[Jon Merlin]

Hi,
First I want to say I love this site, last time I had an issue I couldn't solve, maybe a year ago, you guys were great and took the time to help me fix it. Thanks again so much!

Anyways, as the subject suggests, my start bar and task bar isn't showing right now... When I tried to turn on my computer this mourning it got stuck in an endless restarting loop. I tried booting in safemode and last know good configuration and those didn't work. So I put in my windows disk, and booted off the cd, ran a raid 0 driver off a floppy, and went into the repair utility and ran chkdsk /r. After fixing some errors, that got my system up an running again, however, my start menu and taskbar are gone...

I went to ask-leo.com and found an article on there and tried CTRL + ESC, CTRL + ALT + DEL new task explorer.exe, and I ran the system file checker (SFC /scannow). None of these have solved the issue.

If I move my mouse to the bottom of the screen, a little grey bar (maybe 2 pixels high) will pop up, like the bar is trying to pop up as if its in auto hide. I can right click on this bar and get my taskbar options, such as Properties, Show Desktop, Toolbars... My mouse even turns to an arrow when i move it down there, like its about to let me expand the bar, but when i click and try to, nothing happens.

Its quite a mystery to me, I looked around the web and couldn't find anyone with my issue, and thats why I am posting here as a last result. I really don't want to have to reformat my computer. I am hoping you guys can help me find away around that.

So I ran ComboFix, based on the sugestion of another post here. I'll include my log at the bottom. Now, I can not move my icons anywhere. Every icon is locked in place. I tried running HiJackThis and it gave me the error Bad Image: The DLL c:\windows\system32\MSVBVM60.DLL is not a valid windows image.

Thank you so much in advanced, and I look forward to working with you to help solve this issue!

-Jon Merlin

ComboFix Log:  ComboFix.txt   14.38KB   156 downloads

Edited by Jon Merlin, 12 June 2008 - 04:55 PM.

[Advertisements]

I think ComboFix messed up my system even more. Now I can't even run firefox or Internet Explorer. When I click on these programs a window appears and then instantly closes. This is very frusterating.


I DO NOT RECOMMEND COMBOFIX!

Edited by Jon Merlin, 12 June 2008 - 04:49 PM.

[Jon Merlin]

I think ComboFix messed up my system even more. Now I can't even run firefox or Internet Explorer. When I click on these programs a window appears and then instantly closes. This is very frusterating.


I DO NOT RECOMMEND COMBOFIX!

Edited by Jon Merlin, 12 June 2008 - 04:49 PM.

[JSntgRvr]

Hi, Jon Merlin

Welcome.

Lets query the registry for policies.

Download the enclosed folder. Save and extract its contents on your desktop. It is a batch file. Once extracted, click on the Query.bat file and post the report it shall produce.

[Jon Merlin]

Here is the post from that file.  Query_1.txt   1.38KB   224 downloads

Keep in mind I still cant move files or use the web on XP. I have been moving files by zipping them up, and then unziping them in the desired location.

I downloaded Ubuntu and am running it through the CD to use the internet. Thanks so much for your quick response. I look forward to working with you! =)

Edited by Jon Merlin, 12 June 2008 - 04:52 PM.

[JSntgRvr]

Hi, Jon Merlin

There is a policy in place to run a script prior to Explorer. Since we don't know if that script is corrupted, I believe we should remove it, but first, lets query the registry a little further for policies, and see which services are running.

Download the enclosed folder. Save and extract its contents on your desktop. It is a batch file. Once extracted, click on the Query_2.bat file and post the report it shall produce..

[Jon Merlin]

Here are the results:  Query_2.txt   12.09KB   992 downloads

Edited by Jon Merlin, 12 June 2008 - 04:54 PM.

[JSntgRvr]

Hi, Jon Merlin

I am moving this topic to the Malware forum, as I need to run tools only allowed in this forum.

Most services are not started. Especially the Remote Procedure Call, which most services depend on. We need to know why this is happening.

If you press the Windows Key, does the start menu pops-up? If not, pressing Ctrl+Alt+Del or Ctrl+Shift+Esc, would it brings the Task Manager up?

In any event, I need you to run the following command:

Services.msc

Scroll down to to Remote Procedure Call (RPC). Double click on it. Set the startup as Automatic, then attempt to Start the service. If an error is received, please post its contents.

Download OTScanit.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanit on your desktop. OTScanit can be detected as malware by your firewall and Ativirus. Chose Ignore on any warning alert.

• Close any open browsers.
• Open the OTScanit folder and double-click on OTScanit.exe to start the program.
• Leave all settings as they appear as default, except for the following:
• Under Drivers, select "Non microsoft".
• Under Rootkit Search, select Yes
• Under additional Scan select the following:
  
  • Uncheck "Non Microsoft Only".
  • Reg: Botcheck
  • Reg: Controls sets
  • Reg: File Associations
  • Reg: Mountpoints2
  • Reg: Security Settings
  • Reg: Software Policy Settings
• Now click the Run Scan button on the toolbar.
• The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Save that notepad file

Use the Reply button and attach the notepad file here (Do not copy and paste in a reply, rather attach it to it).

[Jon Merlin]

When I tried to start the RPC, it gave me Error 5: Access is denied.


Here is the Scan Results:  OTScanIt.Txt   329.13KB   135 downloads

[JSntgRvr]

Hi, Jon Merlin

It gets more complicated.

Please download and run the enclosed file and post the resulting log.

[Jon Merlin]

Here you go!  logit_3.txt   2.33KB   187 downloads

Thanks again for helping me!

Let me know our next steps...

[JSntgRvr]

Hi, Jon Merlin

The main problem in your system is the inability of the Remote Procedure Call service to logon as an NT AUTHORITY\NetworkService. Most services in the system depend on the RPC. If unable to logon, your computer will not be functional. Taking in consideration what happened to get to this state, you should be thinking in a Repair Install.

I have checked all these reports up and down and find no reason for the access denied error.

Lets re-register those files that interact with this service.

Please run the following commands one at a time.

regsvr32 /s "%SystemRoot%\system32\msv1_0.dll"
regsvr32 /s "%SystemRoot%\system32\kerberos.dll"
regsvr32 /s "%SystemRoot%\system32\msv1_0.dll"
regsvr32 /s "%SystemRoot%\system32\schannel.dll"
regsvr32 /s "%SystemRoot%\system32\wdigest.dll"
regsvr32 /s "%SystemRoot%\system32\RPCss.dll"

Once done restart the computer.

If no joy, lets check your permissions as an user:

Please download AccessEnum by SysInternals and save it to your Desktop.

Refer to the image posted




1. In the Window referenced by #1, type in C:\

2. Then click the 'Scan' button

3. When it has finished running, 'Save' a copy of the report


Note:
Report shall be a large text file. It would be preferable if it was compressed into a zipped archive so that it may be attached in your next post

[Jon Merlin]

i ran those commands and restarted and there was no difference. He is the results of the scan:  AccessEnumTxt.zip   2.61KB   1493 downloads

[JSntgRvr]

Run AccessEnum again. This time, instead of C:\, copy and paste the following and scan:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Attach the report.

[Jon Merlin]

Here is the scan:  AccessEnumReg.zip   2.33KB   491 downloads

[JSntgRvr]

Everything seems normal. Can you boot in Safe Mode? If you do, attempt to logon as the Administrator and create a new profile. Once done, attempt to logon on to the new profile. Is there any difference?