Start menu, task bar & desktop icons all missing

Good. Delete ESET findings except QooBox and system volume information related ones. Those will be removed after ComboFix is uninstalled and system restore reseted.

Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.


THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis


Now lets uninstall ComboFix:
  • Click START then RUN
  • Now copy-paste Combofix /uninstall in the runbox and click OK



UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.


Download and run Secunia Personal Software Inspector (PSI) and fix its findings.


Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade :cool:
 
Hi,

Well, I fixed all the Secunia findings, updated internet explorer & windows, and all of my desktop it back (YAAAAAY), but the internet is running MUCH slower than before so I didn't reset my restore point or uninstall combofix in case you needed to have me do some more stuff.
 
Hi,

We can remove PCTools remaining if you're not going to reinstall it.

Disable Spybot's TeaTimer to make sure it won't interfere with fixes:
  • Run Spybot-S&D in Advanced Mode
  • If it is not already set to do this, go to the Mode menu
    select
    Advanced Mode
  • On the left hand side, click on Tools
  • Then click on the Resident icon in the list
  • Uncheck
    Resident TeaTimer
     and OK any prompts.
  • Restart your computer



Open notepad and copy/paste the text in the quotebox below into it:

Code: 
Driver::
PCTCore
pctDS
pctEFA
File::
c:\windows\system32\drivers\PCTCore.sys
c:\windows\system32\drivers\pctDS.sys
c:\windows\system32\drivers\pctEFA.sys
c:\windows\system32\drivers\pctgntdi.sys
c:\windows\system32\drivers\PCTAppEvent.sys
c:\windows\system32\drivers\pctplsg.sys
Folder::
c:\program files\common files\PC Tools
c:\docume~1\owner\applic~1\PC Tools
c:\docume~1\alluse~1\applic~1\PC Tools
f:\all files\Programs\PC Tools Security
DDS::
BHO: {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll
SecCenter::
{D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ISTray"=-
"PCTools FGuard"=-


Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

CFScriptB-4.gif


Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log + fresh dds logs.
 
During the combofix, the computer restarted on its own and when it rebooted it went to the blue screen error message. I tried starting in normal, safe mode, and last know working settings. each time it went to the blue error screen. I took a pic in case you needed to see it.
 
Hi,

Earlier logs indicate you have recovery console installed. Please follow these steps:

1. Restart your computer
2. Before Windows loads, you will be prompted to choose which Operating System to start
3. Use the up and down arrow key to select Microsoft Windows Recovery Console
4. You must enter which Windows installation to log onto. Type 1 and press enter.
5. At the C:\Windows prompt, type the following bolded text, and press Enter:

cd erdnt\subs

6. At the next prompt, type the following bolded text, and press Enter:

batch erdnt.con

7. The erunt backups will begin copying.
8. At the next prompt, type the following bolded text, and press Enter:

exit

Windows should now begin loading.
 
ok, I did that. Everything was as you said it should be until windows should now begin loading. When it began loading, it went back to the blue error screen as before.
 
Hi,

Reboot into safe mode and note down the final driver file (.sys) you see before BSOD. Also, please verify if BSOD error is the same as earlier (STOP: 0x0000007B).
 
Hi,

Do you have more than one Windows installations? Just asking cos that line you posted shows partition 2.
 
Hi,

Try to start back into recovery console and type this command there:
chkdsk /r
When that's done type command exit. See if Windows is able to start.

Do you have your Windows installation media handy?
 
It let me do everything until step #6 "Setup will copy the necessary files to the hard drive and reboot. Do not press any key to boot from CD when the message appears. Setup will continue as if it were doing a clean install, but your applications and settings will remain intact." It stopped at the attached picture. It asked me to choose the language but the mouse and keyboard (USB wireless) wouldn't work. Similar to this http://www.tomshardware.com/forum/247704-45-keyboard-stopped-working-repair-install So, based on the advice there, I borrowed a PS2 keyboard & mouse and rebooted. It still did not work. How do I get around this?
 
Try to reboot one more time making sure both devices are plugged in first (unplug USB keyboard & mouse). If it doesn't work then try to do those steps from 1 again with PS2 devices plugged in.
 
the only thing it will let me do besides go to the boot menu, is the same screen of the repair install. When I reboot, it goes to it w/ or w/out the cd in and if the cd isnt in, it asks for it. Still the PS2 keyboard and mouse will not work.
This time though, instead of asking for my language it says fatal error. I attache d a pic.
 
Hi,

That and those BSODs earlier indicate possible hard drive issue. How old is this system and its hard drive?
 
You must log in or register to reply here.
Back
Top