Jump to content
Sign in to follow this  
Martin-P

Icons disappear

Recommended Posts

Save this text from the code box as a .REG file and then double-click on it and run it.

Then reboot your computer and run Malwarebytes and go to the UPDATE tab and update the program.

Then do a Quick Scan and reboot the computer again.

After the reboot run another HJT scan only and post back both of those logs as well as let me know if things appear okay now.

REGEDIT4


[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}]
@="IShellFolderBand"

[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,48,00,\
45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe"

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2\]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU\]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop\]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\BarSize\]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoBandCustomize"=dword:00000000
"NoMovingBands"=dword:00000000
"NoCloseDragDropBands"=dword:00000000
"NoSetTaskbar"=dword:00000000
"NoToolbarsOnTaskbar"=dword:00000000
"NoSaveSettings"=dword:00000000
"NoToolbarsOnTaskbar"=dword:00000000
"NoSetTaskbar"=dword:00000000
"NoActiveDesktop"=dword:00000000
"ClassicShell"=dword:00000000
"LockTaskbar"=dword:00000000
"NoTrayContextMenu"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoCloseDragDropBands"=dword:00000000
"NoMovingBands"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\]
"BarSize"=-
"Media Band"=""

If you need more information on how to save and run this as a .REG file please let me know.

Share this post


Link to post
Share on other sites
Save this text from the code box as a .REG file and then double-click on it and run it.

Then reboot your computer and run Malwarebytes and go to the UPDATE tab and update the program.

Then do a Quick Scan and reboot the computer again.

After the reboot run another HJT scan only and post back both of those logs as well as let me know if things appear okay now.

REGEDIT4

[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}]

@="IShellFolderBand"

[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}\InProcServer32]

@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,48,00,\

45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00

"ThreadingModel"="Apartment"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoSaveSettings"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"SystemTray"="SysTray.Exe"

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2\]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU\]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop\]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\BarSize\]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoBandCustomize"=dword:00000000

"NoMovingBands"=dword:00000000

"NoCloseDragDropBands"=dword:00000000

"NoSetTaskbar"=dword:00000000

"NoToolbarsOnTaskbar"=dword:00000000

"NoSaveSettings"=dword:00000000

"NoToolbarsOnTaskbar"=dword:00000000

"NoSetTaskbar"=dword:00000000

"NoActiveDesktop"=dword:00000000

"ClassicShell"=dword:00000000

"LockTaskbar"=dword:00000000

"NoTrayContextMenu"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoCloseDragDropBands"=dword:00000000

"NoMovingBands"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\]

"BarSize"=-

"Media Band"=""

If you need more information on how to save and run this as a .REG file please let me know.

Yes. please tell my how I save and run a .reg file

Share this post


Link to post
Share on other sites

Yes. please tell my how I save and run a .reg file
Save this text from the code box as a .REG file and then double-click on it and run it.

Share this post


Link to post
Share on other sites

Start NOTEPAD and copy the text from the CODE box into the new blank Notepad document.

Then save it on your desktop as "RemovePolicies.reg" don't forget to keep the " quote marks in there so that it is saved as .REG and not as .TXT

Then find the new saved file on your desktop and double-click on it and say yes to import the settings to the Registry. Then reboot your computer.

Share this post


Link to post
Share on other sites

The registry file will attempt to remove any policies that might have been set by Malware that try to block you from running certain applications.

By both logs I mean a new MALWAREBYTES Log, then reboot, Then a new HJT log so that I can see what's going on.

Then also let me know how the box is running after these fixes and if or what issue you may still be having.

Share this post


Link to post
Share on other sites

Okay well at this time the only item left in the logs that I see that you might want to review is this one

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

I would open the Registry and browse to this location HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions

and post back what you find there. Very unlikely this key should be there unless maybe one of the applications you use for protection is using it and not Malware.

This link will give you more information on what this key is used for. Internet Explorer Restrictions

.

Share this post


Link to post
Share on other sites
Okay well at this time the only item left in the logs that I see that you might want to review is this one

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

I would open the Registry and browse to this location HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions

and post back what you find there. Very unlikely this key should be there unless maybe one of the applications you use for protection is using it and not Malware.

This link will give you more information on what this key is used for. Internet Explorer Restrictions

.

I have file named NObrowseroptions

Share this post


Link to post
Share on other sites

Is there a 1 or a 0 in it?

Basically you can delete that key. I see no reason for it to be there on a home system that you control.

Is there anything else going on with the box to indicate any type of infection?

Share this post


Link to post
Share on other sites

You can delete the key (just make sure it's only that key).

Yes you can delete the REG file you created.

At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore-WINDOWS XP

This is a good time to clear your existing system restore points and establish a new clean restore point:

Turn off System Restore

  • On the Desktop, right-click My Computer.
  • Click Properties.

  • Click the System Restore tab.

  • Check Turn off System Restore.

  • Click Apply, and then click OK.

  • Reboot.

Turn ON System Restore

  • On the Desktop, right-click My Computer.
  • Click Properties.

  • Click the System Restore tab.

  • UN-Check *Turn off System Restore*.

  • Click Apply, and then click OK.

This will remove all restore points except the new one you just created.

Here are some free programs I recommend that could help you improve your computer's security.

Spybot Search and Destroy 1.5.2

Download it from
here
. Just choose a mirror and off you go.

Find here the tutorial on how to use Spybot properly
here

Install SpyWare Blaster 4.1

Download it from
here

Find here the tutorial on how to use Spyware Blaster
here

Install WinPatrol

Download it from
here

Here you can find information about how WinPatrol works
here

Install FireTrust SiteHound

You can find information and download it from
here

Install MVPS Hosts File

from here
or
hpHosts
from here:
hpHosts for your protection...

The MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.

You can find a tutorial here :
http://www.mvps.org/winhelp2002/hosts.htm

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

You can use one of these sites to check if any updates are needed for your pc.

Visit Microsoft often to get the latest updates for your computer.

The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must. I recommend
Online Armor Free

A little outdated but good reading on

how to prevent Malware

Keep safe online and happy surfing.

Since this issue is resolved I will soon close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.

The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you
Fully Understand

how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting
Pre- HJT Post Instructions

Also don't forget that we offer
FREE
assistance with General PC questions and repair here
PC Help

If you're pleased with the product
Malwarebytes
and the service provided you, please let your friends, family, and co-workers know.
http://www.malwarebytes.org

.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.