Desktop icons and start menu keep on disappearing. please help [RESOL

Welcome Guest ( Log In | Join )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis� Logs Go Here

2 Pages

1 2 >

Desktop icons and start menu keep on disappearing. please help [RESOL

Options

jflygsu View Member Profile	Aug 24 2007, 02:31 PM Post #1
New Member Posts: 8 OS: Windows XP MCE	A couple days ago, I left the computer while I went to work and when I got back the desktop icons and start menu were gone. I've been using the task manager to do pretty much everything. I've done adware scans, virus scan and everything i can think of and nothing works. please help Logfile of HijackThis v1.99.1 Scan saved at 4:16:49 PM, on 8/24/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\system32\bgsvcgen.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\dla\DLACTRLW.exe C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Toshiba\Tvs\TvsTray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Synaptics\SynTP\Toshiba.exe C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe C:\WINDOWS\system32\TDispVol.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\RAMASST.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\WINDOWS\system32\MsiExec.exe C:\Program Files\Hijackthis\HijackThis.exe C:\WINDOWS\system32\taskmgr.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.georgiasouthern.edu/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2235B1BE-66F9-4B99-A5D7-3699AA2426F9} - C:\WINDOWS\system32\mllmm.dll (file missing) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: (no name) - {8B3F8A93-933C-4DDA-B24C-AEB0697C132A} - C:\WINDOWS\system32\pmnllif.dll O2 - BHO: (no name) - {AA2BEE35-6D99-4404-BDCB-97828B56ED12} - C:\WINDOWS\system32\pmnnk.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [THotkey] "C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\DLACTRLW.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Tvs] "C:\Program Files\Toshiba\Tvs\TvsTray.exe" O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [TFncKy] TFncKy.exe O4 - HKLM\..\Run: [TDispVol] TDispVol.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\cmd.exe /c Combobatch.bat O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1183249797359 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: mllmm - C:\WINDOWS\system32\mllmm.dll (file missing) O20 - Winlogon Notify: NavLogon - C:\WINDOWS\ O20 - Winlogon Notify: pmnllif - C:\WINDOWS\SYSTEM32\pmnllif.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

MoNsTeReNeRgY22 View Member Profile	Aug 24 2007, 02:40 PM Post #2
Member Posts: 2,264 From: Classified, CA OS: Windows XP Media Center Editon SP2	Hello and Welcome to Geeks to Go. I am MoNsTeReNeRgY22 and I will be assisting you with your malware problem today. Please give me some time to analyze your log, and I will post back with instructions ASAP. Also, as I am still a trainee my posts must be approved before I can post them, therefore there may be a slight delay between my posts.

MoNsTeReNeRgY22 View Member Profile	Aug 24 2007, 05:05 PM Post #3
Member Posts: 2,264 From: Classified, CA OS: Windows XP Media Center Editon SP2	Hello jflygsu, 1)Please download VundoFix.exe to your desktop Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting. 2)Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them. Please follow these steps to remove older version Java components and update: Download the latest version of Java Runtime Environment (JRE) 6 Update 2 and save it to your desktop. Scroll down to where it says "Java Runtime Environment (JRE) 6u2...allows end-users to run Java applications". Click the "Download" button to the right. Read the License Agreement and then check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation and save the file to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java. Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u2-windows-i586-p.exe to install the newest version. 3)Download Deckard's System Scanner (DSS) to your Desktop. Close all applications and windows. Double-click on DSS.exe to run it, and follow the prompts. When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply. Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard's System Scanner to run and don't let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus) 4)Please post the vundofix.txt and the DSS log in your next reply.

MoNsTeReNeRgY22 View Member Profile	Aug 25 2007, 08:16 AM Post #5
Member Posts: 2,264 From: Classified, CA OS: Windows XP Media Center Editon SP2	Hello again, 1)Please go to UploadMalware to upload a suspicious file for analysis. Enter your username from this forum Copy and paste the link to this thread Browse for this filename: C:\WINDOWS\system32\vtuuutt.dll C:\WINDOWS\system32\opnmlmn.dll C:\WINDOWS\system32\pmnllif.dll In the comments, please mention that I asked you to upload this file Click on Send File 2)I see you have LimeWire and �Torrent installed on your system. While the program itself is legal, most of the files downloaded with it are not. Also, quite often the files can be infected with viruses, malware, and other undesirable applications. I highly recommend uninstalling LimeWire and �Torrent via Add or Remove Programs, but this program is optional for you if you choose to want to keep it. See HERE for details on P2P file sharing programs. Please also remove the orange lines if you would like them removed. 3)Also, most registry optimizers do more bad then they do good. There for I recommend you uninstall Advanced Registry Optimizer via Add or Remove Programs. 4)Please re-open HijackThis and scan. Check the boxes next to all the entries listed below. O2 - BHO: (no name) - {2235B1BE-66F9-4B99-A5D7-3699AA2426F9} - C:\WINDOWS\system32\mllmm.dll (file missing) O2 - BHO: (no name) - {9B8C7C71-6D9B-497D-8716-20B39691FB64} - C:\WINDOWS\system32\pmkjh.dll (file missing) O2 - BHO: (no name) - {AA2BEE35-6D99-4404-BDCB-97828B56ED12} - C:\WINDOWS\system32\pmnnk.dll (file missing) O20 - Winlogon Notify: mllmm - C:\WINDOWS\system32\mllmm.dll (file missing) Now close all windows other than Hijackthis, then click Fix Checked. Close HijackThis. 5)Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present): LimeWire 4.12.6 ffdshow DivX Codec Advanced Registry Optimizer �Torrent Please note any other programs that you dont recognize in that list in your next response 6)I see signs of Norton Anti Virus in your log as well. Please let me know if you had it previously installed on your system. 7)Please run the F-Secure Online Scanner Note: This Scanner is for Internet Explorer Only! Follow the Instruction Here for installation. Accept the License Agreement. Once the ActiveX installs, Click Full System Scan Once the download completes,the scan will begin automatically. The scan will take some time to finish, so please be patient. When the scan completes, click the Automatic cleaning (recommended) button. Click the Show Report button Please highlight everything inside the box, right-click, and choose copy. Please paste the information here for me.

jflygsu View Member Profile	Aug 25 2007, 12:42 PM Post #6
New Member Posts: 8 OS: Windows XP MCE	I did have Norton before I started usin AVG. Scanning Report Saturday, August 25, 2007 13:40:01 - 14:40:08 Computer name: TOSHIBA-LILY Scanning type: Scan system for viruses, rootkits, spyware Target: C:\ -------------------------------------------------------------------------------- Result: 27 malware found Malware.ADRA (virus) C:\WORKSSETUP\OFFICE 2003 EDITIONS 60 DAY TRIAL.EXE (Submitted) C:\DOCUMENTS AND SETTINGS\ALL USERS\DESKTOP\OFFICE 2003 EDITIONS 60 DAY TRIAL.EXE (Submitted) Smalltroj.YUD (virus) C:\WINDOWS\SYSTEM32\BRROT-UNINST.EXE (Submitted) Tracking Cookie (spyware) System (Disinfected) System System System System System System System System System System System System System System System System System System System W32/Smalltroj.YUF (virus) C:\WINDOWS\SYSTEM32\SLIMFFCJ.EXE (Submitted) W32/Vundo.dam (virus) C:\WINDOWS\SYSTEM32\OPNMLMN.DLL (Submitted) C:\WINDOWS\SYSTEM32\PMNLLIF.DLL (Submitted) C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\GGK6C3L3\CSS4[1] (Submitted) -------------------------------------------------------------------------------- Statistics Scanned: Files: 53602 System: 4166 Not scanned: 4 Actions: Disinfected: 1 Renamed: 0 Deleted: 0 None: 26 Submitted: 7 Files not scanned: C:\HIBERFIL.SYS C:\PAGEFILE.SYS C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\BN3W8PK9\CSS4[1] -------------------------------------------------------------------------------- Options Scanning engines: F-Secure AVP: 7.0.171, 2007-08-24 F-Secure Blacklight: 1.0.64 F-Secure Draco: 1.0.35, 2007-08-20 F-Secure Libra: 2.4.2, 2007-08-24 F-Secure Orion: 1.2.37, 2007-08-24 F-Secure Pegasus: 1.19.0, 2007-07-19 Scanning options: Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB BAT LNK ANI AVB CEO CMD LSP MAP MHT MIF PDF PHP POT WMF NWS TAR TGZ WSF ZL? {* ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX Use Advanced heuristics

MoNsTeReNeRgY22 View Member Profile	Aug 25 2007, 02:27 PM Post #7
Member