At least we have the culprit.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Common Startup REG_EXPAND_SZ %windir%\system32
You see that the global startup is pointing to the
system32 folder, it should be pointing to
%USERPROFILE%\Start Menu\Programs\StartupPlease do this for me...
We are going to make some changes to your registry. To make sure that if something happened while doing this fix we have a backup of your registry available, I will need you to follow these instructions::Please go to Start > Run
Paste in the following line:
regedit /e c:\registrybackup.regClick OK.
It won't appear to be doing anything, that's normal.
Your mouse pointer may turn to an hour glass for a minute.
Please continue when it no longer has the hour glass.
[/list]Please open Notepad by going to Start > Run and typing Notepad.exe in the window that pops up. Press enter and in the notepad window that appears Copy (Ctrl+C) and Paste (Ctrl+P) the following:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Common Startup"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,53,00,74,00,61,00,72,00,74,00,20,00,4d,00,65,00,6e,\
00,75,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,73,00,5c,00,53,00,\
74,00,61,00,72,00,74,00,75,00,70,00,00,00
Note: it is important to copy this with the spacing left as it is, also make sure "Windows Registry Editor Version 5.00" is the first thing in Notepad (No spaces ahead or anything).In Notepad click on the "File" menu > Save As... Under "File name" type
Fix.reg and Change "Save as type" to
All FilesNow double click
Fix.reg. A pop-up will appear asking you if you want to import this to your registry click yes.
Reboot your PC, then re-scan with Hijack This - attach the log here please. (take a note if the O4s are gone)
Also could you take a screenshot of your desktop so I can see what is going on there? If you have things you don't want to show either hide them or PM me the screenshot please
Edited by Mike, 11 August 2008 - 01:28 PM.