Remove Netscape N3 entries from HijackThis

[DTracy]

Good morning all -

I have a couple of HijackThis entries that I am trying to get rid of:

N3 - Netscape 7: user_pref("browser.startup.homepage", "

http://home.netscape.com/");

(C:\Documents and Settings\phil\Application Data\Mozilla\Profiles\default\15bkw6n9.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "

http://www.google.com/");

(C:\Documents and Settings\phil\Application Data\Mozilla\Profiles\default\15bkw6n9.slt\prefs.js)

When I delete them they just return. How may I remove them completely?

Thanks and regards,
David

 

[2ffat]

What happens when you go into Mozilla and change your preferences there?


James P. Cottingham
^{I'm number 1,229!
I'm number 1,229!}

 

[BadBigBen]

DTracy - what version of HJT are you using, and follow up on 2ffat's suggestion...

PS: if there is Netscape installed on that machine, then deinstall it and install either FireFox or Flock as replacements...

End of development and support

AOL officially announced that it is no longer supporting Netscape Navigator as of 1 March, 2008, and recommended that its users download either the Flock or Firefox browsers, both of which were based on the same technology.

Source: Wikipedia


Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[DTracy]

Hi Guys,

My HijackThis is v1.99.1. The Netscape is 7.0.

On all the workstations in our domain I'm changing the Netscape email to Outlook email, but the County Engineer still uses the Netscape browser. Also, he is the only one that has HJT N3 entries that I can't remove. Short of completely removing Netscape (which I will eventually do), I just want to remove these references from startup.

He has a lot of little problems with this workstation (self inflicted) making it perform badly. I'm trying to fix them as I see them and help performance on all workstations.

Thanks for the help, it's greatly appreciated.

David.

 

[2ffat]

Just for kicks, download and run Autoruns from Sysinternals and see if you can see any Netscape programs starting.

I suspect that some configuration for Netscape is putting those back in.


James P. Cottingham
^{I'm number 1,229!
I'm number 1,229!}

 

[BadBigBen]

DTracy - update HiJackThis, from the Trend Micro website, there where a few fixes in between time, version should be 2.0.2 ...

Those N3 entries are not bad, and yes Netscape recreates them as soon as it is run... so removing them is just an unending loop, until you deinstall it/replace it...

HiJackThis Code:

        * R1 - Internet Explorer Start page/search page/search bar/search assistant URL
        * R2 - This is not used
        * R3 - Default URL Searchhook
        * F0 - Autoloading programs from system.ini file
        * F1 - Autoloading programs from win.ini file
        * F2 } F2/F3 are essentially F0/F1 items, mapped to the Registry.
        * F3 } Only present in NT based systems.
        [b]* N1 - Netscape 4x default homepage and search page URLs
        * N2 - Netscape 6x default homepage and search page URLs
        * N3 - Netscape 7x default homepage and search page URLs
        * N4 - Mozilla default homepage and search page URLs[/b]
        * O1 - Hosts file redirection
        * O2 - Browser Helper Objects
        * O3 - Internet Explorer toolbars
        * O4 - Autoloading programs from Registry
        * O5 - IE Options icon not visible in Control Panel
        * O6 - IE Options access restricted by Administrator
        * O7 - Regedit access restricted by Administrator
        * O8 - Extra items in IE right-click menu
        * O9 - Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu
        * O10 - Winsock hijacker
        * O11 - Extra group in IE 'Advanced Options' window
        * O12 - IE plugins
        * O13 - IE DefaultPrefix hijack
        * O14 - 'Reset Web Settings' hijack
        * O15 - Unwanted site in Trusted Zone
        * O16 - ActiveX Objects (aka Downloaded Program Files)
        * O17 - Lop.com domain hijackers
        * O18 - Extra protocols and protocol hijackers
        * O19 - User style sheet hijack
        * O20 - AppInit_DLLs Registry value autorun
        * O21 - ShellServiceObjectDelayLoad Registry key autorun
        * O22 - SharedTaskScheduler Registry key autorun
        * O23 - Windows NT Services
        * R0 - Internet Explorer Start page/search page/search bar/search assistant URL

source: Understanding and Interpreting HijackThis Entries

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[DTracy]

Thanks Ben, that's kind of what I was thinking. I'm going to take his Netscape away in a few more days.

Thanks again all for your help, it's greatly appreciated.

Best Regards,
David.