18 replies to this topic

[Anthony A]

Recently had to remove Norton Internet Security from my system see here http://forum.ccleane...?showtopic=6672

Since than I have noticed something very strange about IE. I would probably have not noticed if not for CCleaner. Here is what is happening. I run CCleaner and use the analyze feature to see what will get removed. I always look it over to see whats there. Then run it and clean it out. Yesterday I did this and cleaned out everything except the advanced section. Than I did my browsing for about half an hour using Fire Fox. Only used IE for my banking site. I ran analyze with CCleaner and there were a large amount of entries from the IE cache. There were a few cookies and of course the cookies I have set in CCleaner not to be removed but there were all kinds of temp internet files for IE. Remember I only used it at my bank site since the last time I ran CCleaner. So I go into the actual cache of IE by tools/internet options/temporary internet files/settings/view files. This will show you all the stuff in IE's files that gets deleted when you clean up the temporary internet files. When I opened this and looked it had many entries of sites I had not been to. Not only that but there were many (20+) favicons in there and they were all from my book marks. Very strange. So I emptied the cache and just visited a few pages and looked in there again. Again there were entries that I have no idea were they came from and many favicons from some more of my book marks. I haven't been to these sites in a long while and certainly not since I emptied the cache only minutes before.

My first thought is that maybe malware is causing this and was also responsible for my Norton getting ruined. So I did this,

Looked in Task Manager for any unusual processes running and there were none. I am familair with all my running processes in Task Manager. Updated and ran

Spybot S&D, clean
Ewido 4, clean
Ad-Aware, clean
Superantispyware, clean
AVG Antivirus 7, clean
Computer Associates online scanner, clean
CWshredder, clean

Not even a tracking cookie. Everything else works fine. Nothing else happening to make me think it's malware. Even now after visiting only a few sites the IE cache has many entries and favicons from booked marked sites I am not visiting.

Has anyone seen this before?

[Eldmannen]

Sounds very strange...

Use HijackThis and post a log.

[rridgely]

can you take a screenshot of what your talking about.(just so we can see some of the entries from sites you haven't been too) Also like eldmannen said a HJT log wouldn't be a bad idea.

[Anthony A]

I don't have HJT and don't know how to use it. I will have to read up on it.

Let me explain a little clearer on the problem. If I clear the IE temp internet files and the cache is now empty than go to a few sites I expect to see some entries in the cache when I go in and look through internet otpions in IE. What I'm seeing is many more entries than you would expect and entries that have nothing to do with the site I visited. Whats more strange is all the favicons from my booked marked sites that appear in there. I did not visit those sites yet the favicons are in there. Clear the cache again and go in and check to confirm it is empty and it is. Visit a few pages and go in and see whats in the cache and sure enough there a whole bunch of favicons there from my booked marked sites and they are not always the same ones. Very weird. I would probably not have noticed if not for CCleaner and the analyze feature.

How do I post a screen shot or you?

[Eldmannen]

You can get HJT from here:
http://www.spywarein...jn/programs.php

[rridgely]

For hijack this look here(just follow the lest steps about post a log)
http://forum.ccleane...?showtopic=6329

For the screenshot press the alt and prt scr keys together with ccleaner open after you run the cleaner and see the list of things cleaned.(browse for a minute then show the entries your talking about in the pic.) after you press the keys together for you picture open up paing and press ctrl+V and then save it as a .jpg and upload it here:
http://imageshack.us/

Copy and post the link that says for forums 1.

[Andavari]

It's sort of weird but not entirely.
If you're using a Media Player while online or starting them while online, i.e.; Apple iTunes, Windows Media Player, and any other with a built-in browser window to view songs or content online that can add stuff into IE's Temp Internet Files. Also the strange way some sites are coded you'll get cookied even if using a third-party browser like Opera or Firefox.

[rridgely]

You can also get them from ads sometimes(which is what I was thinking) but I'm not sure about the favicon thing. IE as far as I know doesn't go seek those out,you have to go to the site to get it back.

[Anthony A]

OK lets see if I did this image thing right. What I did was empty the IE cache of all temporary Internet files via Tools/Internet options/delete files. I then went in and looked to make sure they were gone. The cache was empty except for some cookies because I did not delete cookies just temporary Internet files. I than visited MY Yahoo, MSN Money and Market Watch and a few other sites. I only went to the home pages I did not do any browsing around. My cache is filled with entries and take a look at the favicon stuff. Those are favicons from my booked marked sites and I did not visit them. I just went to the sites I mentioned. Those favicons were not there when I checked after emptying the cache. Edit, the majority of those favicons are my booked marked sites a few are not. That one about internet and your brain is weird and not one of my book marks. Look how many things are in there only after a few pages.

[rridgely]

The favicon thing is strange. Does Maxthon or Avant have a feature to keep them updated or something? That would be my only guess.

[JDPower]

Anthony A, on Sep 16 2006, 04:03 AM, said:

That one about internet and your brain is weird and not one of my book marks.

The CCleaner beginners guide is at that internetrotsyourbrain site, maybe you've got that bookmarked.

[Humpty]

Do you have a program similar to Favorg which could stop those ico files from being deleted.

Quote:

So, why do we need a utility to manage these favicons? Because Internet Explorer doesn’t do its job very well. The downloaded icon file is stored as a temporary file. Which means that after a while, the favicon will disappear and your shortcut will be associated again with the standard Internet Explorer icon. This often happens after cleaning up your Temporary Internet Files folder. FavOrg will fix this problem and ensure that your favicons are made sticky. That is, once downloaded, the icon will be assigned to the shortcut permanently. FavOrg stores the favicons in a user-defined folder.

Link to Favorg App

[Anthony A]

I do not have any special program for saving favicons. Maxthon does not do anything different with them than IE. Maxthon is an big IE addon really. It runs of IE's engine. Add a book mark to IE and it shows up in Maxthon. Clear the cache in Maxthon and you go into IE's internet options to do it. So I don't think Maxthon has anything to do with it.

I really don't know how long this has been happening. I just recently installed and started using CCleaner and prior to that I just cleared IE's cache and never really paid attention to what was actually in there. Running analyze with CCleaner I can see how much is going to be removed when it cleans so when I see a bunch of entries for IE and I only hit a few sites it made me go into IE and look and you can see by the screen shot what I seen. Pretty weird. Everything else on my computer is running very well since I removed Norton but that's when I really notice the favicon thing starting so I am wondering what the relation is there. One more thing about those favicons is that they are my book marked sites but if you go into my book marks they do not have favicons because I clear the cache several times a day and that dumps all the favicons in IE (works different in Fire Fox)

If this is some how malware related than it's the strangest bug I have heard of. Makes favicons from my book marked sites appear in IE's cache when I haven't been to those sites. I will have to install HJT and learn how to run it and post a log over the next little while and post the log here and a few other places and see whats what. I run a good amount of scans and they are spotless.

JDPower, on Sep 16 2006, 12:36 AM, said:

The CCleaner beginners guide is at that internetrotsyourbrain site, maybe you've got that bookmarked.

I do. Didn't notice that address for it though. That explains why it's in there than. All those favicons are book marked sites.

[hazelnut]

Just a thought, is there any milage in a reboot after clearing out the cache?

[Anthony A]

hazelnut, on Sep 16 2006, 05:52 AM, said:

Just a thought, is there any milage in a reboot after clearing out the cache?

You mean clear the cache and immediately reboot the computer? I sorta do that. I shut down the laptop at night before I go to sleep. I have been running CCleaner to clean out everything and than shutting down the computer. Next day the favicon problem is back.

I received your message and will look over those links. Thank You.

[Andavari]

If you have a third-party firewall installed ZoneAlarm, Sygate, etc., you could run a not so quick test and set it to ASK for all programs which use the Internet to see which one is causing this. Who knows it may reveal something, then again it may not.

[Anthony A]

Think I might have found out what might be happening with the favicons. Just prior to this happening my Google Tool Bar auto updated to version 4 which includes a book mark button. I already had all my book marks backed up online with Google Book Marks. So now with the new book mark feature in the tool bar I simply click the button and my book marks drop down in a menu like they do with the favorites button for IE. All my Google book marks have favicons when viewed with the button on the tool bar within my browser. I think this is connected in some way to whats going on. My IE book marks do not have favicons showing. I can't think of what else this can be.

[Andavari]

Well if you've scanned for malware and have a clean status it could just be another one of those Windows Annoyances.

[Anthony A]

Andavari, on Sep 18 2006, 07:41 AM, said:

Well if you've scanned for malware and have a clean status it could just be another one of those Windows Annoyances.

I was spretty sure that it was/is not melware but I was concerned that my problems with Norton lately might have messed something up.