流氓漫游浏览器历史的神秘案例-删除OneView Internet登录

I like a good mystery and I hope you do, too. I'll give you two versions. First, the TL;DR version so you can just fix it, and later second, the maddening technical details.

我喜欢一个很好的谜，也希望你也喜欢。 我给你两个版本。 首先，它是TL; DR版本，因此您只需对其进行修复即可，其次，它提供了令人头疼的技术细节。

TL; DR-为什么我的Internet Explorer说“ OneView Internet登录”？ (TL;DR - Why does my Internet Explorer say OneView Internet Login?)

If you go googling for "OneView Internet Login" google will suggest things like "...remove." You'll find Yahoo Answers where folks are thinking they have a toolbar installed or a virus because when they launch Internet Explorer they see a flash of OneView Internet Login in the title bar.

如果您谷歌搜索“ OneView Internet登录”，则Google会建议“ ...删除”之类的内容。 在人们认为他们安装了工具栏或病毒的地方，您会找到Yahoo Answers，因为当他们启动Internet Explorer时，他们会在标题栏中看到OneView Internet Login的闪烁。

To remove it, go to the Star in Internet Explorer's toolbar and click History, then By Site. Find "One View Internet Login," right click and delete that history record.

要删除它，请转到Internet Explorer工具栏中的星标，然后单击历史记录，然后单击按站点。 找到“ One View Internet登录”，右键单击并删除该历史记录。

Note here in this screenshot that the site is http://google.com but the Title is OneView Internet Login. Delete that.

请注意，在此屏幕快照中，该站点为http://google.com，但标题为OneView Internet登录。 删除它。

NOTE: If your home page is not google, then find your IE home page by Site, and delete the entry with the wrong title. Or, go nuclear and clear all history.

注意：如果您的主页不是google，请按站点查找IE主页，然后删除标题错误的条目。 或者，去核并清除所有历史。

CSI：我的计算机-为什么在所有计算机上都显示OneView Internet登录？ 这是什么，为什么它不消失？ (CSI: My Computer - Why does OneView Internet Login show up on all my computers? What is it and why won't it go away?)

A year ago or so I stayed at a Hyatt Hotel. Hotels like the Hyatt often use "Captive Portals" when getting you on their internet. A captive portal "captures" your browser's traffic so no matter what site you asked for you'll get their login screen. So you get on their wi-fi, you type googlebing and they redirect you to GlobalSuite.net or whatever to sign up. Only then does your traffic go through.

一年前左右，我住在凯悦酒店。 像凯悦酒店这样的酒店，通常在您上网时会使用“专属门户”。 强制门户网站“捕获”了浏览器的流量，因此无论您要访问哪个站点，都将获得其登录屏幕。 因此，您可以使用他们的wi-fi，键入googlebing，然后他们会将您重定向到GlobalSuite.net或进行注册的任何内容。 只有这样，您的流量才会通过。

If you visit a hotel like this and hit it with IE for the first time with a fresh cache (nothing in your history or you've recently cleared your history) the Title that gets saved in the browser database will be the URL of the site you asked for but the title of the Hotel's Captive Portal. Weird? Just wait.

如果您访问这样的酒店，并第一次使用IE刷新了缓存(您的历史记录中没有任何内容，或者您​​最近清除了历史记录)，则保存在浏览器数据库中的标题就是该网站的网址您只要求提供酒店的Captive Portal的标题。 奇怪的？ 等一下

I noticed that my laptop would flash OneView Internet in the title (see the animated gif above) when opening my home page for the first time. Every once in a while I'd go looking for it, search the registry, do a hard-drive-wide grep or findstr but then I'd give up.

我注意到，第一次打开我的主页时，我的笔记本电脑将在标题中闪烁OneView Internet(请参见上面的gif动画)。 偶尔我会去寻找它，搜索注册表，执行硬盘驱动器范围内的grep或findstr，但随后我会放弃。

Later, though, my desktop at home started showing OneView Internet Login in the title bar on startup. To be clear, that's my desktop computer that hasn't left my house.

但是，稍后，我在家里的桌面在启动时开始在标题栏中显示OneView Internet登录。 要明确的是，这是我的台式计算机尚未离开我的房子。

Roaming, my friends. All browsers roam things now. They roam passwords, history, bunches of stuff. This record, this cache, this tab, this something was getting roamed to all 5 of my machines. Now every time I open a browser on any machine I own I get a little gentle reminder of how hotel wi-fi sucks and how the GlobalSuite OneView Internet Login Captive Portal is sending a 301 or lousy headers or something dumb. Next time I stay there I'll do a Fiddler trace and prove it. Until then I wanted to find out where this was being stored on my hard drive.

漫游，我的朋友们。 所有浏览器现在都在漫游。 他们漫游密码，历史记录，一堆东西。 该记录，该缓存，该选项卡，这些东西已经漫游到我的所有5台计算机上。 现在，每次我在自己拥有的任何一台计算机上打开浏览器时，我都会稍微想起酒店wi-fi的状况以及GlobalSuite OneView Internet Login Captive Portal是如何发送301或糟糕的标头或类似内容的。 下次我呆在那里时，我将进行Fiddler跟踪并进行证明。 在此之前，我一直想找出硬盘上的存储位置。

Where is IE History stored? It's stored in a database using a technique called Extensible Storage Engine or ESE. In fact, Windows has shipped this database tech for over 13 years. You can even use it in your apps as a free and fast local database, but no one knows it exists. Over at NirSoft there are a host of wonderful utilities (they are saints, truly, give them money) and one of them is the ESEDatabaseView.

IE历史记录存储在哪里？ 它使用称为“可扩展存储引擎”或ESE的技术存储在数据库中。 实际上，Windows已经将这种数据库技术交付了13年以上。 您甚至可以将其作为免费快速的本地数据库在应用程序中使用，但没人知道它的存在。 在NirSoft上，有许多很棒的实用程序(它们是圣徒，确实是给他们钱)，其中之一是ESEDatabaseView 。

Run ESEDatabaseView and go File | Open IE10 Locked Database (even though you may be using IE11) and you'll be into the depths.

运行ESEDatabaseView并转到文件| 打开IE10锁定数据库(即使您可能正在使用IE11)，您也会陷入困境。

In a tabled called Container one I found a bunch of history entries:

在一个称为“容器一个”的表中，我发现了一堆历史记录条目：

There's my first tab, my home page, but I didn't find "OneView Internet Login" or even the word OneView. I searched the while database, every table.

这是我的第一个选项卡，即主页，但没有找到“ OneView Internet登录”，甚至没有找到单词OneView。 我搜索了while数据库和每个表。

I was stuck here for a while.

我在这里停留了一段时间。

Then I noticed way off to the right (like I literally had to scroll off to the right) there was  column called ResponseHeaders with a bunch of HEX.

然后，我注意到在右边的路(就像我实际上必须在右边滚动一样)有一个名为ResponseHeaders的列，里面带有一堆十六进制。

20 01 00 00 1C 01 00 00 31 53 50 53 A1 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 11 00 00 00 17 00 00 00 00 13 00 00 00 00 00 00 00 41 00 00 00 10 00 00 00 00 1F 00 00 00 17 00 00 00 4F 00 6E 00 65 00 56 00 69 00 65 00 77 00 20 00 49 00 6E 00 74 00 65 00 72 00 6E 00 65 00 74 00 20 00 4C 00 6F 00 67 00 69 00 6E 00 00 00 00 00 15 00 00 00 18 00 00 00 00 40 00 00 00 40 E8 3E C4 96 8E D0 01 11 00 00 00 0D 00 00 00 00 13 00 00 00 00 00 00 00 11 00 00 00 09 00 00 00 00 13 00 00 00 00 00 00 00 11 00 00 00 22 00 00 00 00 13 00 00 00 00 00 00 00 11 00 00 00 06 00 00 00 00 13 00 00 00 0A 00 00 00 55 00 00 00 15 00 00 00 00 1F 00 00 00 22 00 00 00 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 77 00 77 00 77 00 2E 00 67 00 6F 00 6F 00 67 00 6C 00 65 00 2E 00 63 00 6F 00 6D 00 2F 00 66 00 61 00 76 00 69 00 63 00 6F 00 6E 00 2E 00 69 00 63 00 6F 00 00 00 00 00 00 00 00 00 00 00 DC 00 00 00 D8 00 00 00 31 53 50 53 A1 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 11 00 00 00 20 00 00 00 00 03 00 00 00 00 00 00 00 11 00 00 00 14 00 00 00 00 03 00 00 00 01 00 00 00 15 00 00 00 28 00 00 00 00 40 00 00 00 70 0D 51 33 D8 6C D0 01 11 00 00 00 21 00 00 00 00 13 00 00 00 00 00 00 00 3D 00 00 00 1D 00 00 00 00 42 00 00 00 1E 00 00 00 70 00 72 00 6F 00 70 00 34 00 32 00 39 00 34 00 39 00 36 00 37 00 32 00 39 00 35 00 00 00 00 00 08 00 00 00 EB 03 00 00 00 00 00 00 15 00 00 00 1E 00 00 00 00 40 00 00 00 3C DC B8 DF 12 6D D0 01 11 00 00 00 1C 00 00 00 00 03 00 00 00 00 00 00 00 11 00 00 00 27 00 00 00 00 13 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00           

20 01 00 00 1C 01 00 00 31 53 50 53 A1 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 11 00 00 00 17 00 00 00 00 13 00 00 00 00 00 00 00 41 00 00 00 10 00 00 00 00 1F 00 00 00 17 00 00 00 4F 00 6E 00 65 00 56 00 69 00 65 00 77 00 20 00 49 00 6E 00 74 00 65 00 72 00 6E 00 65 00 74 00 20 00 4C 00 6F 00 67 00 69 00 6E 00 00 00 00 00 15 00 00 00 18 00 00 00 00 40 00 00 00 40 E8 3E C4 96 8E D0 01 11 00 00 00 0D 00 00 00 00 13 00 00 00 00 00 00 00 11 00 00 00 09 00 00 00 00 13 00 00 00 00 00 00 00 11 00 00 00 22 00 00 00 00 13 00 00 00 00 00 00 11 11 00 00 00 06 00 00 00 00 13 00 00 00 0A 00 00 00 55 00 00 00 15 00 00 00 00 1F 00 00 00 22 00 00 00 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 77 00 77 00 77 00 2E 00 67 00 6F 00 6F 00 67 00 6C 00 65 00 2E 00 63 00 6F 00 6D 00 2F 00 66 00 61 00 76 00 69 00 63 00 6F 00 6E 00 2E 00 69 00 63 00 6F 00 00 00 00 00 00 00 00 00 00 00 DC 00 00 00 D8 00 00 00 31 53 50 53 A1 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 11 00 00 00 20 00 00 00 00 03 00 00 00 00 00 00 00 11 00 00 00 14 00 00 00 00 03 00 00 00 01 00 00 00 15 00 00 00 28 00 00 00 00 40 00 00 00 70 0D 51 33 D8 6C D0 01 11 00 00 00 21 00 00 00 00 13 00 00 00 00 00 00 00 3D 00 00 00 1D 00 00 00 00 42 00 00 00 1E 00 00 00 70 00 72 00 6F 00 70 00 34 00 32 00 39 00 34 00 39 00 36 00 37 00 32 00 39 00 35 00 00 00 00 00 00 08 00 00 00 EB 03 00 00 00 00 00 00 15 00 00 00 1E 00 00 00 00 40 00 00 00 3C DC B8 DF 12 6D D0 01 11 00 00 00 1C 00 00 00 00 03 00 00 00 00 00 00 00 11 00 00 00 27 00 00 00 00 13 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00

First thing I noticed (I assume you do also) is all the zeros. They are mostly not used as if this is UTF16. But I really look for HEX that I know. That means CR, LF, and Space, so 0D, 0A, and 20.

我注意到的第一件事(我想你也是)是全零。 大多数情况下不使用它们，就像这是UTF16一样。 但是我确实在寻找我知道的十六进制。 这意味着CR，LF和空格，即0D，0A和20。

See that there?

看到那里吗？

4F 00 6E 00 65 00 56 00 69 00 65 00 77 00 20 00 49 00 6E 00 74 00 65 00 72 00 6E 00 65 00 74 00 20 00 4C 00 6F 00 67 00 69 00 6E 00 00 00 00 00 15 00 00 00 18

4F 00 6E 00 65 00 56 00 69 00 65 00 77 00 20 00 49 00 6E 00 74 00 65 00 72 00 6E 00 65 00 74 00 20 00 4C 00 6F 00 67 00 69 00 6E 00 00 00 00 00 15 00 00 00 18

That's One View Internet Login. I converted from Hex to ASCII/UTF16. There's lots of online Hex to String Convertors where you can just paste this into a text box. I can also put the string above into a PowerShell string and convert it like this:

这就是单视图Internet登录。 我从十六进制转换为ASCII / UTF16。 有很多在线十六进制到字符串转换器，您可以将其粘贴到文本框中。 我还可以将上面的字符串放入PowerShell字符串中，并将其转换为：

$HEXDATA.Split(“ “) | FOREACH {WRITE-HOST –object ( [CHAR][BYTE]([CONVERT]::toint16($_,16))) –nonewline }

There it is, OneView Internet Login. The title of the portal was cached along with the original URL (google.com) and the location to the favicon. When IE hits the page it shows what it has and then corrects it as soon as it gets the current title.

那里就是OneView Internet登录。 门户的标题以及原始URL(google.com)和图标的位置均被缓存。 当IE点击该页面时，它会显示该页面的内容，并在获得当前标题后立即对其进行更正。

What's not clear to me is why this never expired. This title sat around for a year, at least. Maybe an IE engineer will read this and answer in the comments. If they do I will update the post with their answer.

对我来说不清楚的是为什么它从未过期。 这个头衔至少存在了一年。 也许IE工程师会阅读并回答评论。 如果他们愿意，我会用他们的答案来更新帖子。

The Good News is that if you delete the history record manually as seen at the very top of this post, that delete will roam and automatically fix this issue on all your machines (to be clear, all those that are logged in with the same Microsoft Account and roaming your browser data.

好消息是，如果您手动删除历史记录(如本文开头所示)，则该删除将漫游并自动修复所有计算机上的此问题(请注意，所有使用同一Microsoft登录的计算机帐户和漫游浏览器数据。

Remember, Dear Reader, the Internet (and your computer and its operating system) is not a black box. Look inside.

请记住，亲爱的读者，互联网(以及您的计算机及其操作系统)不是一个黑匣子。 看看里面。

翻译自: https://www.hanselman.com/blog/the-mysterious-case-of-the-rogue-roaming-browser-history-removing-oneview-internet-login