Desktop+Taskbar Gone explorer regedit failed!

Discussion in 'Malware Help (A Specialist Will Reply)' started by ball777, Oct 2, 2009.

  1. ball777

    ball777 Private E-2

    I have been scanning the internet for similar threads on forums and have found the best match here at majorgeeks. Particularly this thread here "Desktop has no icons or start menu" I have had no success in getting the explorer to load for about 3 days now. Malwarebytes found some infected files and after deleting them, the problem started.

    I've checked the reg values over and over again and merged nodesktop.reg from kelly's. The .vbs fixall for taskbar and desktop always fails due to runtime error. I have included the Mgtools and combofix log. I have run malwarebytes again which found nothing and superantispyware which found 79 reg value issues but only 3 infected files. My hypothesis is based on the fact that everytime I try cd\windows, explorer.exe or run(from taskmanager) explorer, explorer.exe, or C:windows/explorer.exe I get a denial error that says the file cannot be found or that I do not have access permissions. I have tried running in safe mode. I know there are others with this problem and most of the posters had their problems fixed. Any help would be GREATLY appreciated. Running everything through the taskmanager has gotten old. I understand that there are a LOT of users to mods here as in other forums. I patiently await further directions.
     

    Attached Files:

    ball777, Oct 2, 2009
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Why are you running this PC with no protection? You have several very bad infections. One is Windows Police Pro and the other is a Conficker infection.

    You need to attach the logs from SUPERAntiSpyware and Malwarebytes so we can see what was found.


    Please run the below procedure with Win32kDiag:
    • Download this Win32kDiag and save to C:\Win32kDiag.exe. You must save it here!!!!
    • Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log
    C:\win32kdiag.exe -f -r
    Now run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Uninstall the below software:
    J2SE Runtime Environment 5.0 Update 2
    J2SE Runtime Environment 5.0 Update 6
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    My Way Search Assistant <-- should have been uninstalled in step 5 of the READ ME
    NOD32 v3.0.642 FiX1.2 by TemDono (31 days remaining forever up
    Spybot - Search & Destroy 1.4
    Viewpoint Media Player <-- should have been uninstalled in step 5 of the READ ME

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKUS\S-1-5-21-2718090849-3826651968-106128798-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
    O4 - HKUS\S-1-5-21-2718090849-3826651968-106128798-1006\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User '?')
    O4 - HKUS\S-1-5-21-2718090849-3826651968-106128798-1006\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User '?')
    O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    After clicking Fix, exit HJT.

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run MSconfig and put your PC into Normal Startup mode as was requested in step 4 of the READ & RUN ME.

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

    Now attach the below log:
    • the logs from SUPERAntiSpyware and Malwarebytes
    • the Win32kDiag.txt log
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Oct 8, 2009
    #2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds