Guest ozegirl Posted February 17, 2009 Posted February 17, 2009 Hi, I don't have a problem - just a question. I'm learning to interpret Hijack this entries and would appreciate comment on the following entry: R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost; From what I understand, proxy override overrides any proxy server that has been set, so in this case the http:// request is instead redirected to local host - which is the computer sending the request.....? Is this right? Does this mean that the request would just loop back to the originating computer - in which case you would get "page not found" ??? or is the implication that it sets the local computer up as a server??? I'm not really sure what it means. I have seen hijack this fixes in forums where some people leave it as not needing to be fixed and others who insist it is fixed. Someone I asked said it was a "bad thing" but I would liek to understand why. Quote
Guest PA Bear [MS MVP] Posted February 17, 2009 Posted February 17, 2009 http://aumha.org/a/hjttutor.php => http://www.bleepingcomputer.com/tutorials/tutorial42.html ozegirl wrote:<span style="color:blue"> > Hi, > > I don't have a problem - just a question. I'm learning to interpret > Hijack > this entries and would appreciate comment on the following entry: > > R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet > Settings,ProxyOverride = http://localhost; > > From what I understand, proxy override overrides any proxy server that has > been set, so in this case the http:// request is instead redirected to > local > host - which is the computer sending the request.....? Is this right? > Does this mean that the request would just loop back to the originating > computer - in which case you would get "page not found" ??? or is the > implication that it sets the local computer up as a server??? I'm not > really > sure what it means. I have seen hijack this fixes in forums where some > people leave it as not needing to be fixed and others who insist it is > fixed. Someone I asked said it was a "bad thing" but I would liek to > understand why. </span> Quote
Guest ozegirl Posted February 17, 2009 Posted February 17, 2009 Re: Question re Hijack this entry - Internet Security, Proxy Overr Thanks, but this doesn't really help. I've looked at all these tutorial sites before and they are very general. I specifically want to know about this entry - I'm assuming it must be bad, but as I said in my original post, what does it actually mean? Does it mean that the local computer is set up as a server? Does it just redirect everything to "page not found"? I did see somewhere that trojans can exploit this entry for proxy override, but how? Does it make any difference if you have this entry on your computer if you are say in a corporate environment and you are behind a proxy server as opposed to a home user who is not using a proxy server but sits behind a router on a LAN as opposed to a home user who uses no proxy server and connects directly to the internet? "PA Bear [MS MVP]" wrote: <span style="color:blue"> > http://aumha.org/a/hjttutor.php => > http://www.bleepingcomputer.com/tutorials/tutorial42.html > > ozegirl wrote:<span style="color:green"> > > Hi, > > > > I don't have a problem - just a question. I'm learning to interpret > > Hijack > > this entries and would appreciate comment on the following entry: > > > > R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet > > Settings,ProxyOverride = http://localhost; > > > > From what I understand, proxy override overrides any proxy server that has > > been set, so in this case the http:// request is instead redirected to > > local > > host - which is the computer sending the request.....? Is this right? > > Does this mean that the request would just loop back to the originating > > computer - in which case you would get "page not found" ??? or is the > > implication that it sets the local computer up as a server??? I'm not > > really > > sure what it means. I have seen hijack this fixes in forums where some > > people leave it as not needing to be fixed and others who insist it is > > fixed. Someone I asked said it was a "bad thing" but I would liek to > > understand why. </span> > > </span> Quote
Guest PA Bear [MS MVP] Posted February 18, 2009 Posted February 18, 2009 Re: Question re Hijack this entry - Internet Security, Proxy Overr You may be interested in http://www.malwareremoval.com/university.php ozegirl wrote:<span style="color:blue"> > Thanks, but this doesn't really help. I've looked at all these tutorial > sites before and they are very general. I specifically want to know about > this entry - I'm assuming it must be bad, but as I said in my original > post, > what does it actually mean? Does it mean that the local computer is set up > as a server? Does it just redirect everything to "page not found"? I did > see > somewhere that trojans can exploit this entry for proxy override, but how? > Does it make any difference if you have this entry on your computer if you > are say in a corporate environment and you are behind a proxy server as > opposed to a home user who is not using a proxy server but sits behind a > router on a LAN as opposed to a home user who uses no proxy server and > connects directly to the internet? > > > "PA Bear [MS MVP]" wrote: ><span style="color:green"> >> http://aumha.org/a/hjttutor.php => >> http://www.bleepingcomputer.com/tutorials/tutorial42.html >> >> ozegirl wrote:<span style="color:darkred"> >>> Hi, >>> >>> I don't have a problem - just a question. I'm learning to interpret >>> Hijack >>> this entries and would appreciate comment on the following entry: >>> >>> R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet >>> Settings,ProxyOverride = http://localhost; >>> >>> From what I understand, proxy override overrides any proxy server that >>> has >>> been set, so in this case the http:// request is instead redirected to >>> local >>> host - which is the computer sending the request.....? Is this right? >>> Does this mean that the request would just loop back to the originating >>> computer - in which case you would get "page not found" ??? or is the >>> implication that it sets the local computer up as a server??? I'm not >>> really >>> sure what it means. I have seen hijack this fixes in forums where some >>> people leave it as not needing to be fixed and others who insist it is >>> fixed. Someone I asked said it was a "bad thing" but I would liek to >>> understand why. </span></span></span> Quote
Guest ozegirl Posted February 18, 2009 Posted February 18, 2009 Re: Question re Hijack this entry - Internet Security, Proxy Overr That's what I'm already doing, but with a different tech site. Which is the whole point of my post - I'm trying to find out more about the things I need to learn about. "PA Bear [MS MVP]" wrote: <span style="color:blue"> > You may be interested in http://www.malwareremoval.com/university.php > > ozegirl wrote:<span style="color:green"> > > Thanks, but this doesn't really help. I've looked at all these tutorial > > sites before and they are very general. I specifically want to know about > > this entry - I'm assuming it must be bad, but as I said in my original > > post, > > what does it actually mean? Does it mean that the local computer is set up > > as a server? Does it just redirect everything to "page not found"? I did > > see > > somewhere that trojans can exploit this entry for proxy override, but how? > > Does it make any difference if you have this entry on your computer if you > > are say in a corporate environment and you are behind a proxy server as > > opposed to a home user who is not using a proxy server but sits behind a > > router on a LAN as opposed to a home user who uses no proxy server and > > connects directly to the internet? > > > > > > "PA Bear [MS MVP]" wrote: > ><span style="color:darkred"> > >> http://aumha.org/a/hjttutor.php => > >> http://www.bleepingcomputer.com/tutorials/tutorial42.html > >> > >> ozegirl wrote: > >>> Hi, > >>> > >>> I don't have a problem - just a question. I'm learning to interpret > >>> Hijack > >>> this entries and would appreciate comment on the following entry: > >>> > >>> R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet > >>> Settings,ProxyOverride = http://localhost; > >>> > >>> From what I understand, proxy override overrides any proxy server that > >>> has > >>> been set, so in this case the http:// request is instead redirected to > >>> local > >>> host - which is the computer sending the request.....? Is this right? > >>> Does this mean that the request would just loop back to the originating > >>> computer - in which case you would get "page not found" ??? or is the > >>> implication that it sets the local computer up as a server??? I'm not > >>> really > >>> sure what it means. I have seen hijack this fixes in forums where some > >>> people leave it as not needing to be fixed and others who insist it is > >>> fixed. Someone I asked said it was a "bad thing" but I would liek to > >>> understand why. </span></span> > > </span> Quote
Guest deenem Posted March 24, 2009 Posted March 24, 2009 ProxyOverride setting This doesn't look malicious. The ProxyOverride settings just determines which sites don't redirect through the proxy server and http://localhost usually doesn't need to go though a proxy. If the ProxyServer setting had been overrriden with http://localhost it would be suspicious since it would mean there was a proxy server server running on the local machine that all traffic was being redirected though. Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.