Windows Explorer and desktop

[nogsmail]

I am trying to sort out a friends PC running XP Home but so far am baffled. after logining in in both normal and safe mode the start/taskbar flashes up and then disappears and I am left with only the background. I can get up the task manager and run most programs. I have cleaned the system as best I can with spy bot and adaware and both say the system is clean unfortunately I do not have access to the net from this pc and so cannot use any of the online checkers.

I have tried renaming shdocvw.dll but no better

sfc /sannow is difficult as it is an oem install I do not have the original install disk and the i386 directory is nearly 1gig so I can'nt create one

does anyone have any ideas?

many thanks

 

[Rik]

Does that system have norton on it? If so, see if you can uninstall it!

 

[nogsmail]

Thanks Rik

Norton was installed, have just uninstalled rebooted but no change

any other ideas

Thanks

 

[Rik]

Do as much as you can from the following. Just skip the things you can't do.

You need to have a read of this - If your system is infected. Read this before deciding whether to CLEAN or REFORMAT.

Then if you should wish to proceed with cleaning your system you need to go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT and AVG Antispyware logs as ATTACHMENTS into this thread, only after doing the above.


This thread is for the use of nogsmail only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[nogsmail]

back at last

Hi Rik

OK took some time but managed to run just about everything. The antispyware found nothing so I have only attached the hjt log.

once again many thanks for your help

 

[howard_hopkinso]

Hello and welcome to Techspot

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.


Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

UIUCU.EXE

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\AINEMC~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\DOCUME~1\AINEMC~1\LOCALS~1\Temp\UIUCU.EXE

Reboot into normal mode, and rehide your protected OS files.

Post a fresh HJT log. Let us know if you`re still having any problems.

Regards Howard :wave: :wave:

This thread is for the use of nogsmail only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[nogsmail]

Howard/Rik

Tried what Howard suggested, but still no change, attached is the latest HJT log

Thanks

Nigel

 

[howard_hopkinso]

Have HJT fix the following.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.0.0.1:80

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

Click the fix checked button. Close HJT and reboot your computer.

Download combofix.exe. Double click combofix.exe & follow the prompts. A window will open with a warning. Type "Y" (and Enter) to start the fix. When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log. Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Post an AVG Antispyware log as per the instructions in this thread HERE along with the combofix log.

This thread is for the use of nogsmail only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[nogsmail]

Howard

Combo log attached, avg found nothing

Nigel

 

[howard_hopkinso]

I can`t see anything wrong as in malware etc. Therefore, I think the problem is caused by corruption and not viruses etc. It might be prudent to consider a reformat and reinstall and see if that solves the problem.

Regards Howard

This thread is for the use of nogsmail only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[nogsmail]

Many thanks for your help Howard,

I was hoping not to have to do a re-install but it looks like we have exhausted everything else.

Once again many thanks

Nigel