[Inactive] Programs are missing.( PC 1)

[bigglos716]

Hello,

I have a dell desktop and my programs will not show and all of my desktop icons are gone. I can not get on the internet to download HJT.
I am running windows XP

Thank You

[Hoov]

My name is Hoov and I will be helping you with your problem. I have also posted to your other thread, please read it in its entirety. You have been helped here before, so I am going to skip the preliminaries. Nothing has changed.

Is this your computer? Do you have access to another computer and a CD or thumbdrive so that you can move programs to the problem computer?

[bigglos716]

Yes this is my computer and i have access to another computer

[Hoov]

You can download these programs to another computer and the unhide you can run from a CD or thumbdrive. Malwarebytes' Anti-Malware needs to be installed though.

Download the following program to your desktop:

Unhide tool

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.
Please be patient as this may take several minutes to run, it will scan and fix all Hard drives on your system. You will see a new window with the drive being processed, typically C:\  as below:



Changing as the next drive is processed as below:



You will get a success alert at the end. Re-boot and see if your files are present.


Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
• Update Malwarebytes' Anti-Malware
  
• Launch Malwarebytes' Anti-Malware

• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

[bigglos716]

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7622

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

11/25/2011 6:52:12 PM
mbam-log-2011-11-25 (18-52-12).txt

Scan type: Quick scan
Objects scanned: 225603
Time elapsed: 13 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\Temp\0.15567705778373897.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\0.4996170979639385.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\0.6827944903887316.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\0.9098411431549683.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.

[Hoov]

Are the programs and desktop icons back?

We need to see some information about what is happening in your machine.  Please perform the following scan:

• Download DDS by sUBs from one of the following links.  Save it to your desktop.
  • DDS.scr
    
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explaination about the tool.  No input is needed, the scan is running.
• Notepad will open with the results.
• Please copy and paste both logs into your next response. You may need more than one response.
• Close the program window, and delete the program from your desktop.

Please note:  You may have to disable any script protection running if the scan fails to run.  After downloading the tool, disconnect from the internet and disable all antivirus protection.  Run the scan, enable your A/V and reconnect to the internet. 

Information on A/V control HERE

[bigglos716]

attach

[bigglos716]

dds

[bigglos716]

I could not copy and paste the logs in the reply. I attached them. I kept getting the forbidden error. Sorry for the confusion and delay.

I cannot get on the internet with PC1. The icons are back.

Thank You

[Hoov]

Click Start. click run, type: cmd, and press Enter
Type: netsh winsock reset, and then press the ENTER key.
Type: Exit and press ENTER.
Restart the computer.

Check to see if you can access the internet now.  If not run the instructions for ipconfig below

Open a command prompt (all programs > Accessories > Command Prompt) and type in
Ipconfig /all > ipconfig.txt and then hit enter. Then type in ipconfig.txt to open notepad with the log. Copy it and paste it in to your next response.


Also I need you to attach your event viewer logs using the instructions below.

I need you to go to the administration tools in XP. They are in the Control Panel. Open the Admin tools, then open the event viewer. Over on the left hand side and click on System. Then up at the top click on Action and then click on Save Events As, type in system as the file name,  make sure file type EVT is selected, and then navigate so it will save the file to your desktop, then click save. Over on the left hand side and click on Application. Then up at the top click on Action and then click on Save Events As, type in application as the file name,  make sure file type EVT is selected, and then navigate so it will save the file to your desktop, then click save. Zip them both up into a single zip file, post them back here in your next reply as attachments.

[bigglos716]

Thanks

Windows IP Configuration



An internal error occurred: The request is not supported.

 

Please contact Microsoft Product Support Services for further help.



Additional information: Unable to query host name.

[Hoov]

Well that tells me all the networking is turned off. Go to the control panel and then to the system control panel and then to the hardware tab. Then click on the device manager tab. Let me know if there are any devices with a red x or yellow exclamation point. Also look for the network devices and tell me if there are any.

[bigglos716]

Other Device has a yellow exclamation and question mark.

There is a network adapter that does not have a exclamation or question mark.

[Hoov]

Go to the control panel and then to network connections and try creating a new connection.

[bigglos716]

When I try this it says "Your broadband connection should already be configured"