Desktop Icons and Start menu gone - Page 2

[PhilliePhan]

In addition to the step in Post #30, please do the following:

-- Run Explorer (NOT explorer.exe) and Navigate to C:\WINDOWS\ServicePackFiles\I386
-- RightClick on Explorer.exe and Copy it. Then, paste it back into the I386 folder.
You should now have a file reading Copy of explorer.exe along with explorer.exe.
Rename the Copy of explorer.exe to Kenney.exe and then Cut&Paste Kenney.exe into the C:\Windows folder.

Just leave it there for now along with the current explorer.exe in the Windows folder.
Let me know if you had any problems with this.

Lastly:
Download this new Kenney.bat

Run it and post the log for me along with the silentrunners log.

Cheers :)
PP

[Kenney]

Hi PP,

Ok, first please see the attached logs. I was successful in running them both.

I also tried to copy & paste explorer as you instructed and was once again unsuccessful. I got a similar message to the one before, "Cannot copy explorer: Access is denied. Make sure the disk is not full or write-protected and that the file is not currently in use."
I also tried to run just explorer in the task manager and was unsuccessful.

As always, please let me know what you think.

[PhilliePhan]

I also tried to copy & paste explorer as you instructed and was once again unsuccessful. I got a similar message to the one before, "Cannot copy explorer: Access is denied.

In the I386 folder? It wouldn't let you copy that?

Try in Safe Mode and let me know.

Also, please disable SpybotSD's Tea Timer:
http://russelltexas.com/malware/teatimer.htm

Then Reboot and run a HJT scan and post me the log. Linky below:
http://free.antivirus.com/hijackthis/

This is odd - the logs all look normal to me - perhaps I am missing something. Let's see if we can get that explorer.exe copied and then I can try to rule some things out.....

-- Before you posted here, did you attempt any other fixes or post in another forum. I saw that C:\logevent.dll where somebody might instruct you to copy it, so I'm curious.

PP :)

[PhilliePhan]

This is odd - the logs all look normal to me - perhaps I am missing something. Let's see if we can get that explorer.exe copied and then I can try to rule some things out.....

I think I see what I missed - I feel stupid......

In addition to the above, do this:
Use task manager to open a command prompt (cmd or command.com)

Type or Copy&Paste:

copy C:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\explorer.exe C:\ /y
& hit ENTER

THEN:
I am not sure if you still have Avenger available, so I'll copy & paste the whole thing....

Please Download The Avenger v2 by Swandog46
http://swandog46.geekstogo.com/avenger.zip

-- Extract Avenger.exe from the ZIP to your Desktop
-- Highlight the complete text in Red below and copy it using Ctrl+C or RightClick > Copy:

Files to move:
C:\explorer.exe | C:\WINDOWS\explorer.exe

-- Now, DoubleClick avenger.exe on your desktop to run it
-- Read the Warning Prompt and press OK
-- Paste the script you just copied into the textbox, using Ctrl+V or RightClick > Paste
-- Press Execute
-- Answer YES to the confirmation prompts and allow your computer to reboot.
In some cases, The Avenger will reboot your machine a second time. No worries.
-- After reboot, The Avenger should open a log – please post that for me.

Hopefully this will do the trick.... I'll be back in a couple hours to check.

Best Luck :)
PP

[Kenney]

Hi PP,

First, please see the attached hijackthis log.

Secondly when I tried to open spybot I got the message path error. So, in turn I just removed spybot all together via the add and remove feature. I hope this is ok.

I tried to copy and paste the explorer.exe as you instructed in safe mode and once again was unsuccessful....got the same error message about not being able to copy explorer.exe.

Also, I did attempt to fix my problem via some other forums recommendations. Do you think this is part of the problem?

Anyway, let me know.

Also, I just noticed you posted some more instructions (after I made this initial post).

I followed your instructions and when I hit execute in avenger I get the following error message: Error: Could not register cleanup. Aborting execution! Error 0: the operation completed successfully. I tried it several times and I get the same message each time. Am I doing something wrong?

Thanks.

[PhilliePhan]

Also, I did attempt to fix my problem via some other forums recommendations. Do you think this is part of the problem?

Probably not - Just wanted to check because it looked like some fixing had taken place.
No worries.

Please download This File and place it in your C:\Windows folder.

Let me know if you were able to do that.

PP :)

[Kenney]

Hi PP,

Yes, I was able to save it...

Should I run it? (probably a stupid question, but I have to ask).

Thanks.

[PhilliePhan]

Should I run it? (probably a stupid question, but I have to ask).

Actually, no . . . . :)

Please download Fixit.reg to a convenient location.
DoubleClick on it and Allow it to merge into the registry.
It it allows you to merge, then Reboot and let me know how things look.
If you get another error message, let me know.

PP :)

[Kenney]

Hi PP,

I have a desk top with icons and a start menu (Yay...jumping up and down). I'm so elated! You just don't know how happy you just made me.

You are a genius! My goodness, this has been bothering me for the longest.

Thank You...Thank You.

Now, what are you recommendations for keeping this from happening again, i.e. virus protection programs, and/or firewall type stuff?

[PhilliePhan]

Now, what are you recommendations for keeping this from happening again, i.e. virus protection programs, and/or firewall type stuff?

Glad to see a return to some semblance of normal :)

This, however, is just a workaround and may not last and certainly should not be permanent. What we have done is changed the Winlogon Shell value to "Kenney.exe" - we still need to address the root problems remaining from the malware.

This particular malware tends to leave the system fairly unstable. Plus, you may get a bunch more of those error messages when trying to run programs...

If you don't mind running more logs . . . . . :)

This is what I'd like to see:

-- Download DDS by sUBs and save it to your Desktop
-- If your AV has a script blocker, please disable it
-- DoubleClick on dds.scr to run the tool

* A command box will open, displaying added information for your reading pleasure while DDS completes its scan.
* Upon completion, a Dialog Box should open instructing you to save and post the TWO resulting logs (DDS.txt & Attach.txt).

- Copy&Paste the DDS.txt into your next post.
- Please post Attach.txt as an attachment to your post - there is no need to Zip it.

-- Please Download:
http://download.sysinternals.com/Files/Junction.zip
Extract junction.exe from the Junction.zip you downloaded and place junction.exe in your C:\Windows directory.
Start a command prompt and type:
junction -s > C:\Logit.txt

Let the tool run and then post the C:\Logit.txt for me.

I will check back in Monday evening.

G'Night :)
PP

[Kenney]

Hi PP,

I wasn't able to find the logit (log) for the junction program. I followed your instructions and something popped up but disappeared relatively quickly. I'll try again tomorrow...I may be getting a little tired here.

Anyway I was able to do the rest.

Thanks...talk to you tomorrow!

Please see below:

DDS (Ver_09-09-29.01) - NTFSx86
Run by Administrator at 1:44:17.31 on Mon 10/05/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.121 [GMT -4:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\Kenney.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MP4 Player\mp4Player.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Shell=Kenney.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: FGCatchUrl: {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - c:\program files\flashget\jccatch.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - c:\program files\flashget\getflash.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [MP4 Player] "c:\program files\mp4 player\mp4Player.exe" hmw
uRun: [RegistryMechanic] c:\program files\registry mechanic\RegMech.exe /H
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IgfxTray] "c:\windows\system32\igfxtray.exe"
mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe"
mRun: [Realtime Monitor] "c:\progra~1\ca\etrust~1\realmon.exe" -s
mRun: [AdaptecDirectCD] "c:\program files\roxio\easy cd creator 5\directcd\DirectCD.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"
mRun: [Flashget] "c:\program files\flashget\FlashGet.exe" /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [AppleSyncNotifier] "c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10b.exe
IE: &Download All with FlashGet - c:\program files\flashget\jc_all.htm
IE: &Download with FlashGet - c:\program files\flashget\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205852848724
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://sdlc-esd.sun.com/ESD39/JSCDL/jdk/6u5b/jinstall-6u5-windows-i586-jc.cab?AuthParam=1205942330_e45359278c53296fa7f05c57decb8380&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD39/JSCDL/jdk/6u5b/jinstall-6u5-windows-i586-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\64a7lc56.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-8-8 206256]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-9-15 74480]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-8-8 348752]
R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-8-8 1097096]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]

=============== Created Last 30 ================

2009-10-05 00:58 1,033,728 a------- c:\windows\Kenney.exe
2009-10-04 23:27 1,033,728 a------- C:\explorer.exe
2009-10-04 22:19 <DIR> --d----- c:\program files\Trend Micro
2009-09-30 22:55 <DIR> a-dshr-- C:\cmdcons
2009-09-29 21:00 <DIR> --d----- C:\PKBTEMP
2009-09-27 21:59 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-09-27 12:48 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-09-27 12:48 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-27 12:48 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-09-27 12:48 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-09-27 12:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-09-27 11:40 7,396 a------- c:\windows\system32\drivers\pctcore.cat
2009-09-27 11:37 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-09-27 11:37 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-09-27 11:37 <DIR> --d----- c:\docume~1\admini~1\applic~1\SUPERAntiSpyware.com
2009-09-26 23:16 2,207,776 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-09-26 23:16 286,240 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2009-09-26 23:16 27,908 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2009-09-26 23:16 26,948 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-09-26 22:50 <DIR> --d----- c:\program files\common files\ParetoLogic
2009-09-26 22:50 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ParetoLogic
2009-09-24 20:48 <DIR> --d----- c:\windows\system32\appmgmt

==================== Find3M ====================

2009-09-29 22:55 166 a------- c:\program files\zvudg.txt
2009-09-27 11:40 206,256 a------- c:\windows\system32\drivers\PCTCore.sys
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll

============= FINISH: 1:46:11.42 ===============

[PhilliePhan]

Hi PP,

I wasn't able to find the logit (log) for the junction program. I followed your instructions and something popped up but disappeared relatively quickly. I'll try again tomorrow...I may be getting a little tired here.

=============== Created Last 30 ================

2009-10-04 23:27 1,033,728 a------- C:\explorer.exe

Hi Kenney,

A few things:
-- Are you getting any errors when you try to run programs?
-- It looks like you were indeed able to copy explorer.exe to the C:\ drive.
See if you can now DELETE the bad copy of explorer.exe in the Windows folder. ( C:\Windows\explorer.exe )
If you are able to do that, then Copy&Paste C:\explorer.exe into the C:\Windows folder.
Let me know if you are able to do that.

PP :)

[Kenney]

Happy Monday PP,

I wasn't able to delete the explorer.exe from the
C:\Windows\explorer.exe. I got the error message of not being able to delete explorer: Access denied. Make sure disk is not fill or write-protected. Interesting...

Anyway, let me know what you think.

Thanks

[PhilliePhan]

I wasn't able to delete the explorer.exe from the
C:\Windows\explorer.exe. I got the error message of not being able to delete explorer: Access denied. Make sure disk is not fill or write-protected. Interesting...

Interesting indeed.....

--- See if you can delete it with Unlocker and let me know.
http://ccollomb.free.fr/unlocker/

If that doesn't work, we'll try a couple other options...

---You may also want to uninstall C:\Program Files\MP4 Player
I don't see why you'd need this with the codecs on your compy. Anyhoo, the choice is yours, of course.
See below:
http://www.bleepingcomputer.com/startups/mp4Player.exe-21448.html

Happy Monday :)
PP

[PhilliePhan]

Hi Kenney,

Heading out for a bit, so I wanted to post this in the event that the steps in post #44 did not work.

First, please do this again and post me the log - do this regardless of whether you had success deleting the bad explorer.exe:

-- Please Download a fresh Win32kDiag from a linky below and save it to your Desktop.
• http://ad13.geekstogo.com/Win32kDiag.exe
• http://download.bleepingcomputer.com/rootrepeal/Win32kDiag.exe
-- DoubleClick on Win32kDiag.exe to run it. Let it run for as long as it needs to.
-- When it says Finished – Press any key to exit, do that to exit the program.
-- You should now have a Win32kDiag.txt on your Desktop. Please post the entire log for me.
Be sure to let it run until is says "Finished" before posting the log!

-- If the step in Post #44 Failed, please do this:

Please download FixIt.zip and RightClick on FixIt.zip and Extract the FixIt folder to your Desktop.
-- Inside the folder, you'll see RunThis.bat - DoubleClick it and let it run for as long as it takes.
A log should pop up - please post that for me.

Cheers :)
PP

[Kenney]

Hi PP,

I hope all is well. I'm sorry for not responding last night but I was ridiculously tired and the win32diag seemed like it took forever to run. By the way, its attached.

Ok, a couple of things. I was able to delete the explorer using the unlocker application you sent me...just clicked on it and unlocker just deleted it.

Now, the wierd thing is, as I was going back to get the other/good copy of explorer to copy and paste in the windows folder....I selected paste and it said explorer was already in the folder and asked if I wanted to replace it. I said no, but it appeared my old correct explorer mysteriously reappeared. I hope I'm making a little sense here. The explorer I deleted looked wierd, i.e. it was just a square with explorer up under it (kind of hard to explain).
The copy that seemed to come out of nowhere looked like the good copy downloaded in my C: drive, i.e. it had an actual picture of a computer and said explorer. Once again, I hope I'm not just sounding crazy but its kind of hard to describe. Nevertheless if you think I should replace the explorer, please let me know.

By the way, I will delete MP4 as soon as I figure out how.

Ok, don't forget I would love to hear your suggestions on how to keep this computer safe. When I log on currently it says my firewall is turned off and my computer may be at risk.

Anyway, thanks so much for you assistance.

Talk to you later.

K

[PhilliePhan]

I hope all is well. I'm sorry for not responding last night but I was ridiculously tired and the win32diag seemed like it took forever to run.

No Worries - We all have "real lives" to deal with... :)

I said no, but it appeared my old correct explorer mysteriously reappeared.

That is normal - Windows will replace explorer.exe almost immediately if you delete or rename it. I just was not sure it would do this for you since you were/are now running Kenney.exe

Frankly, I'd be most comfortable if you Renamed C:\Windows\Kenney.exe to C:\Windows\explorer.exe. That way we know it is for sure good.....

Then, I'll need to give you another registry patch to change the Winlogon value back to explorer.

By the way, I will delete MP4 as soon as I figure out how.

Go into Add/Remove Programs and uninstall it. Should be listed as "MP4 player"

Ok, don't forget I would love to hear your suggestions on how to keep this computer safe. When I log on currently it says my firewall is turned off and my computer may be at risk.

Once we get the explorer thing sorted, we'll work on that. A couple questions:
Are you paying for Anti-Virus?
Are you paying for Spyware Doctor or any other anti-spy tools?
The reason I ask is that you might want to keep those.

I can also suggest some good FREE and maybe better alternatives, if you want to go that way......

Anyway, thanks so much for you assistance.

Happy to help! :)
PP

[Kenney]

Hi PP,

Ok, I tried to rename Kenney.exe to explorer.exe and each time I get an error message saying I cannot change the name because another file in the folder has that name. I noticed there is another explorer.exe in the folder.,...it looks to be the original one....but I really don't know.

As far as other anti spyware programs.... I did pay and sign up for spyware doctor, and I did buy a spy sweeper disk from walmart. Those are the only two I've actually paid for.

Thanks,
PP

[PhilliePhan]

As far as other anti spyware programs.... I did pay and sign up for spyware doctor, and I did buy a spy sweeper disk from walmart. Those are the only two I've actually paid for.

Keep the Spyware Doctor - It is a good program and will offer you decent "real time" protection.

If you want a good "all in one" solution and you don't mind spending a bit of cash, Kaspersky offers an excellent security suite:
http://www.kaspersky.com/kaspersky_internet_security

If you want to go the free route, install the AV / Firewall combo from Comodo. This would probably be the best free option.

-- You'll need to go into Add/Remove Programs and uninstall all other current Anti-Virus & Anti-Spyware tools. You might want to keep MBAM on hand for "on-demand" scanning. Just update it every three weeks or so and run the Quick Scan. Or, do this whenever you feel it necessary....

-- I also suggest purchasing and external hard drive such as this one to back up your important data, music, pictures, etc....
A very good thing to do in the event of an un-recoverable malware infestation.....

Let's Reset the Winlogon Shell value back to explorer.exe:
Please download FixMe.reg to a convenient location and DoubleClick on it to run it. Allow it to merge into the registry.
Reboot and see if all is running as it should be.

Let me know how things shake out - If you have any more questions or you want me to clarify anything, just ask.

Cheers :)
PP

[Kenney]

Happy Wednesday PP,

Hey, based off your name, is it safe to say you're a Philadelphia Phillies fan. Well, if so, you should be a happy camper right now with the win today.

Ok, I appreciate your suggestions on protection programs. I will look into each one and try to get some protection so this thing hopefully won't happening again...but you never know with all the viruses out there.

Also I imported fixme.reg into my registry and rebooted. Everything seems to be working fine now. I continue to get an error message on some anti virus program I ran when I first got the virus (pareto logic...or something like that). It comes up occasionally saying its unable to run for various reasons. I just click ok, and it has never given me any further problems.

I think I'm in good shape. I'll wait for you to give me the thumbs up before getting too confident. But if you have any further suggestions, please let me know.

Thanks again for all your help.

K

[PhilliePhan]

Well, if so, you should be a happy camper right now with the win today.

Oh, yeah - The first game in a best-of-five is always important! Plus, it goes a long way to erasing memories of the Rockies sweeping them in '07.....

I will look into each one and try to get some protection so this thing hopefully won't happening again...

The sooner the better!

I suggest downloading Comodo (linked before) and Spyware Blaster:
http://www.javacoolsoftware.com/spywareblaster.html

Uninstall ALL your other AV / Anti-spy apps except for Spyware Doctor and MBAM.

Your ideal setup should look like this:
Comodo -- For AV and Firewall
Spyware Doctor -- For "Real-Time" protection
MBAM -- For "On Demand" scanning, as necessary
Spyware Blaster -- For added protection from "Drive-by" downloads. Works similarly to SpyBotSD's "immunize" feature.

Keep all of these UP TO DATE with builds and definitions - Very important!

Uninstall all other unneeded protection so they do not come into conflict with the ones listed above.

Also, keep your Windows up to date with patches, etc... via Windows Updates - This is your first line of protection!

I think I'm in good shape. I'll wait for you to give me the thumbs up before getting too confident. But if you have any further suggestions, please let me know.

Definitely look into an external hard drive to back up your data!

As I mentioned, infections such as the one you had can leave the system unstable. The next time might not be recoverable....

Thanks again for all your help.

You're welcome!
I think you can mark this one as "solved!"

Best :)
PP