What Is the Microsoft URL Search Hook?
By Ron Price
When you enter an Internet URL without its corresponding protocol identifier, such as http://, https:// or ftp://, Internet Explorer attempts to determine the protocol needed by using the contents of the URL address. However, when the browser can't determine the protocol on its own, it uses the URL Search Hook method in an attempt to identify the protocol.
IE and the URL Search Hook
When Internet Explorer cannot identify the protocol for a particular URL address entry, it first assumes the protocol should be the Hypertext Transfer Protocol (HTTP), which is generally the default protocol for most browser-based requests for data. However, should HTTP not be the proper protocol, the browser then interfaces with the URL Search Hook method (IURLSearchHook) that translates the data in a registered registry object to identify the appropriate protocol.
URL Translation
The Microsoft Windows registry contains system configuration settings and setting options for the Windows OS and some applications. The Internet Explorer browser stores (registers) URL Search Hook objects in the registry that it then uses for lookup purposes as needed, such as when it must identify a protocol for a particular URL.
URL Search Hook objects are created under the registry key of:
HKEY_LOCAL_MACHINE/Software/Microsoft/Internet Explorer/UrlSearchHooks
A URL Search Hook object's class Identifier (CLSID) string, the data between the braces ({ }) in the registry entry, uniquely identifies the object. The IURLSearchHook interface translates a URL's address and the data of its corresponding CLSID to identify the associated protocol. Internet Explorer then uses the partial URL and the protocol identifier to access, retrieve and display the requested information.
On a majority of Windows systems, there is only one UrlSearchHook object, which should look something like this:
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
Bad URL Search Hook Objects
Internet Explorer hackers, hijackers and other evildoers can, and often do, add UrlSearchHook objects to the registry on a host system. Typically, a hacker creates a registry object that redirects any URL that is missing a protocol to a site he controls. However, a more common problem is when the Default URLSearchHook is missing, has been deleted or has not been registered.
To identify and fix registry object issues, including URLSearchHook objects, a free downloadable utility, HijackThis, is available. When it runs, this utility analyzes a Windows registry and can even fix certain problems, including a missing or corrupt default URLSearchHook object. However, if you prefer, you can also use RegEdit, a free utility from Microsoft that lets you edit, modify and correct the registry directly.
IE 9 and Later Versions
Internet Explorer 8 and earlier versions use the IURLSearchHook method to identify missing protocol entries. Beginning with Internet Explorer 9 (meaning IE 9, 10, 11, etc.), the IURLSearchHook method is no longer used by these browser versions to identify missing protocol identities.
References
Writer Bio
Ron Price, MBA, has extensive senior level experience in business, information technology, and education. Under his pen name Ron Gilster, Price has written over 40 books for several leading publishers on a topics ranging from business and finance to IT certifications to real estate.