Folder/Window spam at Startup

[evilfantasy]

That didn't get it for some reason.

Go ahead and create the new account and backup your files. After that we will try to remove the startups.

[keyweez360]

You mean create a user on XP itself? I have another user account on here (Danny) so could I just backup my files on his desktop or something?

[evilfantasy]

Does the same thing happen when you log on to Danny?

[keyweez360]

Yes but I noticed it's to a much lesser degree. The only thing that pops up at startup on Danny is the "Start Menu" folder

[evilfantasy]

OK create the new user and see if it loads up correctly when you sign on.

How to create and configure user accounts in Windows XP

[keyweez360]

Created a new user called TestAccount and it behaved just like Danny -- folder "Start Menu" is the only thing that popped up at startup

[evilfantasy]

Lets try to repair your System Restore in case it's needed.

Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

Go to Start > Run and type notepad.exe then click OK

Copy and paste the text in the Quote box below to Notepad and save as fixme.reg to Your Desktop

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=dword:00000000
"DisableSR"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr]
"Type"=dword:00000002
"Start"=dword:00000000
"ErrorControl"=dword:00000001
"Tag"=dword:00000004
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\
  52,00,49,00,56,00,45,00,52,00,53,00,5c,00,73,00,72,00,2e,00,73,00,79,00,73,\
  00,00,00
"DisplayName"="System Restore Filter Driver"
"Group"="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Parameters]
"FirstRun"=dword:00000000
"DontBackup"=dword:00000000
"MachineGuid"="{EAAFAEEC-4AFE-42BE-83D9-C12FDD4942A6}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Enum]
"0"="Root\\LEGACY_SR\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalMachine\Software\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalMachine\Software\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=dword:00000000

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalMachine\Software\Policies\Microsoft\Windows NT\SystemRestore]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalMachine\Software\Policies\Microsoft\Windows NT\SystemRestore]

Locate fixme.reg on your Desktop and double-click it. Answer Yes when prompted to merge with the Registry.

Accept any warnings.

----------

Download to your desktop FixPolicies.exe, a self-extracting ZIP archive from HERE.

Double-click FixPolicies.exe.
Click the Install button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd
A black box will briefly appear and then close.
Restart the computer so the changes can take effect.


Any changes?

[keyweez360]

Did what you said. The only thing different is a new pop-up at startup. It's a notepad file called LuResult.txt and contains the text

Install Failed
16
The LiveUpdate install failed due to an internal error.

Which is weird, since I uninstalled LiveUpdate and all things Norton...But other than that, should I try to see if System Restore now works? I have a few system checkpoints from a few days before the problems arose.

[evilfantasy]

We will create a new Restore Point right now when we uninstall ComboFix.


• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.

• The above procedure will:
• Delete the following:
• ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

.
----------

Now lets try to remove all of those folders/files that are opening.

Log on to the account that has everything bad loading up on it. (be sure you have moved your files to another account before doing this)

Download OTMoveIt2 by OldTimer

• Save it to your desktop.

.
Note: If you are running on Vista, right-click on OTMoveIt2.exe and choose Run As Administrator.

• Double-click OTMoveIt2.exe to run it.
  
• Copy the lines in the codebox below.

Code: [Select]

[kill explorer]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Start Menu
C:\Documents and Settings\Owner.ANTHONY\Application Data
C:\Documents and Settings\Owner.ANTHONY\Cookies
C:\Documents and Settings\Owner.ANTHONY\Desktop
C:\Documents and Settings\Owner.ANTHONY\Favorites
C:\Documents and Settings\Owner.ANTHONY\Local Settings
C:\Documents and Settings\Owner.ANTHONY\LuResult.txt
C:\Documents and Settings\Owner.ANTHONY\My Documents
C:\Documents and Settings\Owner.ANTHONY\NetHood
C:\Documents and Settings\Owner.ANTHONY\ntuser.dat
C:\Documents and Settings\Owner.ANTHONY\ntuser.dat.LOG
C:\Documents and Settings\Owner.ANTHONY\ntuser.ini
C:\Documents and Settings\Owner.ANTHONY\PrintHood
C:\Documents and Settings\Owner.ANTHONY\Recent
C:\Documents and Settings\Owner.ANTHONY\SendTo
C:\Documents and Settings\Owner.ANTHONY\Start Menu
C:\Documents and Settings\Owner.ANTHONY\Templates
C:\Documents and Settings\Owner.ANTHONY\UserData
C:\Documents and Settings\Owner.ANTHONY\WINDOWS
C:\WINDOWS\system32\tmp.txt
C:\WINDOWS\SYSTEM32\tmp.reg
EmptyTemp
[start explorer]

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste

• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) and paste it in your next reply.
  
• Close OTMoveIt2

.
Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes. If not, reboot anyway.

[keyweez360]

Did what you said but forgot to grab the results for you before the computer restarted itself...

Anyways, on startup I still got the folders popping up. And a whole bunch of stuff is missing from my desktop/everywhere.

[evilfantasy]

Do a system restore to when you uninstalled combofix. I don't know what to think now.

I will do some googling but I'm out of ideas at this point.

[keyweez360]

Ok the system restore worked and most of the stuff is back, but My Documents and those other folders are now gone. There's nothing in My Pictures or any of that stuff

[keyweez360]

I just realized I skipped the part where you said to backup everything on another account.

Wow. Is there ANYTHING I can do to get it back?

[evilfantasy]

I mentioned it like 3 or 4 times...

I have a guide for file recovery here. Data Loss - Recovery & Prevention Might work.

[keyweez360]

Well, I think I'm SOL, which in turn means I'm dead. Apologies for being awful at following directions.