AutoComplete keeps enabling itself

Discussion in 'adware, spyware & hijack cleaning' started by simpleton, Nov 13, 2003.

Thread Status:
Not open for further replies.
  1. simpleton

    simpleton Registered Member

    Joined:
    Nov 8, 2003
    Posts:
    25
    Location:
    Canada
    I am not sure if my problem is related to spyware or not but I figured it was best to find out for sure.

    The problem I am experiencing is AutoComplete is automatically enabling itself even though I keep disabling it. It doesn't re-enable right away - sometimes it can take up to a week before it is re-enabled. I am completely puzzled as to why this is happening and would appreciate any input offered.

    I have run Spybot Search & Destroy as well as Ad-aware and neither program finds anything that is spyware. S & D did find four DSO Eploit entries and two Windows Media Player entries but I declined to fix these until I can find out more about them. I don't believe any of these six entries are related to the peculiar behaviour of AutoComplete turning itself back on again and again but of course I could be wrong.

    Here is a copy of my HijackThis log:

    Logfile of HijackThis v1.97.6
    Scan saved at 5:12:55 PM, on 13/11/2003
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Norton Internet Security\NISUM.EXE
    C:\Program Files\Norton Internet Security\ccPxySvc.exe
    C:\Program Files\Roxio\GoBack\GBPoll.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Belkin Bulldog Plus\upsd.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\NSClean\BOClean\BOClean.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\IE New Window Maximizer\iemaximizer.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\PROGRA~1\NSClean\BOClean\BOCSEC.EXE
    C:\Program Files\Roxio\GoBack\GBTray.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Slipstream Web Accelerator\slipaccel.exe
    C:\Program Files\Belkin Bulldog Plus\MUPS.exe
    C:\Documents and Settings\Michael\Start Menu\Programs\Startup\ietsr.exe
    C:\Documents and Settings\Michael\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5500
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:5500;
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Slipstream Web Accelerator\PBHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [BOCleanautostart] C:\PROGRA~1\NSClean\BOClean\BOClean.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [IE New Window Maximizer] C:\Program Files\IE New Window Maximizer\iemaximizer.exe
    O4 - HKCU\..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe /backgroun
    O4 - Startup: ietsr.exe
    O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: SlipStream Web Accelerator.lnk = C:\Program Files\Slipstream Web Accelerator\slipaccel.exe
    O4 - Global Startup: MUPS.lnk = C:\Program Files\Belkin Bulldog Plus\MUPS.exe
    O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
    O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
    O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\Slipstream Web Accelerator\slipaccel.exe/250
    O8 - Extra context menu item: Show Original Image - res://C:\Program Files\Slipstream Web Accelerator\slipaccel.exe/227
    O9 - Extra button: ieSpell (HKLM)
    O9 - Extra 'Tools' menuitem: ieSpell (HKLM)
    O9 - Extra 'Tools' menuitem: ieSpell Options (HKLM)

    Any help would be greatly appreciated!
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,435
    Location:
    Netherlands
    Hi simpleton,

    I can find no malware in your log.
    Had a quick look for problems with AutoComplete and I could find a lot of people that could not get it to work or were unable to clear some entries, but sofar no-one where it re-enabled itself.

    Regards,

    Pieter
     
  3. simpleton

    simpleton Registered Member

    Joined:
    Nov 8, 2003
    Posts:
    25
    Location:
    Canada
    Hi Pieter,

    Thank you so much for looking at my log as well as looking into the AutoComplete issue in terms of the experiences of other people with it.

    I am thankful you found no malware but at the same time frustrated as to what is causing this. Perhaps it is just something I will have to live with. At least in all other respects, my computer is working fine.

    Thanks again for sharing both your time and knowledge with me. Much appreciated. :)
     
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,435
    Location:
    Netherlands
    Hi simpleton,

    I'd rather have found a solution for you, but maybe someone else will come along with one. :)

    Regards,

    Pieter
     
  5. simpleton

    simpleton Registered Member

    Joined:
    Nov 8, 2003
    Posts:
    25
    Location:
    Canada
    I appreciate your effort Pieter. :)

    I will keep my eye on this thread with the hope that, as you say, someone else may have a possible solution for me.
     
  6. Detox

    Detox Retired Moderator

    Joined:
    Feb 9, 2002
    Posts:
    8,507
    Location:
    Texas, USA
    Hm I've got a couple thoughts...

    My auto-update has been known to re-enable itself, but only when I had used Windows Update, that I can recall. Other than that, I know the computers at my University's computer labs always pop up asking if you would like to enable auto-complete now... So maybe it's possible that someone else using your system periodically has enabled it? Weak stuff, but that's all I've come up with today... And I must say I don't recall my own PC ever popping the "enable auto-complete" thing so...
     
  7. simpleton

    simpleton Registered Member

    Joined:
    Nov 8, 2003
    Posts:
    25
    Location:
    Canada
    Thanks very much for the reply Detox.

    I am the only one who uses this computer and I disabled AutoComplete from day one. It seemed fine until about a month after I installed XP (clean install) then I started noticing that AutoComplete was being turned on somehow. Every time I disable it...it re-enables itself again, sometimes in a couple of days, sometimes within a week but eventually I end up disabling it again.

    I have a firewall and nothing unusual is trying to obtain Internet access so maybe this is just some sort of bug that only shows up in certain configurations?

    Thanks again for taking a shot at this problem. I very much appreciate all the feedback I can get. :)
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.