Windows Explorer not working, can't install HijackThis

wobblebear

I have a Dell Vostro 1510 laptop, Vista Home Premium Service Pack 2. I have PC Tools Firewall Plus installed and Eset anti-virus. I always keep my laptop up-to-date and regularly run anti-virus scans and Malwarebytes scans (the latest of which didn't find anything).

I am unable to delete any files from my laptop as Windows Explorer keeps crashing every time I try. I also can't delete any of my favourites from Internet Explorer or move things to the recycle bin from the desktop. I am unable to delete files from my MP3 player when that is plugged in. I have tried to install HijackThis today to try and find out what the problem is, but it won't install. Can anyone help?

busenbust

Try doing a system restore to a previously known good working state, esp. if a recent problem .

The_Grandmaster

Can you install malwarebytes:
Download Malwarebytes Anti-Malware 1.46 - FileHippo.com
Download and install. UPDATE tab, CHECK FOR UPDATES, run a QUICK SCAN. Remove everything it finds and post log here.

wobblebear

Thanks for the replies. Sorry I should have said, I tried system restore before my original post but it didn't help. I already have Malwarebytes installed and have just updated it and done another scan, but it didn't find anything:

Malwarebytes' Anti-Malware 1.46
Database version: 4868
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975
18/10/2010 10:51:52
mbam-log-2010-10-18 (10-51-52).txt
Scan type: Quick scan
Objects scanned: 135989
Time elapsed: 7 minute(s), 53 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

busenbust

See here: any of these recovery options available to u??
http://forums.moneysavingexpert.com/....php?t=2242109

applies to Vista also ^^

spakkker

I'm not familiar with vista but is this an accounts /permissions setting problem? Can you do any of the above in safe mode? As admin?
I'd suggest get combofix and run it -even if from usb.

wobblebear

busenbust wrote: »

See here: any of these recovery options available to u??
(link removed as I can't post links)

applies to Vista also ^^

I ran the Dell operating system disc that came with the laptop and tried to do a windows repair. The only option that looked appropriate was "startup repair", which I ran but it didn't find any problems. The only other thing that seems appropriate is "complete pc restore", which I assume would wipe everything? (that's why I haven't run it yet!).

spakkker wrote: »

I'm not familiar with vista but is this an accounts /permissions setting problem? Can you do any of the above in safe mode? As admin?
I'd suggest get combofix and run it -even if from usb.

I have run Combofix but don't understand the log file, please could someone decipher it for me? Thanks!

ComboFix 10-10-17.04 - Wobblebear 19/10/2010 15:40:43.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2038.1115 [GMT 1:00]
Running from: c:\users\Wobblebear\Desktop\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2010-09-19 to 2010-10-19 )))))))))))))))))))))))))))))))
.
2010-10-19 14:48 . 2010-10-19 14:48

---

d

---

w- c:\users\Wobblebear\AppData\Local\temp
2010-10-19 14:48 . 2010-10-19 14:48

---

d

---

w- c:\users\Default\AppData\Local\temp
2010-10-18 09:41 . 2010-09-09 22:52 6084944 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0F409714-D009-4117-AEAA-5E9BA63AA37A}\mpengine.dll
2010-10-18 09:16 . 2010-09-13 13:56 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2010-10-18 09:16 . 2010-09-13 13:56 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-10-18 09:15 . 2010-09-06 16:20 125952 ----a-w- c:\windows\system32\srvsvc.dll
2010-10-18 09:15 . 2010-09-06 16:19 17920 ----a-w- c:\windows\system32\netevent.dll
2010-10-18 09:15 . 2010-09-06 13:45 304128 ----a-w- c:\windows\system32\drivers\srv.sys
2010-10-18 09:15 . 2010-09-06 13:45 145408 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-10-18 09:15 . 2010-09-06 13:45 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-10-18 09:14 . 2010-08-31 15:44 531968 ----a-w- c:\windows\system32\comctl32.dll
2010-10-18 09:14 . 2010-08-10 15:53 274944 ----a-w- c:\windows\system32\schannel.dll
2010-10-18 09:13 . 2010-06-28 17:00 1316864 ----a-w- c:\windows\system32\ole32.dll
2010-10-18 09:13 . 2010-06-28 14:54 339968 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2010-10-18 09:13 . 2010-08-26 16:37 157184 ----a-w- c:\windows\system32\t2embed.dll
2010-10-18 09:13 . 2010-08-31 15:46 954752 ----a-w- c:\windows\system32\mfc40.dll
2010-10-18 09:13 . 2010-08-31 15:46 954288 ----a-w- c:\windows\system32\mfc40u.dll
2010-10-18 09:09 . 2010-08-31 13:27 2038272 ----a-w- c:\windows\system32\win32k.sys
2010-10-18 09:09 . 2010-05-04 19:13 231424 ----a-w- c:\windows\system32\msshsq.dll
2010-10-18 09:08 . 2010-08-20 16:05 867328 ----a-w- c:\windows\system32\wmpmde.dll
2010-10-08 09:40 . 2010-10-08 09:40

---

d

---

w- c:\program files\Common Files\Adobe
2010-10-03 22:43 . 2010-10-03 22:43 59240 ----a-w- c:\windows\system32\drivers\RapportKELL.sys
2010-09-29 04:24 . 2010-06-22 13:30 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-22 17:10 . 2010-09-22 17:10 103864 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-02-22 159744]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-22 4907008]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-10-27 3563520]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"dldtmon.exe"="c:\program files\Dell V305\dldtmon.exe" [2008-03-20 668912]
"dldtamon"="c:\program files\Dell V305\dldtamon.exe" [2008-03-20 16624]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-05 524632]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-02-26 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-26 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-26 150552]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2010-01-12 3168216]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-2-12 163840]
Directrec Configuration Tool.lnk - c:\program files\Olympus\DeviceDetector\DirectrecConfig.exe [2009-2-12 122880]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-2-22 1193240]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=""
"FirewallOverride"=""
R2 dldtCATSCustConnectService;dldtCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\dldtserv.exe [2009-07-09 98984]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-05 1029456]
R3 pctplfw;pctplfw;c:\windows\System32\drivers\pctplfw.sys [2010-01-13 115216]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-09-05 64160]
S0 RapportKELL;RapportKELL;c:\windows\System32\Drivers\RapportKELL.sys [2010-10-03 59240]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
S1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi.sys [2010-01-07 233136]
S1 RapportBuka;RapportBuka;c:\windows\system32\drivers\RapportBuka.sys [2010-02-26 390528]
S1 RapportCerberus_19917;RapportCerberus_19917;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917.sys [2010-10-03 34792]
S1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [2010-10-03 169320]
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2008-02-22 77824]
S2 BthFilterHelper;Bluetooth Feature Support;c:\program files\CSR\Vista Profile Pack\BthFilterHelper.exe [2006-11-07 127488]
S2 dldt_device;dldt_device;c:\windows\system32\dldtcoms.exe [2008-02-25 595184]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-11-16 735960]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2009-12-18 95896]
S2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009-11-23 88040]
S2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [2010-10-03 767208]
S3 BTHFILT;Bluetooth Command Filter;c:\windows\system32\DRIVERS\BthFilt.sys [2007-05-05 13824]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-11-05 51288]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2008-11-05 43608]
S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2010-01-12 70664]
S3 pctNDIS;PC Tools Driver;c:\windows\system32\DRIVERS\pctNdis.sys [2010-01-07 58816]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2010-10-18 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 05:47]
2010-10-19 c:\windows\Tasks\User_Feed_Synchronization-{5550DF15-0330-45A7-BCBE-2E24FC4D727B}.job
- c:\windows\system32\msfeedssync.exe [2010-10-18 04:25]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www .bbc.co.uk/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.
.

---

LOCKED REGISTRY KEYS

---

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.

---

DLLs Loaded Under Running Processes

---

- - - - - - - > 'Explorer.exe'(15296)
c:\program files\Trusteer\Rapport\bin\rooksbas.dll
.
Completion time: 2010-10-19 15:51:47
ComboFix-quarantined-files.txt 2010-10-19 14:51
ComboFix2.txt 2010-10-18 15:51
Pre-Run: 157,061,316,608 bytes free
Post-Run: 157,798,711,296 bytes free
- - End Of File - - CDD778035029B4C6F92AB64C08C39522

busenbust

The only other thing that seems appropriate is "complete pc restore", which I assume would wipe everything? (that's why I haven't run it yet!).

^^yes, it (probably) would! Can u access your docs at all??

wobblebear

busenbust wrote: »

Can u access your docs at all??

Yes, I can access them in Windows Explorer, I just can't delete them, or empty the recycle bin, or delete favourites from IE etc. It all seems to be to do with deleting, I can't delete anything at the moment!

busenbust

wobblebear wrote: »

Yes, I can access them in Windows Explorer, I just can't delete them, or empty the recycle bin, or delete favourites from IE etc. It all seems to be to do with deleting, I can't delete anything at the moment!

If nothing else works -- could u possibly copy over all docs to external drive and do a complete restore? a pain i know but...

dogmaryxx

There may be file system errors on the hard drive that's got Windows on it (this is usually the 'C' drive.) so I would first let Windows scan it and it will fix any such errors automatically.

1. Right-click C drive and choose 'Properties'
2. Click the 'Tools' tab
3. Click 'Check Now'
4. Tick BOTH options then click 'Start'
5. When asked if you want to run the error-checker at the next re-start, click 'YES'.
6. Restart Windows.

Before Windows starts the error-checker will run.