Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Autocomplete Dropdown (in Windows, Not Ie) Disabled


  • Please log in to reply
39 replies to this topic

#1 don_s

don_s

  • Members
  • 163 posts
  • OFFLINE
  •  
  • Local time:06:56 PM

Posted 02 July 2008 - 09:17 PM

Hi there everyone...

I'm having a problem with Windows XP and I'm wondering if anyone can help.

A few weeks ago I was infected with a nasty trojan. Two great guys in the HiJackThis forum helped me remove it, but in the end I was left with a couple of side-effects.

The one I'm most annoyed by is my loss of Autocomplete Dropdown boxes when trying to open and/or save files in any of my programs (Photoshop, AutoCad, Word, whatever...).

I think you guys know what the dropdown boxes are, but I'll explain:

first of all, I'm NOT talking about the autocomplete function in Internet Explorer. I've had that turned off for months, and having it turned off has never affected these other autocomplete functions. The dropdown boxes I'm talking about are the ones that appear when you try to open or save a file in a program you're running.

So, for example, you try to save a file in a program that you're running, but you already have a number of similarly named files on your hard-drive. When I used to save my files (before the infection), if I started to type a name into the "save as" box, the program would produce a dropdown box of autocomplete suggestions for me -- so if I had three files "SAVE1", "SAVED2", "SAVING3"... and started to save a file by typing "SA" all three names would appear in the dropdown box... If I continued to type "SAVE", the third file would disappear from the drop down box, and if I typed "SAVED" only the file "SAVED2" would appear...

For some strange reason, the dropdown box no longer appears (which is really annoying when you're trying to group file names but you have a large number of similarly saved files on your hard-drive).

While the guys in the HiJackThis forum were helping me out, I tried to google the problem and found a few sites that suggested that the registry entry for "explorer > autocomplete" might be affected... here's one description:

Control the Auto Complete Mode

This setting controls whether the automatic text completion (AutoComplete) feature of Windows explorer appends the suggested text to the words as you are typing as well as showing a drop-down list of available values.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\AutoComplete. Value Name: Append Completion, Data Type: REG_SZ (String Value), Value Data: yes or no.

Create a new string value, or modify the existing value, named "Append Completion" and set it to "yes" to append the suggested text as you are typing or "no" to only show a drop-down list.


So I looked at the above setting (I didn't change anything) and noticed it was set as they described... Which suggests that the dropdown function should be working. I then looked at HKEY_LOCAL_MACHINE (thinking that maybe it was over-riding CURRENT_USER) and found that there was no autocomplete key...

I also tried turning on "TOOLS>INTERNET OPTIONS>Advanced>Use Inline Auto Complete"... which did in fact turn on the autocomplete function (sort of) in the OPEN/SAVE dialog boxes in the other programs I was running, but it also turned on AutoComplete in Internet Explorer (and I don't want that turned on)...


I guess what I'm asking is, does anyone know how you get these drop-down boxes back, without having to turn on AutoComplete in Internet Explorer? I suspect something happened to the registry while we cleaned-up the malware infection, or that the infection itself may have affected this function. Or maybe it's something else altogether.

In any case, if someone could lend a hand with this, I'd really appreciate it.

Thanks a million,
D.

BC AdBot (Login to Remove)

 


#2 harrythook

harrythook


  • Security Colleague
  • 4,152 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Philadelphia
  • Local time:06:56 PM

Posted 04 July 2008 - 01:25 PM

Hey don_s,
I was hoping one of the techies would answer this, but they just might need a bit more information.

What programs do you want auto-complete to run in? Just MS word for example? I think the function that you are looking at in IE is kinda broad, it will complete everything including names and some passwords.
The function that deals with file saving and names is a bit different I think, but I am not sure as to the settings on that. I am sure after the holiday one of the experts here will come along and take a look at this :thumbsup:

hang in there......

Harry

Veni Vidi Vici
THE FIGHT AGAINST MALWARE

Become a BleepingComputer fan: Facebook

#3 nigglesnush85

nigglesnush85

  • Members
  • 4,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:56 PM

Posted 04 July 2008 - 02:14 PM

Hello don_s,

Do you have TweakUI on the system? It can be downloaded from here (halfway down on the right.)

Once it has been installed open the application navigate to the Common Dialogs section and check the three options. apply and restart the system.

does the problem remain?
Regards,

Alan.

#4 don_s

don_s
  • Topic Starter

  • Members
  • 163 posts
  • OFFLINE
  •  
  • Local time:06:56 PM

Posted 04 July 2008 - 02:59 PM

Harry -

thanks for the post; I appreciate it (and will wait patiently; I forgot it was the holiday (I'm posting from Canada, and we had our holiday last weekend)))...

As for additional info, yes, I DON'T want autocomplete to run in Internet Explorer. The function used to work in Word (most of Office), as well as in AutoCad, the Adobe CS (Photoshop, InDesign, Illustrator), and Form-Z. That's most of what I run... And I think the option was available in all of them...

Thanks Harry,
D.

#5 don_s

don_s
  • Topic Starter

  • Members
  • 163 posts
  • OFFLINE
  •  
  • Local time:06:56 PM

Posted 04 July 2008 - 03:11 PM

Alan -

Thanks for your suggestion. I gave TweakUI a try about an hour ago, and it didn't work...

The problem isn't so much that the programs I'm running forget which drive and folder to save to, but once they're in that folder, the drop-down box doesn't appear when I start to type in a file name.

TweakUI, it seems, managed to get the open/save function to return me to the proper drive (but this function was never disabled). I expiremented with TUI a bit, changing drive and folder names, and it definitely worked... but autocomplete didn't reenable.


I guess I may as well add: this seems like a minor inconvenience, but it's troubling for two reasons: one, it suggests that while I was infected, something messed around with my computer, and now that something isn't quite fixed (though the infection is gone)... I'm kind of concerned that there are other tweaks present that I haven't encountered yet... but I guess I'll cross those bridges if I come to them...

Second: the autocompete was actually incredibly useful to me. For each type of software that I'm running, I have hundreds of files stored on my drives... And I use names to group those files, for example: "Plan _ building 1 - calgary _ first floor" "Plan _ building 1 - calgary _ second floor", "Plan _ building 1 - Toronto _ third floor", "3d model _ building 2 _ calgary _ morning - January", "3d model _ building 4 _ calgary _ evening - June" and so on and on and on...

Each time I go to save a file, having those drop-downs a) kept me from overwriting a similarly named file, and :thumbsup: helped me to maintain a standardized naming system...

Losing it has been a real drag. Now when I save a file, I'm forced to open up other windows and scroll through them to find the similarly named files, and then I have to open those files to see what I've stored there, and then decide to either go with the standard name or a new name... It's been really time-consuming.

Anyway, thanks a million for that first tip.
Happy 4th of July.
D.

#6 nigglesnush85

nigglesnush85

  • Members
  • 4,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:56 PM

Posted 04 July 2008 - 04:08 PM

If that didn't work, I would use a tool called Advanced Windows Care. by IObit it can be downloaded from here

This tool is not widely recommended due to the fact that it has a registry cleaner. (This can be disabled very easily)

1. Install the tool by agreeing to the EULA.
2. Choose a directory for the program.
3. Create a desktop icon but don't bother with the quick launch and the add to favourites.
4. The next window will ask you if you want to install Yahoo toolbar and if you want to make it default. Clear the check boxes
5. install the application
6. Launch the application (it will try to run a web browser, just ignore this)
7. allow it to perform its 'system backup'
8. The program will now open.
9. click the status button and then update now
10. allow the program to update. Then click start
11. You will see a list of categories (spyware removal, security defence,registry fix)
12. clear the check box for registry fix
13. click scan
14. once the scan has been completed then allow it to fix all.

I have used this tool for a couple of years now and never had any problems with it. But for added piece of mind you can backup your files first.
Regards,

Alan.

#7 don_s

don_s
  • Topic Starter

  • Members
  • 163 posts
  • OFFLINE
  •  
  • Local time:06:56 PM

Posted 04 July 2008 - 06:18 PM

Hi Alan...

Thanks for the tip... Unfortunately, it didn't work...

by the way: is there a way of Uninstalling windowscare? It didn't show up in my add/remove programs (should it)?

You know, I'm now seeing other little problems show up, and I wonder if they're related... for instance, every time I try to clear my history using Internet Options>Clear History, it won't.. . This was also happening during the infection, but I thought it had cleared up...

Oh well...

thanks again,
D.

#8 nigglesnush85

nigglesnush85

  • Members
  • 4,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:56 PM

Posted 04 July 2008 - 06:35 PM

If you want to uninstall the application it will appear under the name Advanced WindowsCare Personal in the add/remove list.

Is the system updated via windows update?
What service pack is the system using?
Have you tried using the System File Checker? To do this go to start=>run=>sfc /scannow
Regards,

Alan.

#9 don_s

don_s
  • Topic Starter

  • Members
  • 163 posts
  • OFFLINE
  •  
  • Local time:06:56 PM

Posted 04 July 2008 - 07:21 PM

Alan -

I'm not sure if I can run the scan. I just googled it, and I learned from the MSoft site that I "may require access to the Windows installation source files" and I don't have the discs.

My copy of windows is ABSOLUTELY legitimate, but it's a student version, and in order to obtain the associated discount, we "rent" the install cd from the university, and they give us a unique install code... We then return the cd once installation is complete...

do you think I can run this? Or will I run into a hiccup?

About the updates: the malware infection was resolved only just yesterday, so i'm currently in the process of updating all my critical updates.

Service Pak is 2.

Thanks,
D.

Edited by don_s, 04 July 2008 - 07:34 PM.


#10 nigglesnush85

nigglesnush85

  • Members
  • 4,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:11:56 PM

Posted 04 July 2008 - 09:06 PM

The SFC will find and repair damaged windows system files, You will need the CD in order for the scan to complete If you don't have the CD it will not finish the job.

Could you check the systems event viewer for warnings and errors. guide to event viewer
Regards,

Alan.

#11 don_s

don_s
  • Topic Starter

  • Members
  • 163 posts
  • OFFLINE
  •  
  • Local time:06:56 PM

Posted 04 July 2008 - 10:03 PM

That's what I thought (I mean, that I'd need the cd)... and since I don't have it, I won't be able to do the scan (I've never understood why the university deal works this way; in the past, when I've had some sort of Windows error, I've had to reformat my drive completely, simply because the MSoft deal with the school is "one time only use" (on the upside, the university provides windows for only 5 dollars CDN))...

I was hoping to avoid reformatting this time around, which is why I went through the HiJackThis forums in the first place...

Anyway, I'm just taking a look at the Event Viewer tutorial and then will post whatever I find there...

thanks again,
D.

#12 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:07:56 PM

Posted 05 July 2008 - 06:26 AM

There's several options available to you depending on your circumstances. Search your hard drive for a folder named i386. If you locate it, please give us the exact path to it on your hard drive.

Here's a link on how to use SFC.EXE and have it check your hard drive for the installation files (which are usually located in the i386 folder). Be advised that not all i386 folders on your computer will work with this - that's why we need the exact path to it to tell.
http://www.bleepingcomputer.com/forums/ind...st&p=368666
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#13 don_s

don_s
  • Topic Starter

  • Members
  • 163 posts
  • OFFLINE
  •  
  • Local time:06:56 PM

Posted 05 July 2008 - 12:16 PM

Hi John, Allen -

first of all, with regards to the location of the i386 folder: I searched "my computer" and found 14 folders (and one .cab file). Because there were so many folders, I didn't do the regedit (to direct SFC.EXE). If you can take a look at this and direct me from here, I'll try the scan.

The i386 folders are located at:

- C:\WINDOWS\Driver Cache\i386

- C:\Program Files\Java\jre1.6.0_06\lib\i386

- lib/i386

- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\00011\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\00012\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\00014\DriverFiles\i386
- C:\WINDOWS\system32\ReinstallBackups\00015\DriverFiles\i386



Ok, about the EVENT VIEWER; I went through all three windows (app, security, system). Here are the results:

- In EVENT VIEWER \ SYSTEM I rec'd this message: "No items in this view"

- In EVENT VIEWER \ APPLICATIONS I saw a bunch of errors etc listed from May 26th until today (May 26th was the day I originally posted my HiJackThis log on BC; I'd noticed weird symptoms leading up to this date).

- there are 3 or 4 msgs per day from May until today. They seem to fall into the following groups:

source = userenv - warning: (lots of these)
Windows saved user DENNISF\DennisFanti registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

source = ESENT - information
wuaueng.dll (3996) SUS20ClientDataStore: The database engine started a new instance (0).

wuauclt (3996) The database engine 5.01.2600.2180 started. - stopped

source = CI - information
CI has started for catalog c:\system volume information\catalog.wci.
CI has started for catalog c:\inetpub\catalog.wci.

source = CI - warning
Content index on c:\system volume information\catalog.wci could not be initialized. Error 3221225477.


source = app error - error (a bunch of these)
Faulting application iexplore.exe, version 6.0.2900.2180, faulting module mshtml.dll, version 6.0.2900.2180, fault address 0x0012bd68.

source = app error - error
Fault bucket 127309457.


source = scan - information
The description for Event ID ( 0 ) in Source ( scan ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Service started.

source - winlogon - information
The shell stopped unexpectedly and Explorer.exe was restarted. (start appearing in the middle of June (around the time I was fixing)).



In EVENT VIEWER \ SYSTEM

- the events in this view seem to run from early May to May 26th, followed by a gap and then resume on July3.


source = Service Control Manager (these msgs appear every day - I'm going to assume these are all BitDefender related)

The Network Location Awareness (NLA) service entered the running state.
The BDSelfPr service was successfully sent a start control.
The Remote Access Connection Manager service was successfully sent a start control.
The Telephony service entered the running state.
The SSDP Discovery Service service was successfully sent a start control.
The Fast User Switching Compatibility service entered the running state.
The Terminal Services service entered the running state.



source = Dhcp - warning (from May until today)
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 000EA63D375E. The following error occurred:
The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

source = eventlog - information (these seem to be grouped with the BitDefender functions above)
Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Multiprocessor Free.
The Event log service was started.

source = TCpip - information
The system detected that network adapter \DEVICE\TCPIP_{47359F0C-29EB-4F97-A923-6247C34E3202} was connected to the network, and has initiated normal operation over the network adapter.

source = Tcpip - warning (from May until today)
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Source = Tcpip6 - information
The Microsoft IPv6 Developer Edition driver was started.


Items from the past two days:
source = browser - information (one instance)
The browser has forced an election on network \Device\NetBT_Tcpip_{47359F0C-29EB-4F97-A923-6247C34E3202} because a master browser was stopped.

source = service control manager - information
The Windows Image Acquisition (WIA) service was successfully sent a start control.
The Windows Image Acquisition (WIA) service entered the running state.

source = Dhcp -warning
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 000EA63D375E. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

source = browser - information
The browser has forced an election on network \Device\NetBT_Tcpip_{47359F0C-29EB-4F97-A923-6247C34E3202} because a master browser was stopped.

source = tcpip - warning
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.


I generated reports for all 3 categories of events...

#14 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:07:56 PM

Posted 05 July 2008 - 02:49 PM

None of those are the appropriate i386 folders for running SFC.EXE - you will need an XP CD of the same version as your OS to run SFC.EXE
If you can borrow one, copy the i386 directory from it to the root of your C: drive (ie C:\i386 )

I wasn't able to see anything that'd relate to your problem in the Event Viewer reports - but I am concerned about the repeating of the number of concurrent TCP/IP connections. This could mean that there's still something on your system that's phoning home.

I'd suggest one of these free online scans to ensure that you're not infected:
(Be advised that some of these scanners will pickup things in "quarantine" from other anti-virus programs - so review the results carefully)

http://housecall.trendmicro.com
http://www.pandasecurity.com/homeusers/solutions/activescan/
http://www.kaspersky.com/virusscanner Scan Only - no removal
http://www.bitdefender.com/scan8/ie.html
http://support.f-secure.com/enu/home/ols.shtml
http://us.mcafee.com/root/mfs/default.asp
http://onlinescan.avast.com/
http://ca.com/us/securityadvisor/virusinfo/scan.aspx
http://www.eset.com/onlinescan/

<links compiled on 02/14/2008>

Edited by garmanma, 05 July 2008 - 04:14 PM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#15 don_s

don_s
  • Topic Starter

  • Members
  • 163 posts
  • OFFLINE
  •  
  • Local time:06:56 PM

Posted 05 July 2008 - 06:20 PM

John -

I thought those TCP connections might be suspicious... I have been running BitDefende and MalwareBytes scans all week, and neither have found anything, but I'll try some of the other scans and post the responses in a few hours....

Thanks,
D,




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users