Icons disappear

[Martin-P]

My icons down by the clock disappears after reboot, even after choose to have them always visible

My computer was infected with virus but they should had been removed.

I

hijackthis.txt

hijackthis.txt

[AdvancedSetup]

Save this text from the code box as a .REG file and then double-click on it and run it.

Then reboot your computer and run Malwarebytes and go to the UPDATE tab and update the program.

Then do a Quick Scan and reboot the computer again.

After the reboot run another HJT scan only and post back both of those logs as well as let me know if things appear okay now.

REGEDIT4


[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}]
@="IShellFolderBand"

[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,48,00,\
  45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe"

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2\]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU\]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop\]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\BarSize\]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoBandCustomize"=dword:00000000
"NoMovingBands"=dword:00000000
"NoCloseDragDropBands"=dword:00000000
"NoSetTaskbar"=dword:00000000
"NoToolbarsOnTaskbar"=dword:00000000
"NoSaveSettings"=dword:00000000
"NoToolbarsOnTaskbar"=dword:00000000
"NoSetTaskbar"=dword:00000000
"NoActiveDesktop"=dword:00000000
"ClassicShell"=dword:00000000
"LockTaskbar"=dword:00000000
"NoTrayContextMenu"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoCloseDragDropBands"=dword:00000000
"NoMovingBands"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\]
"BarSize"=-
"Media Band"=""

If you need more information on how to save and run this as a .REG file please let me know.

[Martin-P]

Save this text from the code box as a .REG file and then double-click on it and run it.

Then reboot your computer and run Malwarebytes and go to the UPDATE tab and update the program.

Then do a Quick Scan and reboot the computer again.

After the reboot run another HJT scan only and post back both of those logs as well as let me know if things appear okay now.

REGEDIT4

[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}]

@="IShellFolderBand"

[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}\InProcServer32]

@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,48,00,\

45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00

"ThreadingModel"="Apartment"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoSaveSettings"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"SystemTray"="SysTray.Exe"

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2\]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU\]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop\]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\BarSize\]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoBandCustomize"=dword:00000000

"NoMovingBands"=dword:00000000

"NoCloseDragDropBands"=dword:00000000

"NoSetTaskbar"=dword:00000000

"NoToolbarsOnTaskbar"=dword:00000000

"NoSaveSettings"=dword:00000000

"NoToolbarsOnTaskbar"=dword:00000000

"NoSetTaskbar"=dword:00000000

"NoActiveDesktop"=dword:00000000

"ClassicShell"=dword:00000000

"LockTaskbar"=dword:00000000

"NoTrayContextMenu"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoCloseDragDropBands"=dword:00000000

"NoMovingBands"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\]

"BarSize"=-

"Media Band"=""

If you need more information on how to save and run this as a .REG file please let me know.

Yes. please tell my how I save and run a .reg file

[gerardwil]

Yes. please tell my how I save and run a .reg file

Save this text from the code box as a .REG file and then double-click on it and run it.

[AdvancedSetup]

Start NOTEPAD and copy the text from the CODE box into the new blank Notepad document.

Then save it on your desktop as "RemovePolicies.reg" don't forget to keep the " quote marks in there so that it is saved as .REG and not as .TXT

Then find the new saved file on your desktop and double-click on it and say yes to import the settings to the Registry. Then reboot your computer.

[Martin-P]

You said I should post both logs, which other then the Hijackthis do you mean

[Martin-P]

By the way what will the reg file do

[AdvancedSetup]

The registry file will attempt to remove any policies that might have been set by Malware that try to block you from running certain applications.

By both logs I mean a new MALWAREBYTES Log, then reboot, Then a new HJT log so that I can see what's going on.

Then also let me know how the box is running after these fixes and if or what issue you may still be having.

[Martin-P]

All done Now, the icons has returned, All seems fine.

I tried to attach my HJT file but it didnt work so I

mbam_log_2008_09_29__09_34_46_.txt

mbam_log_2008_09_29__09_34_46_.txt

[AdvancedSetup]

Okay well at this time the only item left in the logs that I see that you might want to review is this one

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

I would open the Registry and browse to this location HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions

and post back what you find there. Very unlikely this key should be there unless maybe one of the applications you use for protection is using it and not Malware.

This link will give you more information on what this key is used for. Internet Explorer Restrictions

.

[Martin-P]

Okay well at this time the only item left in the logs that I see that you might want to review is this one

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

I would open the Registry and browse to this location HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions

and post back what you find there. Very unlikely this key should be there unless maybe one of the applications you use for protection is using it and not Malware.

This link will give you more information on what this key is used for. Internet Explorer Restrictions

.

I have file named NObrowseroptions

[AdvancedSetup]

Is there a 1 or a 0 in it?

Basically you can delete that key. I see no reason for it to be there on a home system that you control.

Is there anything else going on with the box to indicate any type of infection?

[Martin-P]

It

[AdvancedSetup]

You can delete the key (just make sure it's only that key).

Yes you can delete the REG file you created.

At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore-WINDOWS XP

This is a good time to clear your existing system restore points and establish a new clean restore point:

Turn off System Restore

• On the Desktop, right-click My Computer.
• Click Properties.
  
  
• Click the System Restore tab.
  
  
• Check Turn off System Restore.
  
  
• Click Apply, and then click OK.
  
  
• Reboot.
  
  

Turn ON System Restore

• On the Desktop, right-click My Computer.
• Click Properties.
  
  
• Click the System Restore tab.
  
  
• UN-Check *Turn off System Restore*.
  
  
• Click Apply, and then click OK.
  
  

This will remove all restore points except the new one you just created.

Here are some free programs I recommend that could help you improve your computer's security.

Spybot Search and Destroy 1.5.2

Download it from

here

. Just choose a mirror and off you go.

Find here the tutorial on how to use Spybot properly

here

Install SpyWare Blaster 4.1

Download it from

here

Find here the tutorial on how to use Spyware Blaster

here

Install WinPatrol

Download it from

here

Here you can find information about how WinPatrol works

here

Install FireTrust SiteHound

You can find information and download it from

here

Install MVPS Hosts File

from here

or

hpHosts

from here:

hpHosts for your protection...

The MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.

You can find a tutorial here :

http://www.mvps.org/winhelp2002/hosts.htm

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

You can use one of these sites to check if any updates are needed for your pc.

Secunia Software Inspector

F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.

http://www.update.microsoft.com

The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must. I recommend

Online Armor Free

A little outdated but good reading on

how to prevent Malware

Keep safe online and happy surfing.

Since this issue is resolved I will soon close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.

The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you

Fully Understand

how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting

Pre- HJT Post Instructions

Also don't forget that we offer

FREE

assistance with General PC questions and repair here

PC Help

If you're pleased with the product

Malwarebytes

and the service provided you, please let your friends, family, and co-workers know.

http://www.malwarebytes.org

.