Jan Il said:Hi GordL
Try the following and see if it helps:
Disable Autocomplete
Tools>Internet Options>Content tab>click Autocomplete
Uncheck all the boxes for features you don't want to use
Click Apply
Then OK
or.............
Unwanted Auto-Complete
Internet Options> Advanced> uncheck Use inline autocomplete. You may have to
delete the History folder to eliminate entries which are currently stored in
the index.dat file.
See: http://mvps.org/winhelp2002/delcache.htm
or......
http://inetexplorer.mvps.org/answers4.htm#autocomplete
Try this:
http://mvps.org/winhelp2002/delcache.htm#AutoComplete
also..........
http://www.pcmag.com/article2/0,1759,1585442,00.asp
or ........
Courtesy of Don Varnau
With no programs open,
Run REGEDIT and make your way to this key:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\SPW]
Export that key (Registry> Export.) If you you wish to undo the change,
doubleclicking on that REG file will restore the original registry key.
Then delete the SPW key.
Restart the computer.
If still n joy, then.....
in addition to running your updated anti-virus
program, you should do the following to be sure none of these are present on
your system. Although you may have already run one or more of the programs,
please do so again according to the instructions below. Some variants of
malware can replicate themselves over and over if not removed properly.
Please follow all instructions carefully to be sure your system is
thoroughly cleaned:
Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
Be sure to run CWShredder, Ad-aware and Spybot.
Also be sure to use the About:Buster here
http://www.majorgeeks.com/download4289.html
http://www.atribune.org/downloads/AboutBuster.zip
AdAware se (Free)
http://www.lavasoftusa.com/support/download/
the newest version of CWShredder (2.0) here:
http://www.majorgeeks.com/download3019.html
and the HijackThis. Please do not post your log to this
newsgroup, but to the SpywareInfo or the Aumha HiJackThis forums
http://forum.aumha.org/viewforum.php?f=30, to allow the experts there to
evaluate your log and advise you of the necessary steps to clean your
system.
CAUTION!!!!! Before you try to remove spyware using any of the programs
below, download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.
Also, get a copy of WinsockFix Utility
http://www.dfwonline.net/files/WinsockFix.zip
or
WinsockXPFix available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)
Also.........
Courtesy of Jim Byrd -
Download Sysclean.com, from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest pattern
file, here:
http://www.trendmicro.com/download/pattern.asp
Be sure to read the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt
You might also want to get Art's updater, SYS-UP.Zip, here for future
updating of these: http://home.epix.net/~artnpeg/.
(If you download and use the updater from the beginning, it will
automatically handle downloading the other files. Place them in a dedicated
folder after appropriate unzipping, and then run. This scan may take a long
time, as Sysclean is VERY extensive and thorough
and......
NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them. After you have IE access again, update all programs where
possible to get the latest definitions and run them again in Safe Mode to be
sure there are no lingering items on the system.
also...........
Additional information on how to protect your PC:
The Parasite Fight http://www.aumha.org/a/quickfix.htm
More security tips at http://www.aumha.org/a/parasite.htm
Bugs, Glitches & Stuffups: http://www.mvps.org/inetexplorer/Darnit.htm
So how did I get infected in the first place?
http://boards.cexx.org/viewtopic.ph...ghlight=&sid=53751d8ff5915261af727df08e66ce0d
or
http://snipurl.com/980t
If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.
Hope this helps
Jan
Smiles are meant to be shared,
that's why they're so contagious.
Please reply to the newsgroup so others may benefit.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
Hi Jan Il
Thanks for your response. I do apprecite it. I followed most of
your links and sadly came up empty. Unfortunatly (or fortunatly
depending on your point of view) this issue is not related to
addware, spyware, virus ware nor maleware of any other kind. I had
already throughly checked. It is also not an "auto-complete" issue
that can be changed through IE6's GUI. Again I had already throughly
checked. (This is not to say that it isn't an "auto-complete" issue
that requires some sort of registry hack to fix.)
This machine operates in a highly secure environment with current
(04.11.02) antivirus software (real-time scanning plus daily full
file scans) current anti-addware (real-time scanning and daily full
file scans) and is a fresh install of WinXP with all of the
updates/hot fixes installed before anything else. High-end outbound
(application) firewalling and similar inbound firewalling is
implimented. In addition a high end hardware firewall provides
perimiter security. This particular computer is a multihomed
"server" and has never connected to a client machine. (The LAN NIC
has never been physically connected to anything.) Both of it's IP
addresses are non-routable because the hardware firewall handles NAT
and I would never use anything other than non-routable addresses on
the LAN side.
I think I have encountered a bug in a service pack or a recently
installed hot fix and hoped that someone else had seen exactly the
same behavior and could pin-point the cause and possibly the exact
remedy. Until recently (I don't know exactly when but probably after
installing a recomended update from Microsoft) IE6 behaved normally.
This machine, when completed, will become the server for my test
network where I experiment with various hardware and software
products and configurations before rolling them out in my
mission-critical production environments. I was probably unclear in
my post that I was looking for an exact explanation rather than the
paths to possable solutions or work arrounds. It is my intention to
"image" this machine when it is fully configured so that I always
have a "known restore point" and I will need to fully document the
exact process that I followed should I (or someone else) ever need to
retrace the steps. For this reason I don't want to "thrash around"
any more than is strictly necessary.
Again, thank you for your reply. I have posted my inquiry in many
places and you are the first one to have replied.
Best Regards
GordL
Jan Il said:Hi GordL
Try the following and see if it helps:
Disable Autocomplete
Tools>Internet Options>Content tab>click Autocomplete
Uncheck all the boxes for features you don't want to use
Click Apply
Then OK
or.............
Unwanted Auto-Complete
Internet Options> Advanced> uncheck Use inline autocomplete. You may
have to delete the History folder to eliminate entries which are
currently stored in the index.dat file.
See: http://mvps.org/winhelp2002/delcache.htm
or......
http://inetexplorer.mvps.org/answers4.htm#autocomplete
Try this:
http://mvps.org/winhelp2002/delcache.htm#AutoComplete
also..........
http://www.pcmag.com/article2/0,1759,1585442,00.asp
or ........
Courtesy of Don Varnau
With no programs open,
Run REGEDIT and make your way to this key:
[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\IntelliForms\SPW] Export that key (Registry> Export.) If
you you wish to undo the change, doubleclicking on that REG file
will restore the original registry key. Then delete the SPW key.
Restart the computer.
If still n joy, then.....
in addition to running your updated anti-virus
program, you should do the following to be sure none of these are
present on your system. Although you may have already run one or
more of the programs, please do so again according to the
instructions below. Some variants of malware can replicate
themselves over and over if not removed properly. Please follow all
instructions carefully to be sure your system is thoroughly cleaned:
Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
Be sure to run CWShredder, Ad-aware and Spybot.
Also be sure to use the About:Buster here
http://www.majorgeeks.com/download4289.html
http://www.atribune.org/downloads/AboutBuster.zip
AdAware se (Free)
http://www.lavasoftusa.com/support/download/
the newest version of CWShredder (2.0) here:
http://www.majorgeeks.com/download3019.html
and the HijackThis. Please do not post your log to this
newsgroup, but to the SpywareInfo or the Aumha HiJackThis forums
http://forum.aumha.org/viewforum.php?f=30, to allow the experts
there to evaluate your log and advise you of the necessary steps to
clean your system.
CAUTION!!!!! Before you try to remove spyware using any of the
programs below, download a copy of LSPFIX from any of the following
sites: http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware
may kill your internet connection. If this should occur, this
program, LSPFIX, will enable you to regain your connection.
Also, get a copy of WinsockFix Utility
http://www.dfwonline.net/files/WinsockFix.zip
or
WinsockXPFix available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock
reset
will fix this problem without the need for these programs.)
Also.........
Courtesy of Jim Byrd -
Download Sysclean.com, from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest
pattern file, here:
http://www.trendmicro.com/download/pattern.asp
Be sure to read the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt
You might also want to get Art's updater, SYS-UP.Zip, here for future
updating of these: http://home.epix.net/~artnpeg/.
(If you download and use the updater from the beginning, it will
automatically handle downloading the other files. Place them in a
dedicated folder after appropriate unzipping, and then run. This
scan may take a long time, as Sysclean is VERY extensive and thorough
and......
NOTE: If you can not download these programs from the Internet, if
your PC has CD read capabilities, go to another computer with CD-ROM
burning capabilities. Create a folder on the hard drive of the other
computer called HOLD, download the programs to that folder, then
burn that folder to a CD. Copy the HOLD folder to your HD and then
install the programs from there and run them. After you have IE
access again, update all programs where possible to get the latest
definitions and run them again in Safe Mode to be sure there are no
lingering items on the system.
also...........
Additional information on how to protect your PC:
The Parasite Fight http://www.aumha.org/a/quickfix.htm
More security tips at http://www.aumha.org/a/parasite.htm
Bugs, Glitches & Stuffups:
http://www.mvps.org/inetexplorer/Darnit.htm
So how did I get infected in the first place?
http://boards.cexx.org/viewtopic.ph...ghlight=&sid=53751d8ff5915261af727df08e66ce0d
or
http://snipurl.com/980t
If these steps do not resolve your problem, please post back to this
thread with the details and any error messages.
Hope this helps
Jan
Smiles are meant to be shared,
that's why they're so contagious.
Please reply to the newsgroup so others may benefit.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
Jan Il said:Hi GordL
You're welcome! Now....you don't mention which version of Windows you are
running, so I'll do a bit of guess work at the moment, but, it would help if
you were to let us know which version of Windows you use, any error messages
you are getting, and exactly what is being displayed in the address bar
window.
Also, are you using the Google toolbar? If so, check the following:
Disable Google "Keyword" or Browse by Name
To disable the Browse by Name functionality, simply uncheck its box on the
Toolbar's Options menu.
also.............
Unable to search from IE6 Address Bar
Check the Registry to see if this file is there. Sometime during removal of
hijackers or spyware files in the Registry can get corrupted or removed as
well. If not, try adding this line to this part of the registry.
(watch for the wrap, it should be all on one line)"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
or..............
Restore default Search functions:
In order to restore you default Search functions, download and run the
program below. You will have to redo any customized features you may have
added afterward.
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG
or....................
Courtesy of Tony Klein, MS MVP:
This will restore the Windows defaults for a whole lot of Search related
registry entries.
CAUTION: BACKUP YOUR REGISTRY FIRST!
Close IE, copy the bold to Notepad, save as Search.reg (save as 'all files',
and doubleclick. Answer 'yes' when prompted to add the contents of
Search.reg to the Registry:
REGEDIT4 (Watch for the line wrap. Each one should be all on on line.)
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix] @="http://"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]"
ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://
or.............................
Download the fix - Reset Search:
http://www.spywareinfo.com/downloads/tools/IEFIX.reg
This will restore your default Search functionality. However, if you had
any custom adjustments you have made will have to re-select them.
or.............
Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg
If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.
Hope this helps
Jan
Smiles are meant to be shared,
that's why they're so contagious.
Please reply to the newsgroup so others may benefit.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
Hi Jan Il
Thanks for your response. I do apprecite it. I followed most of
your links and sadly came up empty. Unfortunatly (or fortunatly
depending on your point of view) this issue is not related to
addware, spyware, virus ware nor maleware of any other kind. I had
already throughly checked. It is also not an "auto-complete" issue
that can be changed through IE6's GUI. Again I had already throughly
checked. (This is not to say that it isn't an "auto-complete" issue
that requires some sort of registry hack to fix.)
This machine operates in a highly secure environment with current
(04.11.02) antivirus software (real-time scanning plus daily full
file scans) current anti-addware (real-time scanning and daily full
file scans) and is a fresh install of WinXP with all of the
updates/hot fixes installed before anything else. High-end outbound
(application) firewalling and similar inbound firewalling is
implimented. In addition a high end hardware firewall provides
perimiter security. This particular computer is a multihomed
"server" and has never connected to a client machine. (The LAN NIC
has never been physically connected to anything.) Both of it's IP
addresses are non-routable because the hardware firewall handles NAT
and I would never use anything other than non-routable addresses on
the LAN side.
I think I have encountered a bug in a service pack or a recently
installed hot fix and hoped that someone else had seen exactly the
same behavior and could pin-point the cause and possibly the exact
remedy. Until recently (I don't know exactly when but probably after
installing a recomended update from Microsoft) IE6 behaved normally.
This machine, when completed, will become the server for my test
network where I experiment with various hardware and software
products and configurations before rolling them out in my
mission-critical production environments. I was probably unclear in
my post that I was looking for an exact explanation rather than the
paths to possable solutions or work arrounds. It is my intention to
"image" this machine when it is fully configured so that I always
have a "known restore point" and I will need to fully document the
exact process that I followed should I (or someone else) ever need to
retrace the steps. For this reason I don't want to "thrash around"
any more than is strictly necessary.
Again, thank you for your reply. I have posted my inquiry in many
places and you are the first one to have replied.
Best Regards
GordL
Jan Il said:Hi GordL
Try the following and see if it helps:
Disable Autocomplete
Tools>Internet Options>Content tab>click Autocomplete
Uncheck all the boxes for features you don't want to use
Click Apply
Then OK
or.............
Unwanted Auto-Complete
Internet Options> Advanced> uncheck Use inline autocomplete. You may
have to delete the History folder to eliminate entries which are
currently stored in the index.dat file.
See: http://mvps.org/winhelp2002/delcache.htm
or......
http://inetexplorer.mvps.org/answers4.htm#autocomplete
Try this:
http://mvps.org/winhelp2002/delcache.htm#AutoComplete
also..........
http://www.pcmag.com/article2/0,1759,1585442,00.asp
or ........
Courtesy of Don Varnau
With no programs open,
Run REGEDIT and make your way to this key:
[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\IntelliForms\SPW] Export that key (Registry> Export.) If
you you wish to undo the change, doubleclicking on that REG file
will restore the original registry key. Then delete the SPW key.
Restart the computer.
If still n joy, then.....
in addition to running your updated anti-virus
program, you should do the following to be sure none of these are
present on your system. Although you may have already run one or
more of the programs, please do so again according to the
instructions below. Some variants of malware can replicate
themselves over and over if not removed properly. Please follow all
instructions carefully to be sure your system is thoroughly cleaned:
Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
Be sure to run CWShredder, Ad-aware and Spybot.
Also be sure to use the About:Buster here
http://www.majorgeeks.com/download4289.html
http://www.atribune.org/downloads/AboutBuster.zip
AdAware se (Free)
http://www.lavasoftusa.com/support/download/
the newest version of CWShredder (2.0) here:
http://www.majorgeeks.com/download3019.html
and the HijackThis. Please do not post your log to this
newsgroup, but to the SpywareInfo or the Aumha HiJackThis forums
http://forum.aumha.org/viewforum.php?f=30, to allow the experts
there to evaluate your log and advise you of the necessary steps to
clean your system.
CAUTION!!!!! Before you try to remove spyware using any of the
programs below, download a copy of LSPFIX from any of the following
sites: http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware
may kill your internet connection. If this should occur, this
program, LSPFIX, will enable you to regain your connection.
Also, get a copy of WinsockFix Utility
http://www.dfwonline.net/files/WinsockFix.zip
or
WinsockXPFix available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock
reset
will fix this problem without the need for these programs.)
Also.........
Courtesy of Jim Byrd -
Download Sysclean.com, from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest
pattern file, here:
http://www.trendmicro.com/download/pattern.asp
Be sure to read the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt
You might also want to get Art's updater, SYS-UP.Zip, here for future
updating of these: http://home.epix.net/~artnpeg/.
(If you download and use the updater from the beginning, it will
automatically handle downloading the other files. Place them in a
dedicated folder after appropriate unzipping, and then run. This
scan may take a long time, as Sysclean is VERY extensive and thorough
and......
NOTE: If you can not download these programs from the Internet, if
your PC has CD read capabilities, go to another computer with CD-ROM
burning capabilities. Create a folder on the hard drive of the other
computer called HOLD, download the programs to that folder, then
burn that folder to a CD. Copy the HOLD folder to your HD and then
install the programs from there and run them. After you have IE
access again, update all programs where possible to get the latest
definitions and run them again in Safe Mode to be sure there are no
lingering items on the system.
also...........
Additional information on how to protect your PC:
The Parasite Fight http://www.aumha.org/a/quickfix.htm
More security tips at http://www.aumha.org/a/parasite.htm
Bugs, Glitches & Stuffups:
http://www.mvps.org/inetexplorer/Darnit.htm
So how did I get infected in the first place?
http://boards.cexx.org/viewtopic.ph...ghlight=&sid=53751d8ff5915261af727df08e66ce0d
or
http://snipurl.com/980t
If these steps do not resolve your problem, please post back to this
thread with the details and any error messages.
Hope this helps
Jan
Smiles are meant to be shared,
that's why they're so contagious.
Please reply to the newsgroup so others may benefit.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
When I try to type anything into the IE6 address bar it is
overwritten within a couple of seconds with whatever was previously
there. Does anyone have any ideas? All service packs are
up-to-date on a clean machine.
Hi Jan Il
Again thanks for your reply. I have been out of the country on business for
two days and just now saw your message. I have not yet had a chance to
explore what you presented but I can offer this. The OS is WinXP-Pro running
on pure Intel hardware. All service packs drivers etc. are up-to-date. I am
trying to build the "perfect" test bed so that when I test a piece of
software that is potentially destined for my production environment I can be
reasonably certain that any "flakiness" is not being caused by a "flaky"
machine.
Perhaps knowing the OS will help us narrow down the cause of the IE6 address
bar issue.
What reappears in the IE6 address bar is whatever was there before I started
to type anything into it. Here is the scenario. If http://www.microsoft.com
was being displayed and I tried to manually type in something else I would
only get to enter a couple of characters and the address bar would revert
back to http://www.microsoft.com. Similarly if C:\MyDocument.htm was in the
address bar and I tried to type www.microsoft.com into it, long before I can
even get the www part in C:\MyDocument.htm will "step on" what ever I was
trying to type. If http://www.yahoo.com was in the address bar and I typed
in nothing more than the letter "a" (without the quotes) within about a
second http://www.yahoo.com will reappear in the address bar overwriting my
"a".
Regarding Goggle search; there are absolutely no 'non-Microsoft' add-ons
installed.
With regards to searching from the address bar; the address bar is useless
to me because I cannot type anything into it so unfortunately it is
impossible to know about it's search capabilities. (Based on personal
experience though I doubt that the address bar's search functionality is an
issue.) I most strongly suspect a bug in a patch rather than a setting.
I am a programmer. I write in several (about 20 or so) programming
languages and have had the unfortunate experience of introducing a very
similar bug in one of my own programs. I accidentally created a scenario
where actual data acquired from a PLC overwrote what was supposed to be a
user input field. The user would begin to enter some data (on a Wonderware
application that I wrote) and the next time Wonderware scanned the PLC (it
scanned the PLC once every 500mS) the user input was overwritten by the PLC
data register. It is very difficult to create a field that can be written to
by both the system and by a user.
Clearly the system overwrites data in a field that I will call
IE6Message$AddressBar when I click on a link in an email. This is how the
address bar can display updated information when you navigate by clicking on
a link. What should not happen is IE6Message$AddressBar should _not_ be
written to by the system if input data is being entered from a keyboard.
As stated earlier it is my goal to produce a fully functional machine
without hacking through it to make it work. It is specifically not my goal
to cobble together a working machine that I could not easily put together a
second and a third etc. time because, after failed tests of new software that
prove to be unstable I will have to do exactly that; reformat, reinstall, and
rebuild the machine. I have no wish to struggle through this several more
times in the future. In consideration of the fact that this newly installed
system is already exhibiting some "flakiness" I am not far from blowing it
away and starting again from a low level format of the entire system.
The answer that I am looking for should read something like this:
Please see MSKB article KBxxxxxxx that discusses a malfunctioning IE6
address bar where the address bar will not allow user input or user input is
overwritten with previously displayed data. Uninstall Patch Qxxxxxxx and
then install patch Qyyyyyyy to remedy this documented problem.
Answers that I am not looking for include phrases such as "try this". I
don't mean to be harsh but I am _not_ looking for hacks. I am looking for a
definitive solution that I can document as part of a "build procedure".
Best regards
GordL
Jan Il said:Hi GordL
You're welcome! Now....you don't mention which version of Windows you are
running, so I'll do a bit of guess work at the moment, but, it would help if
you were to let us know which version of Windows you use, any error messages
you are getting, and exactly what is being displayed in the address bar
window.
Also, are you using the Google toolbar? If so, check the following:
Disable Google "Keyword" or Browse by Name
To disable the Browse by Name functionality, simply uncheck its box on the
Toolbar's Options menu.
also.............
Unable to search from IE6 Address Bar
Check the Registry to see if this file is there. Sometime during removal of
hijackers or spyware files in the Registry can get corrupted or removed as
well. If not, try adding this line to this part of the registry.
(watch for the wrap, it should be all on one line)"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
or..............
Restore default Search functions:
In order to restore you default Search functions, download and run the
program below. You will have to redo any customized features you may have
added afterward.
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG
or....................
Courtesy of Tony Klein, MS MVP:
This will restore the Windows defaults for a whole lot of Search related
registry entries.
CAUTION: BACKUP YOUR REGISTRY FIRST!
Close IE, copy the bold to Notepad, save as Search.reg (save as 'all files',
and doubleclick. Answer 'yes' when prompted to add the contents of
Search.reg to the Registry:
REGEDIT4 (Watch for the line wrap. Each one should be all on on line.)
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix] @="http://"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]"
ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://
or.............................
Download the fix - Reset Search:
http://www.spywareinfo.com/downloads/tools/IEFIX.reg
This will restore your default Search functionality. However, if you had
any custom adjustments you have made will have to re-select them.
or.............
Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg
If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.
Hope this helps
Jan
Smiles are meant to be shared,
that's why they're so contagious.
Please reply to the newsgroup so others may benefit.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
http://boards.cexx.org/viewtopic.ph...ghlight=&sid=53751d8ff5915261af727df08e66ce0dHi Jan Il
Thanks for your response. I do apprecite it. I followed most of
your links and sadly came up empty. Unfortunatly (or fortunatly
depending on your point of view) this issue is not related to
addware, spyware, virus ware nor maleware of any other kind. I had
already throughly checked. It is also not an "auto-complete" issue
that can be changed through IE6's GUI. Again I had already throughly
checked. (This is not to say that it isn't an "auto-complete" issue
that requires some sort of registry hack to fix.)
This machine operates in a highly secure environment with current
(04.11.02) antivirus software (real-time scanning plus daily full
file scans) current anti-addware (real-time scanning and daily full
file scans) and is a fresh install of WinXP with all of the
updates/hot fixes installed before anything else. High-end outbound
(application) firewalling and similar inbound firewalling is
implimented. In addition a high end hardware firewall provides
perimiter security. This particular computer is a multihomed
"server" and has never connected to a client machine. (The LAN NIC
has never been physically connected to anything.) Both of it's IP
addresses are non-routable because the hardware firewall handles NAT
and I would never use anything other than non-routable addresses on
the LAN side.
I think I have encountered a bug in a service pack or a recently
installed hot fix and hoped that someone else had seen exactly the
same behavior and could pin-point the cause and possibly the exact
remedy. Until recently (I don't know exactly when but probably after
installing a recomended update from Microsoft) IE6 behaved normally.
This machine, when completed, will become the server for my test
network where I experiment with various hardware and software
products and configurations before rolling them out in my
mission-critical production environments. I was probably unclear in
my post that I was looking for an exact explanation rather than the
paths to possable solutions or work arrounds. It is my intention to
"image" this machine when it is fully configured so that I always
have a "known restore point" and I will need to fully document the
exact process that I followed should I (or someone else) ever need to
retrace the steps. For this reason I don't want to "thrash around"
any more than is strictly necessary.
Again, thank you for your reply. I have posted my inquiry in many
places and you are the first one to have replied.
Best Regards
GordL
:
Hi GordL
Try the following and see if it helps:
Disable Autocomplete
Tools>Internet Options>Content tab>click Autocomplete
Uncheck all the boxes for features you don't want to use
Click Apply
Then OK
or.............
Unwanted Auto-Complete
Internet Options> Advanced> uncheck Use inline autocomplete. You may
have to delete the History folder to eliminate entries which are
currently stored in the index.dat file.
See: http://mvps.org/winhelp2002/delcache.htm
or......
http://inetexplorer.mvps.org/answers4.htm#autocomplete
Try this:
http://mvps.org/winhelp2002/delcache.htm#AutoComplete
also..........
http://www.pcmag.com/article2/0,1759,1585442,00.asp
or ........
Courtesy of Don Varnau
With no programs open,
Run REGEDIT and make your way to this key:
[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\IntelliForms\SPW] Export that key (Registry> Export.) If
you you wish to undo the change, doubleclicking on that REG file
will restore the original registry key. Then delete the SPW key.
Restart the computer.
If still n joy, then.....
in addition to running your updated anti-virus
program, you should do the following to be sure none of these are
present on your system. Although you may have already run one or
more of the programs, please do so again according to the
instructions below. Some variants of malware can replicate
themselves over and over if not removed properly. Please follow all
instructions carefully to be sure your system is thoroughly cleaned:
Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
Be sure to run CWShredder, Ad-aware and Spybot.
Also be sure to use the About:Buster here
http://www.majorgeeks.com/download4289.html
http://www.atribune.org/downloads/AboutBuster.zip
AdAware se (Free)
http://www.lavasoftusa.com/support/download/
the newest version of CWShredder (2.0) here:
http://www.majorgeeks.com/download3019.html
and the HijackThis. Please do not post your log to this
newsgroup, but to the SpywareInfo or the Aumha HiJackThis forums
http://forum.aumha.org/viewforum.php?f=30, to allow the experts
there to evaluate your log and advise you of the necessary steps to
clean your system.
CAUTION!!!!! Before you try to remove spyware using any of the
programs below, download a copy of LSPFIX from any of the following
sites: http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware
may kill your internet connection. If this should occur, this
program, LSPFIX, will enable you to regain your connection.
Also, get a copy of WinsockFix Utility
http://www.dfwonline.net/files/WinsockFix.zip
or
WinsockXPFix available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock
reset
will fix this problem without the need for these programs.)
Also.........
Courtesy of Jim Byrd -
Download Sysclean.com, from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest
pattern file, here:
http://www.trendmicro.com/download/pattern.asp
Be sure to read the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt
You might also want to get Art's updater, SYS-UP.Zip, here for future
updating of these: http://home.epix.net/~artnpeg/.
(If you download and use the updater from the beginning, it will
automatically handle downloading the other files. Place them in a
dedicated folder after appropriate unzipping, and then run. This
scan may take a long time, as Sysclean is VERY extensive and thorough
and......
NOTE: If you can not download these programs from the Internet, if
your PC has CD read capabilities, go to another computer with CD-ROM
burning capabilities. Create a folder on the hard drive of the other
computer called HOLD, download the programs to that folder, then
burn that folder to a CD. Copy the HOLD folder to your HD and then
install the programs from there and run them. After you have IE
access again, update all programs where possible to get the latest
definitions and run them again in Safe Mode to be sure there are no
lingering items on the system.
also...........
Additional information on how to protect your PC:
The Parasite Fight http://www.aumha.org/a/quickfix.htm
More security tips at http://www.aumha.org/a/parasite.htm
Bugs, Glitches & Stuffups:
http://www.mvps.org/inetexplorer/Darnit.htm
So how did I get infected in the first place?or
http://snipurl.com/980t
If these steps do not resolve your problem, please post back to this
thread with the details and any error messages.
Hope this helps
Jan
Smiles are meant to be shared,
that's why they're so contagious.
Please reply to the newsgroup so others may benefit.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
When I try to type anything into the IE6 address bar it is
overwritten within a couple of seconds with whatever was previously
there. Does anyone have any ideas? All service packs are
up-to-date on a clean machine.
Jan Il said:Hi GordL
In view of the detailed and technical information you are seeking at
this point, I am afraid I am not qualified to assist you further.
Not knowing your exact OS at the onset, I tried to provide
information that might address such a problem under normal
circumstances. However, perhaps someone here is experienced and
knowledgeable in the specifics you require. I have spent some time
researching the problem, and I can find nothing that references any
known bug of this nature related to a faulty update. It may be also
necessary for you to contact the Microsoft Technical support direct
for a quick resolution.
I am sorry I am unable to provide assistance for you with this issue,
and wish you good luck with finding a viable solution.
Jan
GordL said: