Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Windows Explorer vanishes


  • This topic is locked This topic is locked

#16
skookum

skookum

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
Nope, i open AppData all is well, double click Local and Windows Explorer vanishes.

aswMBR wont let me scan same error as before, Only options it gives me is FixMBR/Save Log/Exit.
  • 0

Advertisements


#17
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
OK. Try this:

Go here and download Mischel's MBR Backup to your desktop, then click MBRBackup.exe to start the utility.

Save MBR:

Click Save MBR, and save that file to your desktop. Then close MBR Backup.

(The file is always pre-named MBR_year_month_day.bin - MBR_2011_05_27.bin for example)

Zip that file and attach it in your next reply.

How to add an attachment to a new topic or reply
  • 0

#18
skookum

skookum

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
MBR record problem,"Error You aren't permitted to upload this kind of file" wont let me attatch my 7zip or rar file, my winzip evaluation period has expired.
  • 0

#19
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
Just rename extension from 7z to txt.

BTW, with 7-zip you can also compress files to zip.

And from Win XP SP3 and later just right-click on file then Send to and then Compressed (zipped) folder.
  • 0

#20
skookum

skookum

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
Silly me.

Attached Files


  • 0

#21
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
MBR seems clean and that's good.

Let's perform general scan now. That scan can take several hours so I recommend you to do it just before you go to sleep.

Download AVPTool from Here to your desktop

Run the program you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan
  • On the first tab select all elements down to Computer (included) and then select start scan
  • Once it has finished select report and post that.

Posted Image

Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop

Now an analysis scan
  • Select the Manual Disinfection tab
  • Press the Gather System Information button
  • Once done Open the last report saved folder then attach the zip file to your next post zip
  • The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

Posted Image

How to add an attachment to a new topic or reply
  • 0

#22
skookum

skookum

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
Scan completed.

Disinfection file attached.Attached File  avptool_sysinfo.zip   21.57KB   97 downloads
  • 0

#23
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
OK. How about first part of the scan? Came out clean?

Do the following please:

Go to Start > All Programs > Accessories
Right click Command Prompt and select Run as administrator
When the prompt opens type the following bolded text and press enter

sfc /scannow (Note: There is a space between sfc and /scannow)

On completion reboot

Let me know then if there is any improvement
  • 0

#24
skookum

skookum

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
I'm unsure about the first scan. When i woke and looked, kaspersky had finished and there was no prompt to do anything.

sfc /scan now came up all clear.

Vista now boots in a 1/3 the time it used to.

Browsing to the AppData folder seemed to be good but after 10 or so seconds Explorer vanished again.

I notice in the Kaspersky sysinfo report


DRIVERS
C:\Program Files\Virgin Media\Security\BitDefender\profos.sys
C:\Windows\system32\Drivers\RAMDiskVE.sys
C:\Program Files\Virgin Media\Security\BitDefender\trufos.sys

Virgin Media security & RAMDisk i uninstalled weeks ago.


Also i notice in

Windows Explorer extension modulesWindows Explorer extension modules

C:\PROGRA~1\E-Press\ONE\CONTEX~1.DLL (EasyZip)
That bloody program has been a thorn in my side for over two years now, can we get it exterminated please.

Haali Matroska Thumbnail Exctractor (i never knowingly installed it)


Using other explorer software i notice in the AppData folder, there are 3 files not in a folder, they never used to be there i think.

DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
GDIPFONTCACHEV1.DAT
IconCache.db
  • 0

#25
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
OK. You are now using Avast AV so we will now remove BitDefender's, Ramdisk, EasyZip and Haali Matroska files.

DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
GDIPFONTCACHEV1.DAT
IconCache.db

Leave these files. They are all legit.

Using other explorer software i notice in the ...

What is that "other explorer software"?

Please follow the steps below:

Step 1

  • Re-run AVPTool
  • Select the Manual Disinfection tab
  • Where it states Step 3 paste in the following disinfection script and press execute

    begin
    SetAVZPMStatus(True);
    SearchRootkit(true, true);
    SetAVZGuardStatus(True);
     DelCLSID('{0561EC90-CE54-4f0c-9C55-E226110A740C}');
     DelCLSID('{5574006C-28F5-4a65-A28C-74DE6BFBE0BB}');
     DelCLSID('{327669A0-59A7-4be9-B99E-1C9F3A57611A}');
     DeleteFile('C:\Program Files\Virgin Media\Security\BitDefender\profos.sys');
     BC_DeleteFile('C:\Program Files\Virgin Media\Security\BitDefender\profos.sys');
     DeleteFile('C:\Program Files\Virgin Media\Security\BitDefender\trufos.sys');
     BC_DeleteFile('C:\Program Files\Virgin Media\Security\BitDefender\trufos.sys');
     DeleteFile('C:\Windows\system32\Drivers\RAMDiskVE.sys');
     BC_DeleteFile('C:\Windows\system32\Drivers\RAMDiskVE.sys');
     DeleteFile('C:\PROGRA~1\E-Press\ONE\CONTEX~1.DLL');
     BC_DeleteFile('C:\PROGRA~1\E-Press\ONE\CONTEX~1.DLL');
    BC_ImportDeletedList;
    ExecuteSysClean;
    BC_Activate;
    RebootWindows(true);
    end.
  • Your system will reboot on completion, if it does not please do so yourself
  • On completion please run another analysis scan and attach the zip file

Posted Image

Step 2

Posted Image Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

  • Open Malwarebytes' Anti-Malware.
  • Select the Update tab.
  • Click on Check for Updates button.
  • Click on OK.
  • Select the Scanner tab.
  • Select Perform quick scan, then click on Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
  • 0

Advertisements


#26
skookum

skookum

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
After the disinfection computer rebooted.

Now all the icons on my desktop vanish for 2 second the reappear then vanaish again, stuck in a loop.

ctrl/alt/del task manager shows procsses Explorer using 80%CPU.

I'm on the laptop as i cant do anything on the desktop pc now.

Rebooting under safe mode same result.

Edited by skookum, 31 May 2011 - 11:01 AM.

  • 0

#27
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
OK. Try to boot into Safe mode with networking and see if there is same situation.

To restart the computer in safe mode

Reboot then continually press F8 as the system starts booting
Once a menu appears select safe mode
  • 0

#28
skookum

skookum

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
My desktop pc is dual boot with ubuntu, when i booted ubuntu it said on boot up "the disk contains an unclean file system (0,0)" windows was not shut down correctly.
So i rebooted f8 selected last good configuration (or words like that) now its doing a chkdsk finding all sorts of crap.
Rebooted and BSOD. Ah crap.

Edited by skookum, 31 May 2011 - 11:19 AM.

  • 0

#29
skookum

skookum

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
Rebooted safe mode with networking, seemed good for 30 seconds, now icons vanish loop again.
  • 0

#30
skookum

skookum

    Member

  • Topic Starter
  • Member
  • PipPip
  • 43 posts
Hotkey on keyboard to open browser (firefox) works, i'm using it to send this post.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP