What's this? (strange address in browser)

  • Thread starter Thread starter Laurel
  • Start date Start date
Laurel said:
I typed in www.d-a-l.com/help, and it says the page may have been removed,
but the address in the browser is what you see below. What's all the ?%20
stuff? Is that normal?

http:///? www.d-a-l.com/help

Check the below Registry entries vs. yours:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
Default="http://"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/
 
Laurel said:
I typed in www.d-a-l.com/help, and it says the page may have been removed,
but the address in the browser is what you see below. What's all the ?%20
stuff? Is that normal?

http:///? www.d-a-l.com/help

No it is not normal. It may indicate that you have a search bar hijacker
(or had one which hasn't been completely removed).

Here is some background information to help you understand what
could be happening.

When you enter something from the Address bar without
a protocol prefix it may be recognized as a partial URL
(probably using those Prefix values that Frank pointed you to)
and a DNS lookup is attempted. If that fails the request is passed
first to your AutoSearch provider. I suspect that this is a symptom
of that happening.

The normal way of explicitly invoking the AutoSearch provider
from the Address bar is to prefix search arguments by ?, go, or find,
followed by a space. That's what you are seeing: a question mark
followed by a space followed by a search argument.
Perhaps the implementation of passing an implicit request to the
AutoSearch provider is to simulate the user having done one?
Then normally the search request however made would be
converted into a real HTTP request for the AutoSearch provider.

In the event that your AutoSearch provider is also inaccessible
(e.g. DNS is down) you would next see your partial URL prefixed
by www. and suffixed first (for US users) by .com. This is the
first step of an anachronism called AutoScan which is actually
what people invoke directly when they press Ctrl-Enter after typing
just a site's domain name. The rest of AutoScan cycles through
the remaining patterns listed under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\UrlTemplate

Perhaps you noticed those patterns in your Status bar
as they were being tested?

The final step after the final AutoScan lookup fails is to go back
to the AutoSearch provider again and display that URL in the
Address bar to the user. It suprises me that we don't see more
questions about that URL and instead see so many for the one
which (I am speculating) is an implicit request. Perhaps all it
means is that there is an indication that AutoSearch is allowed
but when it comes time to generate the URL the value which
supplies its pattern is missing or void.

By design you should be able to recover from the above
scenario by using the Reset Web Settings... button
(in Options, Programs tab). However, some claim that
hijackers just use this as an opportunity to reinstall their
own search. YMMV.


HTH

Robert Aldwinckle
---
 
Thanks very much! I've been out of the country and am now looking for old
postings, so I hope this thank you makes it to you!
 
Back
Top