More Information Regarding IGetNet Issue:
(فقط نتیجه یک جستجوی ساده)
[code:1]
"IGetNet (IGN) Keywords" browser "extension" locates sites
registered to "keywords' at IGetNet by typing those keywords into the
"location" or "address" bar of IE or NetScape browser.
IGN is installed if either the user has cluelessly agreed to the installation or some site silently installs the same via some browser security flaw (the IGetNet
keywords extension installer is utterly silent once you accept the
signed ActiveX control).
When run, the IE version copies the main EXE to %windir%system (yes,
even on NT-based OSes) and also unpacks BHO.DLL and RSP.DLL to that
directory. It also sets a registry value named WinStart under
HKLMSoftwareMicrosoftWindowsCurrentVersionRun to run
"<path>WinStart.exe -boot", which ensures the DLLs are unpacked (and
replaced) at each system startup. It also adds the following domain
redirects to your system's HOSTS file:
216.177.73.139 auto.search.msn.com
216.177.73.139 search.netscape.com
216.177.73.139 ieautosearch
This "utility" does not add "uninstall" information to the registry,
so cannot be uninstaleld through the usual means. An uninstaller is
available from the download page of IGetNet's web site, should you
trust them to properly uninstall the beast:
http://igetnet.com/iGetNet_IGNDownloads.html
This seems to leave one of the DLLs but removes the other, the HOSTS
entries and WinStart.exe.
> Also, this file exists: C:WINDOWSprefetchWINSTART.EXE-2C11637C.pf.
Not sure about that -- didn't see it myself, but then I only let it
run for a few minutes...
The IGN Keywords product depends on a registration database which I
guess is centrally maintained, so it has to report keyword attempts
to the server to get the correct URL to redirect the browser to.
Aside from that, ignkeywords.com is 216.177.73.139.
> The WinStart file is labelled as a "Browser Upgrade" in the file
> properties thingy.
[/code:1]