Solved Desktop icons won't stay where I put them.

[PatrickGSR94]

I'm posting this here in Security because of the issues I've had over the past few days. I thought I had taken care of everything using MBAM, Spybot S&D, TDSSKiller, and SFC, but something is still amiss: my desktop icons won't "stick" where I put them, and it's never done this before in the ~20+ months I've had this machine.

I run dual widescreen monitors, one 24" 1920x1200 and one 21" 1920x1080. I keep my task bar and icons all on my right 21" display, so that my main work application gets as much screen real estate as possible on the left 24" display as possible, and I don't have to keep minimizing it to access the icon shortcuts, etc.

Now suddenly every time I log off and then log back on, all icons are lined up in a single column on the left side of my left 24" display. If I arrange them all again and then right-click Refresh, they all pop back over there again!

This has to be something related to the security issues I was having last week. It's never done this before except for when I RDP in from home, and even then the only thing that happens when I get back in the office is the task bar is on my left screen. The icons typically stay on the right where I leave them. But not anymore.

What could be going on here?

 

[PatrickGSR94]

Is there a file that could be missing or corrupted that stores information about desktop icon location?

Also Auto Arrange is NOT checked. That doesn't even let you move the icons around. I can move them around and put them where ever, but as soon as I click Refresh, or log out and log back in, all icons are over on the left side of the left screen again.

 

[Layback Bear]

I don't know if this will work because I use one monitor but it can't hurt.
Right click on desktop of computer you don't want to see the icons and go to view and un-check Show Desktop Icons. On the Desktop you want the Icons on select the size of the icon and Show Desktop Icons.

 

[PatrickGSR94]

No, doing that removes them across both displays.

This was never a problem until 2 weeks ago when I visited a seemingly infected website, and suddenly had several things pop up that were caught by Trend Micro. Something is fudged up here and I can't seem to figure it out.

Desktop icons do not warrant a reformat I don't think, considering the amount of time it will take me and the lost productivity (office machine), but it's still annoying as hell.

 

[flemur13013]

I used this (or something similar - it's been a while) work-around to good effect:

"Save And Restore Desktop Icon Positions & Layout From Context Menu"

Save Desktop Icon Layout In Windows 7

 

[PatrickGSR94]

Yeah, I'm sure that will work, but it's really just a band-aid solution. I would like to figure out what file is gone or possibly corrupted such that it's not remembering my icon positions, and possibly a way to fix it.

 

[PatrickGSR94]

GOT IT!!!

Doing some more Google searching, I came across this page: Everytime I refresh my Desktop the icons Auto Arrange - Microsoft Answers

Last post includes a link to (I think) a French page with a program called Rogue Killer: RogueKiller You can translate the page with Google or Bing, but it's pretty self explanatory where the download link is.

So I downloaded and ran that program, and it found something called ZeroAccess on my machine, which was mentioned in that Microsoft Answers thread. I had it remove everything related to that, and VOILA!!! Problem solved, icons now stay put when logging off or restarting, or when doing a right-click Refresh operation.

 

[shawn77]

Zero access is responsible for desktop icons rearrangement.Most of users remove zero access by using tools.They dont know that they are still infected .Only an expert and check if they are still infections left.

Rogue killer can remove the infected folders but what about services.exe which has been patched.What about the TDL4 rootkit that is detected on every zero access machine .

 

[PatrickGSR94]

What about it? Are you saying I need to do something else?

 

[shawn77]

Please download aswMBR ( 511KB ) to your desktop.
Double click the aswMBR.exe icon to run it
[*]Click the Scan button to start the scan On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.


Please download TDSSKiller.zip and and extract it.

• Run TDSSKiller.exe.
• Click on Change Parameters
• Put a check in the box of Detect TDLFS file system
• Click Start scan.
• When it is finished the utility outputs a list of detected objects with description.
  The utility automatically selects an action (Cure or Delete) for malicious objects.
  The utility prompts the user to select an action to apply to suspicious objects (Skip, by default). Let the options as it is and click Continue
• Let reboot if needed and tell me if the tool needed a reboot.
• Click on Report and post the contents of the text file that will open.
  
  Note: By default, the utility outputs the log into system disk (it is usually the disk with installed operating system, C:\) root folder. The Log has a name like: TDSSKiller.Version_Date_Time_log.txt.

 

[PatrickGSR94]

aswMBR was scanning, and then suddenly just stopped working and crashed.

Awesome.

 

[shawn77]

Move on to TDSSkiller.

 

[PatrickGSR94]

I did run TDSSKiller shortly after this whole ordeal began when my icons started forgetting their positions, and removed whatever it found (about 3 weeks ago).

I tried running aswMBR twice, first time set to scan C:\, second time set to Quickscan. Both times it crashed when trying to scan the downloaded files for the architectural software our office uses, Autodesk Revit 2013. The program install folder itself is over 5 GB and 12,000 files.

So I ran TDSSkiller again just now, 0 threats, 0 objects found.

*edit* it also took over 20 minutes to scan the Temporary Internet Files location. I'm going to clean that out and also delete that Revit 2013 install folder and try running aswMBR again.

 

[PatrickGSR94]

I don't know what the deal is with aswMBR scanning Autodesk-related stuff. When I first downloaded the 5+ GB Revit 2013 install file, I had to install this Akamai NetSession download manager, I guess because of the large file size and the way Autodesk wanted to handle all the download traffic. aswMBR spent almost 15 minutes scanning the Uninstall.exe file for the Akamai program.

 

[PatrickGSR94]

Okay here's the log from aswMBR:

 

[shawn77]

Please go here to run the scan.

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install. All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.Select the option YES, I accept the Terms of Use then click on:

When prompted allow the Add-On/Active X to install. Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked. Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology

Now click on:

The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection. When completed the Online Scan will begin automatically.
[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
[*]Now click on:

Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt. Copy and paste that log as a reply to this topic.

 

[PatrickGSR94]

Okay it finally finished scanning after 3 1/2 hours!

Results:

C:\Program Files (x86)\Dell DataSafe Local Backup\hstart.exe a variant of Win32/HiddenStart.A application

C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application

 

[Layback Bear]

Just a though. I don't know if it matters but your scan aswMBR shows a Vista MBR.

 

[PatrickGSR94]

yeah I have no idea about that.

 

[shawn77]

ASWMBR sometimes shows Windows 2008 server MBR on windows 7 PC lol


Please download Rkill by Grinler and save it to your desktop.

• Link 1 Link 2

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista, right-click on it and Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• The log should be saved on the desktop
• Post it here