Can't drag/copy/paste files and folders and other problems

[Alastair70]

Hi, I have various problems all of a sudden which I hope u guys can help me.

1.) I cant copy/paste files or folders or anything, I've tried right click copy, and when I right click and wanted to paste, the 'paste' is grayed out and im not able to paste anything. I've also tried ctrl-c ctrl-v which doesnt work too. And I cant drag the files or folders too.

2.) I cant open my internet explorer, when I click internet explorer, the window just open and close immediately in less than a sec.

3.) when I minimise my windows for any applications, it doesnt appear on the taskbar, the taskbar is always empty. I need to alt-tab to get from windows to windows.


I've run SDFIX & combofix and have attached the reports along this the hijackthis report.

All of my problems started after installing service pack 3 and I now have the taskbar back with start button (which works) but when I open a folder or program they open but nothing appears on the taskbar.

I have tried to uninstall service pack 3 but it says it can't find the file.

IE when clicked flashes on for a second then disappears

Please Help as I've spent hours reading up on my various problems. I can normally fix most problems well normally SDFix & combofix sort them out but this time to no avail
The HijackThis report is after running Combofix and then SDfix in that order

Thanks in advance
Alastair

 

[Bobbye]

All of my problems started after installing service pack 3
I have tried to uninstall service pack 3 but it says it can't find the file.

Let's try this: Control Panel> Add/Remove Programs> CHECK 'show updates' at the top> look for KB936929 (this is SP3)> uninstall it. Reboot the system.

It looks like you might have Firefox set as the default browse and I see updates for IE7. Are you currently using Firefox? Which version? The HijackThis log states: "MSIE: Unable to get Internet Explorer version!"

If you want me to help you, we need to sort out some of the entries in the HijackThis log:

Remove bad HijackThis entries
• Run HijackThis
• Click on the System Scan Only button
• Put a check beside all of the items listed below (if present):

O8 - Extra context menu item: &Search - ?p=ZJ
O10 - Unknown file in Winsock LSP: c:\windows\system32\lspmlo.dll
(you picked this up on 2009-03-04 23:43 . 2009-03-05 00:37 27,136 --a------ c:\windows\system32\lspmlo.dll per per the Combofix log)

• Close all open windows and browsers/email, etc...
• Click on the "Fix Checked" button
• When completed, close the application.
Attach your logs using the paperclip button on the new reply toolbar =>

Then run Malwarebytes, SuperAntispyware and update and rescan with HijackThis. You will find the steps for this here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

You have skipped the first part and gone on to additional cleaning without it. we need to fix that.

Questions and Suggestions:
1. Combofix is showing a file was created with name 'devil'. Do you know what that is?
(2009-03-17 14:32 . 2009-03-17 14:50 <DIR> d-------- C:\devil)
2. I strongly suggest you check the following for removal. These kinds of sites and programs usually bring in a lot of junk. If OK, check all the following and include in the Fix Checked part of HijackThis. Then uninstall Pricepirates in Add/Remove Programs in the Control Panel.

C:\Program Files\Pricepirates
O8 - Extra context menu item: eBay - Home Page - C:\Program Files\Pricepirates\Pricepirates\SearchEbay.htm
O8 - Extra context menu item: eBay - My eBay - C:\Program Files\Pricepirates\Pricepirates\SearchEbaymein.htm
O8 - Extra context menu item: eBay - Powersearch - C:\Program Files\Pricepirates\Pricepirates\SearchEbaypower.htm
O8 - Extra context menu item: eBay - Start Search - C:\Program Files\Pricepirates\Pricepirates\SearchEbay.htm
O8 - Extra context menu item: Google - Search - C:\Program Files\Pricepirates\Pricepirates\SearchGoogle.htm
O8 - Extra context menu item: Google - Start Search - C:\Program Files\Pricepirates\Pricepirates\SearchGoogle.htm
O9 - Extra button: Pricepirates 3 - {350F4DA2-3886-4BB8-A1A8-D7F57B56DFFF} - C:\Program Files\Pricepirates\Pricepirates\preispiraten3ie.exe

3. I am not familiar with the following. Are you actively using this now?

O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://www.kontiki.ioko.com/bbcfn/kdx.cab
(With Secure Delivery you upload your product, configure a few options, and that's it. Secure Delivery handles payment processing, delivery, and your affiliate system for you.)

IF not, we will need to disable this Active X entry when you can get into Tools> Manage Add-ons in IE.-

 

[Alastair70]

Hi, Thanks for your help. I have done what you said with little effect let me explain.

When I click remove to Service pack 3 its starts the process, and then says "file not found" in add/remove programs it is only listed as Windows Service pack 3 and when I click more info it shows that it is KB936929

When removing the entrie you listed from HijackThis it came up with the following message.

HJT cannot repair 010 Winsock LSP entries you should use LSPFix for that

I downloaded it from where it suggested, ran it and it said I had no problems so no files or entries were removed.

I did previously run Malware before installing service Pack 3 and have attached the log, however whenever I try and run it now it says the following.

Runtime error 372
Failed to load control "vbalgrid" from "vbalsgrid6.ocx" Your version of vbalsgrid6.ocx may be outdated.

I tried to reinstall it and it comes up with the same error.

When I try and install SuperAntispyware I get the following message.

The windows installer service could not be accessed. This can occur if not installed correctly.

Firefox is installed & working, and allowing me to download from the net it is Version 3.0.7

So to sum up I've only been able to removed the entries from HJT except for the 1 stated, I can't install new software that uses Windows installer, and Malware has stopped working

Help!! please
Thanks
Alastair

I've also disabled the activex control you said to in Q3

 

[Bobbye]

I should have done this in the beginning> start at the beginning!

Please follow any steps that pertain to you such as running Malwarebytes, then SuperAntispyware, then new HijkackThis HERE.
UPDATE each first, attach logs for the three programs.

I wish you hadn't run Combofix and SDFix. I should have done this first. I'm going to get someone to look at the ComboFix report though because the Signcheck doesn't look right. And I don't write code. So if that needs to be done- write code for removals, I'll have someone do it.

The fact that HijackThis couldn't identify the IE version is also something we have to deal with. Hang on while I find another 'helper'.

 

[kritius]

Looking over now.

Ok,

• Click START then RUN
  
• Now type Combofix /u in the runbox and click OK
  
• 
  
  
• When shown the disclaimer, Select "2"
  

ComboFix should not be run in this manner and it is why we don't include it in the 8 steps, Continue doing them as Bobbye has said and if at a later date it can be re downloaded.

 

[Alastair70]

I did all the 8 steps except the superspyware before installing service pack 3. After installing it is when things went wrong and i used combo Fix & SDFix as i had used them on another computer when it had a virus and ccleaner & Malware didn't clean it.

I have removed Combofix as instructed

 

[Bobbye]

Thank you kritius.

Alastair, now please pick up the 8 Steps HERE:

You will be updating and scanning with HijackThis again AFTER finishing with Malwarebytes and SuperAntispyware. Please attach the logs from all three programs.

Please do not run any other programs unless we instruct you to.

 

[Alastair70]

did previously run Malware before installing service Pack 3 however whenever i try and run it now it says the following.

"Runtime error 372"
"Failed to load control "vbalgrid" from "vbalsgrid6.ocx" Your version of vbalsgrid6.ocx may be outdated."

I tried to reinstall it and it comes up with the same error.

When i try and install SuperAntispyware i get the following message.

"The windows installer service could not be accessed. This can occur if not installed correctly."

any ideas???

 

[Bobbye]

Please give me time to eat lunch and do a few of those mundane things. I am after all, human!

 

[Alastair70]

do you think it would be worth doing a recovery install of windows, after i uninstall IE 7 first of coarse

 

[Bobbye]

Run this and uninstall all the current cleaning programs, then download as told and attach logs when through:

Download OTCleanIt HERE & save it to your desktop.

Double click on OTCleanIt.exe.
Click on CleanUp!.
It will go thorough the list and remove all of the tools it finds and then delete itself (requiring a reboot).
You will receive a prompt that it needs to restart the computer to remove the files>
Click Yes.
It will restart your computer automatically. If it doesn't, please restart your computer manually.

Then try downloading the cleaning programs again HERE

You have improperly run programs without instructions. There is a reason we have the cleaning program set up as we do. If you still get errors, give them to me.

I have never seen this message in the HijackThis log: MSIE: Unable to get Internet Explorer version!

 

[kritius]

I have never seen this message in the HijackThis log: MSIE: Unable to get Internet Explorer version!

Are you running Internet Explorer 8 beta?

 

[Bobbye]

Nice pickup kritius. Check the Combofix log for KB957055>> IE8 RC, KB957700>> IE8 Beta, KB949787 > IE8 Beta 2 and didn't find any. I see updates for IE7.

But I found the following:

2008-12-20 23:56 827904 044e0a4e9fe97c0fb9afe9c89e2a82e6 c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll
Security Update for Internet Explorer 8 Beta 2 for Windows XP (KB961260)

But then this, also in Combo log:

2008-10-16 20:24 827904 0d5b75171ff51775b630a431b6c667e8 c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll

For IE7: Article ID: 958215 - Last Review: February 13, 2009 - Revision: 2.0>> 10/16/08
MS08-073: >> Cumulative security update for Internet Explorer

So I am not sure what he has! May an install for IE8 beta, then uninstall that wasn't complete?

 

[Alastair70]

I ran OTCleanIt without any problems.

I have Avast

Downloaded, installed and ran Ccleaner twice, no problem.

Disabled Avast real time scanner

Downloaded Malware antibytes to desktop, and when i tried to install it got the "Runtime error372" as previously reported.

Downloaded SuperAntispyware and tried to install, and i get "The windows installer service could not be accessed. This can occur if you are in safe mode or if windows installer is not correctly installed"

When i go to check Java it says it's out of date so i open the update file, it downloads then when it is trying to install the windows installer error comes on screen, so able to install that also.

I've now downloaded and installed Hijack This and run it the report is attached.

I can open IE7 if i use the link that is located c:\windows\IE7 but not from the normal "program files " location

I haven't installed IE8 Beta, however i can't guarantee than my 15 yo son hasn't. I can't see any links to it on his profile, on under control panel.

one thing i have found. There is no remove button next to IE7 in control panel Add/remove programs

Is this of any help?

 

[Bobbye]

Alastair, have you made any changes in the Services in the Administrative Tools? Your HijackThis logs shows only a few running. While Services can be customized, certain one need to be on either Manual or Automatic and their Dependency Services also need to be running. If they have been Disabled and are needed, the system will have problems.

Boot into Safe Mode: Start> Run> services.msc>>
Please refer to Black Viper's site for the settings: Scroll down to the chart and set your Services in the SAFE settings. Check the Dependent Services.
http://www.blackviper.com/WinXP/servicecfg.htm

When you have finished, reboot. the necessary Services will start.

Please let me know your status after doing this.I'm not going to suggest anything else until I have this information.

 

[Alastair70]

Bobbye,

I haven't made any changes, although when i opened it their where no extended services just the standard tab. When i right clicked to select properties nothing opened.

I will refer to Black Vipers site now and report back shortly

Many thanks for all your help

Ok I tried to change the settings to "safe" manually in safe mode but couldn't as the properties tab wouldn't open, so i download the ready made patch from http://www.blackviper.com/WinXP/registry.htm and applied it in safe mode.

When i restarted although i can't still access properties in services they are all as suggested in Black Vipers list.

There is no change in status, i.e. can't copy or paste, can't open IE7, malware still give runtime error, and can't install SuperAntispyware due to windows installer not working.

 

[Bobbye]

Does this path make any difference? Control Panel> Administrative Tools> Services.

Are you saying that you cannot right click on 'any' Service and get the drop-down menu with Properties?

 

[Alastair70]

I can open the window to display services, and i can right click and start or stop some services, however when i click on properties either on the right click menu or on the upper task bar nothing happens

 

[kimsland]

Download and run KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
(uncheck RelevantKnowledge during install, pic here: http://i42.tinypic.com/aloy8z.gif)

Now you have to accept a couple of times during install
And of course uncheck RelevantKnowledge (we don't want to install that)
And at the end of the install it opens the home site, just close it
Then Finish, and run it

select all options, and then select Start (make sure all Internet Browsers closed)
Take a note of what amount of Gigs of temp stuff was removed

Restart, and check Services again

 

[Alastair70]

ok downloaded & running however it didn't open up the home page it came up with a error message

Unable to execute file

ShellExecuteEx failed; code 2
The system cannot find the file specified,

I click ok
and it is running as i tyoe

 

[Alastair70]

ok it cleaned 2.9GB of stuff, i've rebooted and there is no change in services. No extended services and nothing happens when i click properties

Thanks for that kimsland, have you any idea how to get windows installer service working. I've worked wioth computers for 12yrs and never had anything like this before.When i download windows installer from microshit it says it won't work with SP3.

If only i could get copy/paste working i'd backup the stuff i need and format the bugger, but i can't and it has years worth of important stuff on it..

 

[kimsland]

Here's Windows Installer: http://go.microsoft.com/fwlink/?LinkId=120486

It's right at the bottom of the page called: WindowsXP-KB942288-v3-x86.exe

Try the Ultimate Boot CD for Windows to help backup your important data. The link also includes help installing Windows clean

 

[Alastair70]

it says "setup could not verify the integrity of the file update.inf. Make sure cryptographic service is running"

When i goto services the crypo is set to auto & when i right click start it says " could not start service on local computer"
"Error 1068: the dependency service or group failed to start"

Does this make any sense to you??

 

[Bobbye]

See if this will access the Properties:

Open the Services> Click on the first icon (after the Back & forward arrows) to 'show the console tree'> click to highlight a Service> hover mouse over the next icon until you see the word Properties> left click on the icon to show the Properties for the Service you have highlighted. This is not a drop-down menu- it is an icon specifically for Properties.

When I right click on a Service, I get the following drop-down:

Start- if Service is started, this will be greyed out
Stop- if Service is not started this will be greyed out
Pause- greyed out
Resume- greyed out
Restart- greyed out
All Tasks- has > for choices
Refresh- greyed out
Properties
Help

Do you get this drop down menu? If not, what choices do you have? Properties should be available through either the right click or by clicking on the Properties icon. I'm trying to figure out just what is missing.

 

[Alastair70]

bobbye, it doesn't matter which method i try to use to access services they both have the same reult. Nothing happens.

As previously posted i get the right click menu and can stop or start some services, properties is not grayed out but when i click on it nothing happens. This is the same when clicking the properties button on the top taskbar that you have just mentioned.

Yes i do get the above right click menu.

I hope this helps!