Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Desktop icons and taskbar disappear  (Read 11704 times)

0 Members and 1 Guest are viewing this topic.

powerlight

    Topic Starter


    Rookie

    Thanked: 1
    Desktop icons and taskbar disappear
    « on: March 15, 2008, 06:15:53 PM »
    Hi there,

    Yesterday, my Nod32 detected the items below and took care of them. However, now my desktop icons and taskbar disappear about every 20 seconds or so as if there is something trying to initialize. Then they disappear completely and I am left with task manager as the only way to navigate around my PC.

    *http://adxanet.net/snapsnet.exe   
    a variant of Win32/TrojanDownloader.VB.AW trojan   
    Threat was detected upon access to web by the application: C:\Program Files\Internet Explorer\iexplore.exe.

    *http://bsa.safetydownload.com/trustedantivirus.com/TrustedAntivirus/install_en.cab
    Win32/Adware.AVSystemCare application
    Threat was detected upon access to web by the application: C:\WINDOWS\system32\mshta.exe.

    *C:\WINDOWS\TEMP\PK2E3.tmp   
    Win32/Adware.AVSystemCare application   
    Event occurred on a file modified by the application: C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe.

    *C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ZI1B3MWX\install_en[1].exe   
    Win32/Adware.AVSystemCare application   
    Event occurred on a new file created by the application: C:\Program Files\Internet Explorer\iexplore.exe.

    *C:\DOCUME~1\Owner\LOCALS~1\Temp\removalfile.bat
    Win32/Adware.Virtumonde application   
    Event occurred on a new file created by the application: C:\DOCUME~1\Owner\LOCALS~1\Temp\rasesnet.exe.

    *http://adxanet.net/yazzsnet.exe   
    probably a variant of Win32/TrojanDownloader.PurityScan trojan   
    Threat was detected upon access to web by the application: C:\WINDOWS\system32\mshta.exe.

    *C:\DOCUME~1\Owner\LOCALS~1\Temp\removalfile.bat
    Win32/Adware.Virtumonde application   
    Event occurred on a new file created by the application: C:\DOCUME~1\Owner\LOCALS~1\Temp\rasesnet.exe.

    *http://adxanet.net/snapsnet.exe   
    a variant of Win32/TrojanDownloader.VB.AW trojan   
    Threat was detected upon access to web by the application: C:\WINDOWS\system32\mshta.exe.


    I followed another post with a similar problem and installed HiJackThis and CCleaner. Didn't want to go any further without guidance. Help please!

    I have a frankenstein PC (assembled by a friend)
    Pentium 4 2.8
    XP (sp2)
    Nod32 anti-virus
    McAfee Firewall (anti-virus not enabled)

    [recovering space - attachment deleted by admin]
    « Last Edit: March 17, 2008, 04:29:47 AM by powerlight »

    Broni


      Mastermind
    • Kraków my love :)
    • Thanked: 614
      • Computer Help Forum
    • Computer: Specs
    • Experience: Experienced
    • OS: Windows 8
    Re: Desktop icons and taskbar disappear
    « Reply #1 on: March 15, 2008, 08:14:00 PM »
    Is University of New Brunswick your ISP?

    Broni


      Mastermind
    • Kraków my love :)
    • Thanked: 614
      • Computer Help Forum
    • Computer: Specs
    • Experience: Experienced
    • OS: Windows 8
    Re: Desktop icons and taskbar disappear
    « Reply #2 on: March 15, 2008, 08:33:56 PM »
    I don't see anything malicious in HJT log.

    Try to create new profile, and see, if your desktop is back.

    powerlight

      Topic Starter


      Rookie

      Thanked: 1
      Re: Desktop icons and taskbar disappear
      « Reply #3 on: March 16, 2008, 09:18:09 AM »
      No, The University of New Brunswick isn't my ISP. I'm with Aliant. I'll try creating another profile and see if that works.
       
      OK!!! New profile added. The icons do not disappear either. That's good.

      Should I run the CCleaner at this point? HJT again?


      My Icons just started disappearing on this new account too (about 5 mins after it was created.) Argh...
      « Last Edit: March 16, 2008, 11:17:16 AM by powerlight »

      Broni


        Mastermind
      • Kraków my love :)
      • Thanked: 614
        • Computer Help Forum
      • Computer: Specs
      • Experience: Experienced
      • OS: Windows 8
      Re: Desktop icons and taskbar disappear
      « Reply #4 on: March 16, 2008, 12:20:53 PM »
      Print these instructions out.

      1. Download SUPERAntiSpyware Free for Home Users:
      http://www.superantispyware.com/

          * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
          * An icon will be created on your desktop. Double-click that icon to launch the program.
          * If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
          * Close SUPERAntiSpyware.

      Restart computer in Safe Mode.
      To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen

          * Open SUPERAntiSpyware.
          * Under "Configuration and Preferences", click the Preferences button.
          * Click the Scanning Control tab.
          * Under Scanner Options make sure the following are checked (leave all others unchecked):
                o Close browsers before scanning.
                o Scan for tracking cookies.
                o Terminate memory threats before quarantining.
          * Click the "Close" button to leave the control center screen.
          * Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
          * On the left, make sure you check C:\Fixed Drive.
          * On the right, under "Complete Scan", choose Perform Complete Scan.
          * Click "Next" to start the scan. Please be patient while it scans your computer.
          * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
          * Make sure everything has a checkmark next to it and click "Next".
          * A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
          * If asked if you want to reboot, click "Yes".
          * To retrieve the removal information after reboot, launch SUPERAntispyware again.
                o Click Preferences, then click the Statistics/Logs tab.
                o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
                o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
                o Please copy and paste the Scan Log results in your next reply.
          * Click Close to exit the program.
      Post SUPERAntiSpyware log.

      RESTART COMPUTER!

      2. Download Malwarebytes' Anti-Malware: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html to your desktop.

          * Double-click mbam-setup.exe and follow the prompts to install the program.
          * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
          * If an update is found, it will download and install the latest version.
          * Once the program has loaded, select Perform full scan, then click Scan.
          * When the scan is complete, click OK, then Show Results to view the results.
          * Be sure that everything is checked, and click Remove Selected.
          * When completed, a log will open in Notepad.
          * Post the log back here.

      The log can also be found here:
      C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
      Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

      RESTART COMPUTER!

      3. Post new HijackThis log.

      powerlight

        Topic Starter


        Rookie

        Thanked: 1
        Re: Desktop icons and taskbar disappear
        « Reply #5 on: March 17, 2008, 04:29:12 AM »
        Wow! That took a while. Here is my SUPERAntiSpyware Scan Log.
        I had to restart in "normal" mode in order to get my internet connection to work.
        I'll restart in safe mode and follw steps 2 & 3.

        Thanks so much for the help!

        PS I couldn't post the entire log because it was too long, so I deleted the Adware Tracking Cookies section and have included the entire log as an attachment in case it's useful...


        SUPERAntiSpyware Scan Log
        http://www.superantispyware.com

        Generated 03/17/2008 at 00:22 AM

        Application Version : 4.0.1154

        Core Rules Database Version : 3420
        Trace Rules Database Version: 1412

        Scan type       : Complete Scan
        Total Scan Time : 03:40:48

        Memory items scanned      : 152
        Memory threats detected   : 1
        Registry items scanned    : 6208
        Registry threats detected : 22
        File items scanned        : 65427
        File threats detected     : 157

        Adware.Vundo Variant/Resident...

           [info removed]

           C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\KP4N8NO3\i701_bg4[1].jpg


        [recovering space - attachment deleted by admin]
        « Last Edit: May 19, 2009, 07:41:56 PM by powerlight »

        powerlight

          Topic Starter


          Rookie

          Thanked: 1
          Re: Desktop icons and taskbar disappear
          « Reply #6 on: March 17, 2008, 09:19:42 AM »
          OK... Step 2 complete. Here is the Malwarebytes log... Next up, HJT...


          Malwarebytes' Anti-Malware 1.08
          Database version: 498

          Scan type: Full Scan (A:\|C:\|)
          Objects scanned: 98785
          Time elapsed: 3 hour(s), 16 minute(s), 30 second(s)

          Memory Processes Infected: 0
          Memory Modules Infected: 0
          Registry Keys Infected: 1
          Registry Values Infected: 0
          Registry Data Items Infected: 0
          Folders Infected: 0
          Files Infected: 1

          Memory Processes Infected:
          (No malicious items detected)

          Memory Modules Infected:
          (No malicious items detected)

          Registry Keys Infected:
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

          Registry Values Infected:
          (No malicious items detected)

          Registry Data Items Infected:
          (No malicious items detected)

          Folders Infected:
          (No malicious items detected)

          Files Infected:
          C:\WINDOWS\system32\rqrpmkj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

          powerlight

            Topic Starter


            Rookie

            Thanked: 1
            Re: Desktop icons and taskbar disappear
            « Reply #7 on: March 17, 2008, 09:30:30 AM »
            And finally here is the most recent HJT log. Before running any of the apps you mentioned above I booted in safe mode, then "unsafed" to post them here one at a time.

            I can't tell you how much I appreciate this. A HUGE help...


            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 12:20:43 PM, on 3/17/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
            Boot mode: Safe mode

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\SYSTEM32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cbc.ca/news/
            O2 - BHO:

            [info removed]

            O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe

            --
            End of file - 5054 bytes
            « Last Edit: May 19, 2009, 07:43:03 PM by powerlight »

            Broni


              Mastermind
            • Kraków my love :)
            • Thanked: 614
              • Computer Help Forum
            • Computer: Specs
            • Experience: Experienced
            • OS: Windows 8
            Re: Desktop icons and taskbar disappear
            « Reply #8 on: March 17, 2008, 10:07:44 AM »
            You're welcome :)

            *** I can see only McAfee firewall part running. What's the story about McAfee antivirus part? Disabled?
            I can also see some Eset antivirus entry. I need some clarification here.

            *** You need to update your Java:
            http://java.sun.com/javase/downloads/index.jsp
            #4 - Java Runtime Environment (JRE) 6 Update 5
            Uninstall all previous versions of Java through Add\Remove.

            1. Print this post out, since you won't have an access to it, at some point.

            2. Close all windows, except for HijackThis.

            3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with *), no actual program will be removed):

            - O2 - BHO: (no name) - {F5E08107-DBAE-44BC-A893-962E66B65A3B} - C:\WINDOWS\system32\awtqq.dll (file missing)
            - *O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
            - *O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\VistaCodecPack\QT\qttask.exe" -atboottime
            - *O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Aliant\NETASS~1\SMARTB~1\MotiveSB.exe
            - *O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
            - *O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
            - *O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
            - *O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
            - *O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
            - O20 - Winlogon Notify: byxwvwt - byxwvwt.dll (file missing)


            4. Click on "Fix checked" button.

            5. Turn off System Restore:

            - Windows XP:
               1. Click Start.
               2. Right-click the My Computer icon, and then click Properties.
               3. Click the System Restore tab.
               4. Check "Turn off System Restore".
               5. Click Apply.   
               6.  When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
               7. Click OK.
            - Windows Vista:
               1. Click Start.
               2. Right-click the Computer icon, and then click Properties.
               3. Click on System Protection under the Tasks column on the left side
               4. Click on Continue on the "User Account Control" window that pops up
               5. Under the System Protection tab, find Available Disks
               6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
               7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
               8. Click OK

            6. Restart in Normal Mode.

            7. Turn System Restore on.

            8. Post new HijackThis log.

            powerlight

              Topic Starter


              Rookie

              Thanked: 1
              Re: Desktop icons and taskbar disappear
              « Reply #9 on: March 17, 2008, 01:31:28 PM »

              *** I can see only McAfee firewall part running. What's the story about McAfee antivirus part? Disabled?
              I can also see some Eset antivirus entry. I need some clarification here.


              That's right, I'm using McAfee firewall with the Antivirus disabled and NOD 32 as my anitvirus.

              I'll run through the steps above and post the results....

              Broni


                Mastermind
              • Kraków my love :)
              • Thanked: 614
                • Computer Help Forum
              • Computer: Specs
              • Experience: Experienced
              • OS: Windows 8
              Re: Desktop icons and taskbar disappear
              « Reply #10 on: March 17, 2008, 01:37:09 PM »
              Quote
              I'm using McAfee firewall with the Antivirus disabled and NOD 32 as my anitvirus.
              Thank you :)

              powerlight

                Topic Starter


                Rookie

                Thanked: 1
                Re: Desktop icons and taskbar disappear
                « Reply #11 on: March 17, 2008, 02:42:20 PM »
                Just to be sure:
                1. I uninstalled then updated my Java;
                2. I restarted in Safe Mode, ran HJT and turned off system restore
                3. Restarted in Normal mode, turned on system restore and ran HJT (posted below)

                Was this correct?


                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 5:37:20 PM, on 3/17/2008
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\SYSTEM32\winlogon.exe
                C

                [info removed]

                Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe

                --
                End of file - 5314 bytes


                « Last Edit: May 19, 2009, 07:43:53 PM by powerlight »

                Broni


                  Mastermind
                • Kraków my love :)
                • Thanked: 614
                  • Computer Help Forum
                • Computer: Specs
                • Experience: Experienced
                • OS: Windows 8
                Re: Desktop icons and taskbar disappear
                « Reply #12 on: March 17, 2008, 04:20:52 PM »
                The log is clean.

                Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version.
                Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html, and run CCleaner

                Let me know, afterwards, how your computer is doing.

                powerlight

                  Topic Starter


                  Rookie

                  Thanked: 1
                  Re: Desktop icons and taskbar disappear
                  « Reply #13 on: March 17, 2008, 04:49:39 PM »
                  I ran CCleaner and it did its thing. However, just after I started it my NOD32 caught the following:

                  Real-time file system protection
                     
                  C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\4HIZOXQR\CA9SKJ51   

                  Win32/Adware.Virtumonde.FP application
                     
                  cleaned by deleting - quarantined   

                  NT AUTHORITY\SYSTEM
                     
                  Event occurred during an attempt to access the file by the application: C:\Program Files\CCleaner\CCleaner.exe.

                  Broni


                    Mastermind
                  • Kraków my love :)
                  • Thanked: 614
                    • Computer Help Forum
                  • Computer: Specs
                  • Experience: Experienced
                  • OS: Windows 8
                  Re: Desktop icons and taskbar disappear
                  « Reply #14 on: March 17, 2008, 05:07:55 PM »
                  Did CCleaner finish its job?