Has My IE Encoding Been Hijacked??

MERRICKMERRICK In the studio or on a stage
edited November 2003 in Science & Tech
Last week Internet Explorer started experiencing something bad.
Win98SE
IE 6 SP 1

When I browse to a page it does not show all graphics and I have hyperlink connection problems. I went to View->Encoding->and I see that IE defaults to Western European (ISO). When I change Encoding to Western European (Windows) all is well but it does not stick, requiring me to manually make the change :mad:

I looked into Tools->Internet Options->Advanced but I could find nothing, so I clicked on reset default. I looked into Tools->Internet Options->Security and found nothing so I clicked on reset defaults, still no change.

Hmmm, ever since my wife and I started browsing realestate sites (realtor.com) we got bombarded with spy cookies which Ad-aware disposed of. I run
ad-aware, spybot S & D, F-Secure and f-prot anti-virus regularly as well as manually make rounds.

But it was right after browsing Foxtons.com that the encoding got all messed up. I decided to compare the two codepage files which load with windows (CP_1252.nls and CP_437.nls) against the same files from a fredsh install. ANd there was a difference!!

Correct File:
CP_1252.NLS
Modified 4/23/99
12,288 bytes used
Hijack?
CP_1252.NLS
Modified 7/30/97
12,288 bytes used

Correct File:
CP_437.NLS
modified 4/23/99
8704 bytes used
Hijack?
CP_437.NLS
modified 4/23/99
12,288 bytes used

So I did a regedit search of Western European (Windows)

[HKEY_CLASSES_ROOT\MIME\Database\Codepage\1252]
"BodyCharset"="iso-8859-1"
"WebCharset"="iso-8859-1"
"FixedWidthFont"="Courier New"
"ProportionalFont"="Arial"
"Description"="Western European (Windows)"
"Level"=hex:07,07,00,00

[HKEY_LOCAL_MACHINE\Software\CLASSES\MIME\Database\Codepage\1252]
"BodyCharset"="iso-8859-1"
"WebCharset"="iso-8859-1"
"FixedWidthFont"="Courier New"
"ProportionalFont"="Arial"
"Description"="Western European (Windows)"
"Level"=hex:07,07,00,00

a regedit search for CP_437.nls found little:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Codepage]
"437"="cp_437.nls"

I restored both of the .nls files and got no changes. I do not know if the registry is correct.

Perhaps I've overshot the problem? A simple parameter change somewhere? Or is my paranoia justified that a "legitimate" site may be performing illegal activities. The internet realestate game is the dirtiest I've seen regarding internet security and that includes the usual gang of suspects.

Please help!

Comments

  • kanezfankanezfan sunny south florida Icrontian
    edited November 2003
    mozilla firebird. use that instead of IE, see if you get jacked again.
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited November 2003
    Have you run a thorough spyware check? Use both Spybot search & destroy 1.2 and AdAware 6.0 with the latest definitions.
  • a2jfreaka2jfreak Houston, TX Member
    edited November 2003
    Kanez backing Mozilla?
    I know Prime uses it.

    Uh oh. The liberals are taking over my favorite browser.
    /me :bawling:
  • MERRICKMERRICK In the studio or on a stage
    edited November 2003
    Kanz: definitly on my to do list (Opera) but I'd like to fix this now.

    Prime: Yes I'm running updated Ad-aware, Spybot and f-secure practicaly daily.

    Uhoh, Looks like there is no immediate fix here. I swear if this is realestate hijacking I'll sue the $%#^&!

    I'm posting elsewhere. I'll report any finds.
  • WuGgaRoOWuGgaRoO Not in the shower Icrontian
    edited November 2003
    kanezfan had this to say
    mozilla firebird. use that instead of IE, see if you get jacked again.


    ive also heard many good things about mozilla..but im just sooo lazy
  • kanezfankanezfan sunny south florida Icrontian
    edited November 2003
    are you sure the file being updated isn't part of some windows update or something? and i know it's not related, but why are you still using win98? also, out of curiosity, are you lookig to buy a house, or are you an investor?
  • kanezfankanezfan sunny south florida Icrontian
    edited November 2003
    not plain old mozilla, mozilla firebird, it's a stand-alone browser and it's awesome.
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited November 2003
    I am a big advocate of Firebird....

    the jesus freak and the buddhist agree!! Earth shatters! Headlines at 11:00! ;)
  • kanezfankanezfan sunny south florida Icrontian
    edited November 2003
    the jew too. now all we need is a muslim and we're on our way to world peace, all thanks to open source!
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited November 2003
    WANTED:

    One Muslim who uses and really likes Mozilla Firebird. Apply within.
  • TemplarTemplar You first.
    edited November 2003
    Opera and MyIE2 are my favorite browsers. Give 'em a shot while you're browser shopping.
  • a2jfreaka2jfreak Houston, TX Member
    edited November 2003
    A Christian, a Jew and a Buddhist walk into a bar . . . ;D

    We also have two liberals and a conservative. I guess we either need another conservative or at least a libertarian. :)
  • LincLinc Owner Detroit Icrontian
    edited November 2003
    Speaking of things being hijacked...

    *cough* ;)
  • maxanonmaxanon Montreal
    edited November 2003
    did you see this?

    http://support.microsoft.com/?kbid=283807
  • gtghmgtghm New
    edited November 2003
    I just DNL'ed and installed/unzipped Mozilla Firebird and am currently using it.
    So far I like it. Gives exactly the same feel of IE and its already blocked several popup adds.
    I think that I'll be useing it more.
    Thanks for the heads up. :)

    "g"
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited November 2003
    I think MyIE2 is very good also. Not necessarily a browser, but an addon to IE. Featuring a VERY good popup blocker, tabbed browsing, mouse gesutres, the classic feel of IE's interface, and its powerful code-rendering engine.

    Not necessarily on the ORIGINAL topic, but hey.
  • Park_7677Park_7677 Missouri Member
    edited November 2003
    http://short-media.com/forum/showthread.php?s=&threadid=4221


    I had the same problem :(
  • CammanCamman NEW! England Icrontian
    edited November 2003
    kanezfan had this to say
    mozilla firebird. use that instead of IE, see if you get jacked again.


    Yeah you won't have to worry about anything getting jacked, cause it won't run at all or will display your pages incorrectly!

    /me has bad experience with Firebird and is a big fan of using a browser that works.
  • BlackHawkBlackHawk Bible music connoisseur There's no place like 127.0.0.1 Icrontian
    edited November 2003
    Thrax had this to say
    I think MyIE2 is very good also. Not necessarily a browser, but an addon to IE. Featuring a VERY good popup blocker, tabbed browsing, mouse gesutres, the classic feel of IE's interface, and its powerful code-rendering engine.

    Not necessarily on the ORIGINAL topic, but hey.
    Been using it for a few months and I guess it's stuck with me. I usually try firebird after a fresh install but it just sucks the loading time and forgetting to create the shortcut. Also I like the tabbed browsing on MyIE2 better. As for Firebird being faster, I really don't care about 2secs. It's good and all but I guess it's just that feel.
  • MERRICKMERRICK In the studio or on a stage
    edited November 2003
    Park_7677:
    Yeah That's exactly Wha'ts going on. I'm going to post what I know there since this thread has gone on a tangent.

    maxanon:
    I just found that arrticle today. I'm going to post what I know here:
    http://short-media.com/forum/showthread.php?s=&threadid=4221

    Thanks one and all!!:wave:
Sign In or Register to comment.