlresult=userURL.substring(0,serverIndex);

//Check if Intranet URL - then open search bar

if (urlresult.indexOf(".",0) < 1) userURL="Intranet URL";
finalURL = RelatedServiceURL + encodeURIComponent(userURL);
external.menuArguments.open(finalURL, "_search");

/script
------------------------------------------------------------------------
Does anyone have comments or suggestions?

PrntRhd
05-23-2004, 10:36 AM
I alternately run Adaware and Spybot, both find Dataminer/Alexa and remove/fix them, but the explanation in your link helps explain why they repeatedly return. I prefer to send the stuff to 127.0.0.1 as I am certain nothing is there to accumulate data for someone to later find.

Donn
05-23-2004, 11:27 AM
Originally posted by Sylvander
I got Spybot to remove Alexa and it made a backup of the registry entry.

------------------------------------------------------------------------
Does anyone have comments or suggestions?


Sylvander and PrntRhd:

I hate to sound ignorant and stupid, but what in the WORLD has this been all about? I get Alexas every now and then on SpyBot, and I fix and delete them. I used to get them all the time. Should I be doing something else?

PrntRhd: What does it mean to send them to 127.0.0.1 ??

:confused:

PrntRhd
05-23-2004, 11:46 AM
What does it mean to send them to 127.0.0.1 ??

Donn,

You will see posts here in the LAN or WAN sections where instructions are given to ping various addresses. Pinging 127.0.0.1 is an internal test for the network card in your PC to see if it responds to commands.
If you direct the browser-generated information to go to 127.0.0.1, you are sending the information to an internal, non file address so it never gets saved to file or sent off the PC. It effectively "ditches" the information, so Alexa never gets it.

YODA74
05-23-2004, 11:55 AM
Remove Alexa Spyware
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}]

Sylvander
05-23-2004, 11:59 AM
The web page that I linked to explains it all.
Getting Spybot to remove the Alexa registry setting [and make a backup for possible later recovery], is only one possible solution [the one I've chosen so far].

If this had not been removed by Spybot you'd have in Internet Explorer, in the "Tools" menu, a "Related Links" option.
Clicking on this, when in a web page, will take you to an MSN web page which uses the Alexa engine.
A key link in the chain is the set of commands within the "C:\Windows\WEB\Related.htm" file.

You could, instead of removing the first link [the setting in the registry], just ALTER the third link [the commands in the "Related.htm" file] to point to a different web page [Google for example, or the address of your own PC, or to a non existant PC address? = 127.0.0.1].
Then when you click "Related Links", Alexa will not be used.

That's a more refined solution to the problem, but then the file may be overwritten later and the alteration undone.

PrntRhd
05-23-2004, 12:12 PM
from Yoda:Remove Alexa Spyware

Or just stop surfing with IE, use alternate browsers, like Firefox or Opera.

John0904
05-23-2004, 03:58 PM
Originally posted by Sylvander
That's a more refined solution to the problem, but then the file may be overwritten later and the alteration undone.
Would having the file Related.htm "Read Only" help?

Mark Miller
05-23-2004, 05:38 PM
This is going to sound really silly but I am speaking only for myself.
I use Alexa from time to time and the world has not come to an end, my life has not be stolen and as of last check my cars are still in the garage.
I think we are all getting crazy [myself included] about adware and spyware [as in weatherbug also]
Once I got a mortgage and credit cards and car loans my info was out there.
Sometimes these programs can be useful and really not screw anything up IMHO
Mark:)

Sylvander
05-23-2004, 08:21 PM
JOHN
I too wondered about making the file read only, but...
What would happen when Microsoft update went to change the file?
Would the update abort or fail, or just overwrite the file anyway?

MARK
Yes, it's all a matter of preference.
At least if you have some control you are not just dangling on someone elses stings.
Personally I am peace'd off at the amount of manipulation and lies and exploitation, assassinations and tortures, and consider this kind of thing a small part of the great whole of evil.
Now when I go to answer a ring at my front door I'm routinely met by a salesman who begins by:
[this is a technique applied just lately]
1. Waiting to see that someone is approaching.
2. Turning his back on that person [me].
3. Launching into a prepared, scripted, and pracised speach that is a lie from beginning to end. That insults me by treating me like a dumb idiot who can be fooled by the most crudely constructed falsehood.
[Does this sound familiar?]
OK, so perhaps we should all take the money and run and hope that some other poor shmuck will be the one to pay the price for all those evils.
But beware, because when the world is one great ocean of truthlessness, privacy invasion and corruption, you will find that your little pond of comfort and safety is ever shrinking.

Don't you find it insulting that someone would gather personal information about you and yours by steal-eth? [notice how that word stealth is constructed] Today they'll steal information from you. What will they steal tomorrow? Your honour? Your virtue? Your freedom? How much do you have you left to steal?

End of rant :D

Donn
05-23-2004, 08:58 PM
Originally posted by YODA74
Remove Alexa Spyware
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}]


Yeah, see, I need to seriously consider a good book, one that really communicates, because this still doesn't mean anything to me yet. What do I do with this file, change it in some way? delete the CLSID number? Is fixing it in SpyBot functionally enough? Or is that a theoretical question/answer?

What do you read to get to know these Reg files. Like for instance am I right in assuming that each space between the \xxx\ has a functional name?

I'm in this dangerous condition where I have a little bit of knowledge about a lot of things, and I don't have asense of unity or progression yet.

Speak, oh wise ones :)

Sylvander
05-24-2004, 05:52 AM
"delete the CLSID number?"
If you go to "Start->Run", type "regedit" in the "Open" box and click OK, regedit will run.
Then navigate through the system of keys [they are like folders in Windows Explorer].
Go to the address specified by "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
Open the "HKEY_LOCAL_MACHINE" key, then under that, open the "Microsoft" key etc, until you get to the "{c95fe080-8f5d-11d2-a20b-00aa003c157a}" key [if it hasn't been deleted and backed up by Spybot under your control].
If this key has been removed, then there will be no "IE->Tools->Related Links" option and therefore no use of Alexa.
If it is still in place and you decide that removing this particular link in the chain is the best solution, then removing/deleting it with Spybot is the best way, because Spybot makes a backup and you can use it to reverse the change.
You can then leave the "Related.htm" file untouched, because it won't be used.

"Is fixing it in SpyBot functionally enough?"
Yes.

"Or is that a theoretical question/answer?"
No, it doesn't just work in theory, it works in practice.

"What do you read to get to know these Reg files."
I got a book at my local library titled something like "Inside the Windows 95 Registry". It included the "Registry Monitor" program on a floppy, and explained as best it could some of the more important aspects of the registry. It's a HUGE topic all on its own. Like trying to understand the structure of the typical urban environment, with its roads and houses and shops and businesses and pipework and wiring that has a general form, but is different in every case and yet similar.
So where is the hospital placed, and what does it do?
A bit like that.

"I'm in this dangerous condition where I have a little bit of knowledge about a lot of things, and I don't have asense of unity or progression yet.
Join the club! :D
Even Isaac Newton felt like he was "playing with pebbles on the shore before a vast ocean of knowledge".

John0904
05-24-2004, 09:45 AM
Originally posted by Sylvander
JOHN
Would the update abort or fail, or just overwrite the file anyway?
I think it would just skip this file and continue to finish the install.
It it were a major key component file, like winlogon.exe then the install might fail.

If you have doubts about making it Read Only, you can copy the file in the same directory as "Copy of related.htm".

Also want to add that I did a directory and subdirectory listing for ..\Windows and found that not a lot files are Read Only. 178 files to be exact.
Maybe a person who is going to do a fresh install would make the ..\Windows and subdirectory files Read Only and do a update to see what would happen.

Donn
05-24-2004, 08:44 PM
Originally posted by Sylvander
"I'm in this dangerous condition where I have a little bit of knowledge about a lot of things, and I don't have asense of unity or progression yet.[/color]
Join the club! :D
Even Isaac Newton felt like he was "playing with pebbles on the shore before a vast ocean of knowledge".

Sylvander, thanks, just what I need...direct answers to direct questions. I'm one of those people that learns best by asking as I go. But a book that comunicates well is always a plus. If I had my way I would find someone who knows what I want to know, and then just ask questions until I knew all I wanted to know. Not likely in this world.

:) :cool:

Sylvander
05-25-2004, 05:07 AM
That's a pretty good way to learn I'd say, and one of the good things about a forum such as this.
Amongst all the people on the forum there's a good chance that at least one of them will know the thing you need or would like to know.
Everyone puts some information into the common store and then everyone has it.
Those who know more pass information to those who know less, and everyone, no matter how much they know, has someone above and someone below. So we are all giving AND receiving.