Windows Explorer malfunction

[Tiffany]

I have been having trouble the last few days with Windows Explorer malfunctioning and closing. My entire desktop disappears and the tastbar/start button disappears as well. The other day I did a malwarebytes scan, and nothing came up. Today I got a notice from windows defender: Backdoor:win32/IRCbot.gen!T

Im in the process of running malwarebytes scan again and its pulling up all kinds of files but is still going.

Please help! Is this something I can remove with antivirus software? Or is this something more serious?

Tiffany

I did a hijackthis scan:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:13:33 AM, on 10/25/2009

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v7.00 (7.00.6002.18005)

Boot mode: Normal

Running processes:

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

C:\Program Files\Launch Manager\QtZgAcer.EXE

C:\Acer\Empowering Technology\eDSMSNfix.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Windows\ZSSnp211.exe

C:\Windows\Domino.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Users\Tiffany\AppData\Local\Temp\RtkBtMnt.exe

C:\Windows\system32\igfxext.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE

C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE

C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\Dwm.exe

C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Windows\system32\taskeng.exe

C:\RECYCLER\S-1-5-21-8800738596-2202493425-826901173-0220\winmap32.exe

C:\RECYCLER\S-1-5-21-8800738596-2202493425-826901173-0220\winmap32.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def.../search/ie.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.oakland.edu/nursingvids/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE

O4 - HKLM\..\Run: [eDSMSNfix] C:\Acer\Empowering Technology\eDSMSNfix.exe

O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer Registration\ACE1.exe" /startup

O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe

O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe

O4 - HKLM\..\Run: [setPanel] C:\Acer\APanel\APanel.cmd

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [ZSSnp211] C:\Windows\ZSSnp211.exe

O4 - HKLM\..\Run: [Domino] C:\Windows\Domino.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"

O4 - HKLM\..\Run: [DivX Free Codec] C:\Program Files\DivX Free Codec\Divx Free Update.exe

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup

O4 - HKCU\..\Run: [12CFG214-K641-24SF-N85P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1859\ls888.exe

O4 - HKCU\..\Run: [Test321] C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1455\fresdg.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [gi512394958] "C:\Windows\TEMP\gi83FA4D.exe" /resume:"C:\Windows\TEMP\2S83F1RS" /exename:"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSW18UD5\SpyHunter-3.4.0009-Installer[1].exe" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [gi512394958] "C:\Windows\TEMP\gi83FA4D.exe" /resume:"C:\Windows\TEMP\2S83F1RS" /exename:"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSW18UD5\SpyHunter-3.4.0009-Installer[1].exe" (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Empowering Technology Launcher.lnk = ?

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll eNetHook.dll

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe

O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe

O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe

O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)

O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe

O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

--

End of file - 11216 bytes

[Rosty]

Can you please post the log from MBAM?

NOTE: Logs can be retrieved at a later date from the Malwarebytes' Anti-Malware main screen:

Launch Malwarebytes' Anti-Malware.

Click the Logs tab.

Double-click log-mm.dd.yyyy [xxxxxx].txt.

[Tiffany]

Can you please post the log from MBAM?

NOTE: Logs can be retrieved at a later date from the Malwarebytes' Anti-Malware main screen:

Launch Malwarebytes' Anti-Malware.

Click the Logs tab.

Double-click log-mm.dd.yyyy [xxxxxx].txt.

Here is the log file

Malwarebytes' Anti-Malware 1.41

Database version: 3029

Windows 6.0.6002 Service Pack 2

10/25/2009 12:08:08 PM

mbam-log-2009-10-25 (12-08-08).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 255036

Time elapsed: 2 hour(s), 45 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 3

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 37

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12cfg214-k641-24sf-n85p (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\test321 (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1859\ls888.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62EGIEHD\vs8[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62EGIEHD\vs8[2].exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZX8OTZS5\vs8[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\193.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\194.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\625.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\656.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\659.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\259.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\298.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\303.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\338.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\348.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\056.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\070.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\076.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\092.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\106.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\146.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\832.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\847.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\851.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\855.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\907.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\211.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\220.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\242.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\245.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\376.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\441.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\455.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\525.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\580.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Local\Temp\593.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\Tiffany\AppData\Roaming\mouseapp.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1455\fresdg.exe (Trojan.Agent) -> Quarantined and deleted successfully.

[Tiffany]

after removing the infected files with malware bytes, I am only able to start up my computer in safe mode. When I try to start up in normal mode, the screen stays black, and the Windows Explorer Error message still appears.

How frustraiting :-(

[Rosty]

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix when you've accomplished that.

Run ComboFix in safe mode, please!

[AdvancedSetup]

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.