Anybody feel like helping a noob.

[levi]

I don't know the name of the infection.
I installed and ran AVG free...which picked up a bunch of stuff, but didn't solve the problem.
I'll stay tuned for more help.

BTW.  It's almost as if this problem disabled certain features in windows....Which I do not know how to fix.
Like I said....Everything works perfect in my guest account. (save restore)
But I can't right click on anything while using IE. However...Right click works fine in Fire fox.


Still....Right click doesn't work on my desktop at all. I'm stumped.  

[unlovedwarrior]

have you tried to restore it to see what it does

[levi]

Restore doesn't seem to work. I get that same error...as the picture provided.
I'm stumped.


I guess a format is in my future. *censored*.  [smiley=angry.gif]
Thanks for the help dude. I'll check back tommorow...incase others have an idea.

If not...I'll let ya know about the clean install.  [smiley=angry.gif]

[unlovedwarrior]

k srry remember to back up ur stuff

[GX1_Man]

A format and reinstall is not necessarily a bad thing. Think of all the other problems you will correct as well.  

I guess you don't need the speech about warez being laced with virii and other nasties. Download at your own risk. Protection is important but you may want to invest in an imaging program. I think you will be reloading a lot.

[JPH]

Hi levi,

GX1_Man is right, a format and reinstall is not a bad thing and it will fix any other problems that you might have. However, if reinstalling Windows simply isn't an option for you....

Copy and paste this into notepad and save it as fix.reg

Code: [Select]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun"=dword:00000000
"NoViewContextMenu"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=dword:00000000
"DisableSR"=dword:00000000

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserContextMenu"=dword:00000000
Next double click this new reg file to import this information into the registry.
After the info has been successfully imported you will need to reboot for the settings to take effect.

This should fix the Run prompt, Right-Click and System Restore issues you're having. As for MSConfig not working I need you to better clarify what you mean since it appears to be present and in the correct path. Also please rename HiJackThis.exe to HJT2K6.exe and then post a new and complete HJT log.

- JPH

[unlovedwarrior]

see told u

[patio]

A legal version of XP does NOT come on 2 CD's...

[GX1_Man]

Warez on top of warez. And he wonders why he has problems.  

I think the moment that machine gets legitimate software on it all of these problems would be history.  

[levi]

Sorry I took so long getting back. It's been a crazy weekend.

Anyway. Thanks for the reply, JPH. I'm about to try your method right now.

A legal version of XP does NOT come on 2 CD's...

My version of XP is legal. But there are shades of grey in there. lol. As I already mentioned, it's a educational copy. It does come on two disks, but it's not for resale...anywhere. You can only purchase it at the school. And you have to be a registered student to buy it. I think it cost around $18 US. And like I said....I lost disk one. Which has the entire OS on it. Disk two has tutorials and a bunch of other crap.
Geez..... Why would I come to a forum asking for help, then try to deceive any of you? I'm not built that way. And yes...I have learned my lesson when it comes to warez. I'm not going to mess with stuff that I don't understand.

Anyway. Let's try to fix my PC. lol.

OH...Here is a picture of disk two. Sorry about the quality. I couldn't be arsed to take another. But I will if you need further proof.

[levi]

Hi levi,

GX1_Man is right, a format and reinstall is not a bad thing and it will fix any other problems that you might have. However, if reinstalling Windows simply isn't an option for you....

Copy and paste this into notepad and save it as fix.reg

Code: [Select]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun"=dword:00000000
"NoViewContextMenu"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=dword:00000000
"DisableSR"=dword:00000000

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserContextMenu"=dword:00000000
Next double click this new reg file to import this information into the registry.
After the info has been successfully imported you will need to reboot for the settings to take effect.

This should fix the Run prompt, Right-Click and System Restore issues you're having. As for MSConfig not working I need you to better clarify what you mean since it appears to be present and in the correct path. Also please rename HiJackThis.exe to HJT2K6.exe and then post a new and complete HJT log.

- JPH

I followed your instructions. I copied the info to notepad. I saved it as fix.reg
I then double clicked it. The notepad file opened, but didn't seem to do anything. Am I missing something. Or is supposed to do that until I reboot? Sorry for being lame. I'm really new to this, and trying to learn from you.
Thanks in advance. [smiley=cool.gif]

PS. Msconfig problem: When I go to Run, type msconfig, I get an error. Windows can not find msconfig. That never happened before.

[levi]

Updated HJT log.
I re-named the .exe file as you instructed.

Logfile of HijackThis v1.99.1
Scan saved at 12:34:14 PM, on 10/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Documents and Settings\johnny\Desktop\Desktop items\hijackthis\HJT2K6.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: dlcg_device -   - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

[JPH]

You say that when you go to Run and type msconfig you get an error. I was under the impression that you lost the RUN prompt? Well either way applying the NoRun fix won't hurt anything. About the reg file, it sounds like it is still a txt file. You probably have Windows set to hide file extensions for known file types, which means it's probably actually named fix.reg.txt. You can open any folder and go to Tools > Folder Options > View and UNcheck "Hide extensions for known file types" then click Apply. Then you can make sure it is actually named fix.reg it should look like this if reg files are correctly associated:



Here is an updated version that will also fix MSConfig if it is still present in the correct path:

Code: [Select]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun"=dword:00000000
"NoViewContextMenu"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=dword:00000000
"DisableSR"=dword:00000000

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserContextMenu"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSCONFIG.EXE]
@="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe"
I will also attach a copy of the reg file to this post in case you don't feel like messing with the hide extensions setting. Just unzip the reg file to the desktop and either double-click it or right click it and choose Merge. Then after it has been imported successfully, reboot.

Your HJT log looks clean.

- JPH

[patio]

And no matter what pictures you post that is not an XP CD...

[chriscool9]

And no matter what pictures you post that is not an XP CD...

He did say it was an educational copy...
Maybe thats how they come? But yea i see what you mean, they usually come on one disk...


Chris