So here's the deal. I was an idiot and clicked on a file to download from an unknown host and let it extract. I didn't do anything so I restarted the computer and after that could not boot into windows at all. I would be able to get to the user log in screen but once I click on the user it say's loading personal settings then automatically goes to saving settings and turns off. Same thing went for safe mode. I tried check dsk and it did not work. I used a bootable avg to scan and it didn't find anything. I ended up doing a recovery from XP sp 3 disk. After doing this I was able to actually log in with safe mode and get access to all my files. In regular mode it lets me choose the user but after that it brings up my background I had set and no icons or anything, just my mouse pointer which I can move around but nothing else.I can hit Windows+ U and it will bring up that voice thing but nothing else will work. I have also run malware bytes in safe mode along with microsoft malicious software removal tool. I cannot run Hijack this because it say's "The system administrator has set policies to prevent this installation".
I just want my machine back without going the route of reformatting. Is there anybody that can help me with this or give me assistance on what I can do???


Please help this is driving me insane.

I think reformat maybe inevitable by the look of it. What I do is boot up the computer with the Window CD and after it pass through all the loading and come to EULA, press F8 than it look for previous version of Window and after that the next screen will show your drive partition and at the bottom it show delete partition, repair and install. Click repair, this will remove previous version of Window and reinstall Window. Please take precaution when doing this and make sure you have back up all your data.

In regular mode it lets me choose the user but after that it brings up my background I had set and no icons or anything

try this when you get to this point , do ALT+CTRL-DEL ,go to task manager ,go file /new task , there in run type with out the quotes "explorer.exe " this should bring back the desktop .

Alright, so I ended up doing what both you said, the recover repair got me to that point of no background. The CTRL+DEL+ALT and typing got my things back, BUT!!! after that log in and running antivir, I restarted my computer and it went back to the same situation where when you log in it say's logging in then logs right back out again. Same thing into safe mode. I have brought it back up with the same process but I haven't restarted this. Now I'm just wondering since that software didn't help me the first time, is there anything recommended? I have also run malware bytes originally before the first restart.

Mmm.. sounds like a couple of keys in registry are not set correctly, like the one that starts explorer. But a Windows Repair should have reinstated those....
Go Safe Mode, log in as the Administrator, and run hijackthis. Post the log.
May I ask what the software was that you thought you were downloading? And from where?

Hi, maybe a minor, but did you try to use msconfig? Click on start, click on run, write msconfig and check what is turned on at startup, anything you think is not necessary, like any software except applications you know you need. Check also services, mark the box "hide microsoft services" and check what is running which you can't place as software you know about. Try it, maybe it will help you to determine which software disturbs your system? Hope can help you.

Through safe mode running hijack this got me:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:38:12 PM, on 9/26/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Avira\AntiVir Desktop\sched.exe
F:\Program Files\Avira\AntiVir Desktop\avguard.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
F:\WINDOWS\system32\gearsec.exe
F:\Program Files\Avira\AntiVir Desktop\avshadow.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\LogMeIn\x86\RaMaint.exe
F:\Program Files\LogMeIn\x86\LogMeIn.exe
F:\Program Files\LogMeIn\x86\LMIGuardian.exe
F:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
F:\Program Files\Active PC Optimizer\ActivePCOptimizerService.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\svchost.exe
F:\Program Files\TVersity\Media Server\MediaServer.exe
F:\Program Files\Avira\AntiVir Desktop\avgnt.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Windows Live\Messenger\msnmsgr.exe
F:\Documents and Settings\Owner\Start Menu\Programs\Startup\aitagent.exe
F:\WINDOWS\system32\devldr32.exe
F:\WINDOWS\system32\dllhost.exe
F:\WINDOWS\system32\wscntfy.exe
F:\WINDOWS\system32\msiexec.exe
F:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=F:\WINDOWS\system32\userinit.exe,C:\Windows\system32\userinit.exe,F:\Documents and Settings\Owner\Application Data\m7Z10PZUMByl.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - F:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [MSConfig] F:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Audio HD Driver] F:\DOCUME~1\Owner\LOCALS~1\Temp\SystemDriver.exe
O4 - HKLM\..\Run: [avgnt] "F:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\RunServices: [WinxDiagUpdate] WinxDiagUpdate
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Application Impact Telemetry Agent] F:\Documents and Settings\Owner\Start Menu\Programs\Startup\aitagent.exe
O4 - HKCU\..\Run: [Audio HD Driver] F:\DOCUME~1\Owner\LOCALS~1\Temp\SystemDriver.exe
O4 - HKCU\..\Run: [tcactive] F:\Program Files\The Cleaner\tcap.exe
O4 - HKLM\..\Policies\Explorer\Run: [Audio HD Driver] F:\DOCUME~1\Owner\LOCALS~1\Temp\m7Z10PZUMByl.exe
O4 - HKCU\..\Policies\Explorer\Run: [Audio HD Driver] F:\Documents and Settings\Owner\Application Data\SystemDriver.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: aitagent.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://F:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - F:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - F:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - F:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: f:\windows\system32\nwprovau.dll
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.3.5.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1185430372249
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://remote.imsgroup.com/Remote/msrdp.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://www.cogeco.ca/en/OLS3.3/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...5/installer.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://blacks.pnimedia.com/upload/activex/...upv2.0.0.10.cab?
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: Antiwpa - antiwpa.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - F:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - F:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - F:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - F:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - F:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: gearsec - GEAR Software - F:\WINDOWS\system32\gearsec.exe
O23 - Service: Google Software Updater (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - F:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - F:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: The Cleaner 2011 Helper Service (moohelp) - MooSoft Development LLC - F:\Program Files\The Cleaner\mhelper.exe
O23 - Service: McAfee Wireless Network Security Service (MWLSvc) - McAfee, Inc. - F:\Program Files\Mcafee\MWL\MwlSvc.exe
O23 - Service: NBService - Nero AG - F:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - F:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ActivePCOptimizer Service (RegMumService) - Weskysoft Inc. - F:\Program Files\Active PC Optimizer\ActivePCOptimizerService.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - F:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - F:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - F:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: TVersityMediaServer - Unknown owner - F:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: UltiDev Cassini Web Server for ASP.NET 1.1 - Unknown owner - f:\program files\ultidev\cassini web server for asp.net 1.1\ultidevcassinwebserver1a.exe (file missing)
--
End of file - 12171 bytes

Also for the last post I did do the msconfig thing. Didn't see anything that wasn't used before. I was downloading video editing software. I joined one of those unlimited file sites and did a search and started to download it.

1. check these files on google:
ultidevcassinwebserver1a.exe
aitagent.exe
2. uninstall all antivirus software and keep only one, i recommend kaspersky internet suite
3. uninstall all toolbars and if can don't install any and use only your normal internet browser, i recommend firefox
Try these steps and it should be back to normal again.

regarding step 1., if you find these are not regular softwares of ours, then uninstall these as well

You are posting on several sites. i appreciate the panic that such problems can induce, but by multiple postings you overwork the few volunteers.
Anyway... start hijackthis again, click Scan, in the window that opens place checkmarks against all the entries listed below that still exist, and then press Fix Checked.

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Audio HD Driver] F:\DOCUME~1\Owner\LOCALS~1\Temp\SystemDriver.exe
O4 - HKLM\..\RunServices: [WinxDiagUpdate] WinxDiagUpdate
O4 - HKCU\..\Run: [Audio HD Driver] F:\DOCUME~1\Owner\LOCALS~1\Temp\SystemDriver.exe
O4 - HKLM\..\Policies\Explorer\Run: [Audio HD Driver] F:\DOCUME~1\Owner\LOCALS~1\Temp\m7Z10PZUMByl.exe
O4 - HKCU\..\Policies\Explorer\Run: [Audio HD Driver] F:\Documents and Settings\Owner\Application Data\SystemDriver.exe
O20 - Winlogon Notify: Antiwpa - antiwpa.dll (file missing)

Delete these files:
F:\DOCUME~1\Owner\LOCALS~1\Temp\SystemDriver.exe
F:\DOCUME~1\Owner\LOCALS~1\Temp\m7Z10PZUMByl.exe

I have no way of telling if this is legitimate: O4 - Startup: aitagent.exe
-you should check the properties of aitagent.exe [system32] to see if it is the valid Microsoft file; if it is, all is fine.

This one, O20 - Winlogon Notify: Antiwpa - antiwpa.dll (file missing): I don't know, but could suspect, that this is a Windows hack [Anti-WPA?] to bypass validation..? Remove it, or I cannot help further. It's one of the sensible rules here.
Right, try to restart in normal mode, if successful, run first MBAM as shown below, then run hijackthis again and post both the logs. If you cannot start in normal mode, then in Safe mode:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you when it completes... do not click the Save Logfile button.
Examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Copy and post that log [it is also saved under Logs tab in MBAM].

I think you should need to reinstall your Windows again or if you have any friend like a how know hardware well please contact him.

<snip>

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.