cannot unlock taskbar or make changes in Start menu properties

cottonball said:

omegatx,

Is the drive P:\ one that had XP on it at one time, or, is this a dual boot system?

Also, let's see if there is anything that prevents the loading of the Registry key.
The Event Viewer Tool (VEW) by Vino Rosso is free and can help look at system event logs for information that may be pertinent...

Please download VEW:
http://images.malwareremoval.com/vino/VEW.exe
Save to the Desktop

Right-click the icon on the Desktop (VEW.exe), and select: Run as Administrator
Click Allow at the User Account Control (UAC) prompt.

At the VEW program console:
In the Select log to query section, check:
Application
System

In the Select type to list section, check:
Critical (not XP)
Error
Warning

In the Number or date of events section, check: Number of events
Type 20 in the 1 -20 box

Now, press the Run button.

A Notepad report opens on the Desktop when done.

Please provide the report contents in your reply.
(If too large, please attach.)
　

OK, I ran VEW. The file is attached. BTW, just wanted to let you know, I subscribe to Carbonite. After getting my PC to boot, the carbonote would not function, so no further backups were done. Since I have re-installed the app, but have frozen the BU until all these issues are resolved. Not sure carbonite would have backed up any files that would solve our issue. Also since I performed a restore from Feb 16th, not sure if the later carbonite files would conflict? Just wanted you to know more background...

cottonball said:

On Post #7...

The ^V appears if you use the keyboard to copy/paste.

Highlite the text inside the quote box.
Right-click and select: Copy

At the Command Prompt's blinking cursor. click there, then right-click and Paste.

Using the keyboard to copy/paste at the Command Prompt does not achieve the desired results.

OK, just a couple quick clarifications. I can perform the copy/paste now. But should I send the paste as a command (enter key) or just leave it next to the prompt? I did not click the enter key and performed the search. The search did bring up a doc with the name advanced, which appears to be an xml file?

Thanks for clarifying...

cottonball said:

@omegatx,

Paste the Registry key info by the blinking cursor of the Command Prompt, and press Enter.

Haven't looked at the VEW report yet. Will do so later. Need to run some errands.

@Jacee,

Thanks!

OK, I completed the command prompt paste and executed the command. I also peformed the "advanced" search. I opened a file called advanced.xml. Is that the correct file? That file is more than the forum limit for text (20000). xml files are not allowed to be attached. I can ftp the file or email it if you wish, just need info. Thanks...

cottonball said:

omegatx,

Advanced.xml is not it.
The advanced.reg file is nothing more than a short text file with some information on the Registry key
querried.

After looking at the Event Log, you had issues back to 3Feb13, and possibly long before that, since the VEW only looks at the past 20 days.

The malware did quite a job on that system, and the video used did not alert or engage in any damage recovery hints.

Event Viewer points to a corrupted user profile, as Jacee mentioned.

To this effect, let's see if we can do some more searching in the Registry...

Please go back to Post #2, and use SystemLook with the following:

:reg
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist

Please post the SystemLook.txt in your reply.

OK, here are the contents of that text file:

SystemLook 30.07.11 by jpshortstuff
Log created at 06:15 on 03/03/2013 by Paul Christensen
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== reg ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist]
"\REGISTRY\MACHINE\HARDWARE"=""
"\REGISTRY\MACHINE\BCD00000000"="\Device\HarddiskVolume2\Boot\BCD"
"\REGISTRY\MACHINE\SYSTEM"="\Device\HarddiskVolume3\WINDOWS\System32\config\system"
"\REGISTRY\MACHINE\SOFTWARE"="\Device\HarddiskVolume3\WINDOWS\System32\config\software"
"\REGISTRY\USER\.DEFAULT"="\Device\HarddiskVolume3\WINDOWS\System32\config\default"
"\REGISTRY\MACHINE\SECURITY"="\Device\HarddiskVolume3\WINDOWS\System32\config\security"
"\REGISTRY\MACHINE\SAM"="\Device\HarddiskVolume3\WINDOWS\System32\config\sam"
"\REGISTRY\USER\S-1-5-20"="\Device\HarddiskVolume3\WINDOWS\ServiceProfiles\NetworkService\ntuser.dat"
"\REGISTRY\USER\S-1-5-19"="\Device\HarddiskVolume3\WINDOWS\ServiceProfiles\LocalService\ntuser.dat"
"\Registry\User\S-1-5-21-2542295906-685563110-2760403507-1000"="\Device\HarddiskVolume3\Users\Paul Christensen\ntuser.dat"


-= EOF =-

cottonball said:

Also, please go to Start, and in the search box above, type in (or copy/paste): UsrClass.dat

Does it appear on the list of Files above the search box?

If it does, place the mouse cursor over the file, and it will show the path of UsrClass.dat

It should show C:\Users\Paul Christensen\AppData\Local\Microsoft\Windows\UsrClass.dat

Please confirm whether UsrClass.dat is found or not.

Not found... Obviously I also cannot look for it with any file mgr since I cannot set hidden file to be viewed.