Qucik Launch Toolbar disappears

Hi Andy,

Okay, this key:

[[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

Is in my registry and since I haven't fiddled around with the registry, this one must be a default key so we should leave it alone. I suspect that even if you did remove it, Windows would re-create it on next boot.

I'd like to give credit to Bill Castner, MS-MVP-Networking (and currently enrolled here at MRU) for the following script which he credits to: MS-MVPs Kelly Theriot (Kelly's Korner for XP), and Doug Knox,

Using your mouse, Highlight the entire contents of the code box below, including any blank lines. Then hit Ctrl+C tocopy it:

Windows Registry Editor Version 5.0



[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}]

@="IShellFolderBand"



[HKEY_CLASSES_ROOT\CLSID\{D82BE2B0-5764-11D0-A96E-00C04FD705A2}\InProcServer32]

@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\

  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,48,00,\

  45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,00,00

"ThreadingModel"="Apartment"



[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoSaveSettings"=dword:00000000



[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"SystemTray"="SysTray.Exe"



[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2\]



[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU\]



[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop\]



[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\BarSize\]



[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoBandCustomize"=-

"NoMovingBands"=-

"NoCloseDragDropBands"-

"NoSetTaskbar"=-

"NoToolbarsOnTaskbar"=-

"NoSaveSettings"=-

"NoToolbarsOnTaskbar"=-

"NoSetTaskbar"=-

"NoActiveDesktop"=-

"ClassicShell"=-

"LockTaskbar"=-

"NoTrayContextMenu"=-



[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoCloseDragDropBands"=dword:00000000

"NoMovingBands"=-



[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}\]

"BarSize"=-

"Media Band"=""



[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Shell"="explorer.exe"

"Userinit"="userinit.exe, "

Next, launch Notepad, and click Format. Uncheck Word Wrap (if checked). Hit Ctrl+V to paste the contents of the code box into the blank Notepad. Click File=>Save as.... Type (including quotation marks): "C:\fix_regs.reg"., and save to your desktop.

Exit Notepad. Back on your desktop, Double click C:\fix_regs.reg and agree to the registry merge when asked. Once the merge is complete, you can delete this new .REG file we just created.
Reboot and test.

Post back a fresh HijackThis log and let me know if you're still having problems. Also please let me know if anything new has cropped up.

SCB

Hi SCB

Sorry for the delay. Have run your .reg screen, and rebooted twice. No change to the toolbar problem.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:36:41, on 24/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
c:\windows\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ntl\ntl Netguard\fws.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Group\Apache\Apache.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\PROGRA~1\MI6841~1\MSSQL$~1\binn\sqlservr.exe
c:\jdk1.3.1_01\bin\java.exe
C:\Program Files\Apache Group\Apache\Apache.exe
C:\Windows\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_14\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\ntl\ntl Netguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\ntl\ntl Netguard\FBHR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_14\bin\ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [EPSON Stylus Photo RX520 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGE.EXE /P31 "EPSON Stylus Photo RX520 Series" /O6 "USB001" /M "Stylus Photo RX520"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_14\bin\jusched.exe"
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_14\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_14\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.co.uk
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://portal.mydsti.com/Citrix/ICAWEB/en/ica32/ica32t.exe
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{7878798B-3E5D-4A17-A51F-B8A7C4D752BF}: Domain = dstintl.com
O20 - Winlogon Notify: !SASWinLogon - C:\WINDOWS\
O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - C:\Program Files\ntl\ntl Netguard\fws.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

--
End of file - 6200 bytes

Merry Xmas

Andy

Footnote - it has changed.

I get 'Cannot create Toolbar' when I try to add Quicklaunch now

Hi Andy,

Okay, let's take care of some HijackThis entries. Incidentally, please pay particular attention to the note regarding Spybot - Search & Destroy and the O6 entries. If those policies were set using Spybot - Search & Destroy, undo them before fixing those entries. If they weren't, go ahead and fix them.

Next, let's update your Java as outlined in one of my earlier posts. Once that is finished, let's get rid of that Netgear firewall service.

Next, go to Start=>Run and type "Services.msc" (without quotes) then hit Ok

• Scroll down and find the service called Radialpoint Service (FWS)
• Right-click=>Stop.
• Right click=>Properties area
• Under the General Tab, in the "Startup Type" drop-down box:
• Select Disabled.
• Hit Apply=>Ok and close any open windows.

Press Ctrl+Alt+Delete (All three together) to open Task Manager

1. Cclick (highlight) each of the following (if present):

C:\Program Files\ntl\ntl Netguard\fws.exe

2. Click End Process
3.Repeat for each process.
4. Exit Task Manager.

Run HiJackThis and click "Do a system scan only", then check(tick) the following, if present:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - Default URLSearchHook is missing

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
...(Unless you set these with a anti-spyware program like SpyBot's Immunize feature, or a System Administrator set them, have HiJackThis fix this.)

O20 - Winlogon Notify: !SASWinLogon - C:\WINDOWS\

With all windows closed except HiJackThis, click "Fix checked".

I get 'Cannot create Toolbar' when I try to add Quicklaunch now......Hmmmm, I'll check with the OS experts here and see what they think about this one. We may be nearing the point at which we need to refer you to a more specialized forum.

Meanwhile, go ahead and take care of everything outlined above. We'll get you looking as good as we can before sending you out to play with some other kids.

Have a wonderful Christmas

SpotCheckBilly

Hi SCB

OK, all advice now taken:

Java 6.3 installed and all previous java versions discarded
Sygate/Netgear de-istalled
HJT fixes as shown (had to remove the 06 HKEy....policies/restrictions keys manually as fix didn't do it)
Comodo Pro with Advanced options installed


I've also run: REGSVR32 /i SHELL32.DLL to reconstitue my Quick launch toolbar (stop the 'cannot create' message). Toolbar still doesn't reappear after a reboot

Merry Xmas

Andy

Hi Andy,

I think you're going to like COMODO Pro. It's pretty lightweight and probably as much or more configurable than any other third-party firewall I have ever used. And the best part is that it's free. LOL

This information comes directly from one of our MS-MVP's (thanks much, Bill). I'm quoting him verbatim just to make sure that nothing gets lost in translation. Let's give it a go and see what comes up.

"Bill_Castner" wrote:Have them do all the items in the Quick Launch section of MS-MVP Kelly Theriot's Taskbar Repair Plus:
http://www.kellys-korner-xp.com/taskbarplus!.htm

The best course of action for a situation like this is to create a new user account, and then copy the vitals from the old one. There is nothing you can do if essentially the NTUSER.DAT file is corrupt, which is what it sounds like. Give them this KB Article to follow: http://support.microsoft.com/?kbid=811151
Make sure they note Step #4 in the copy old user profile information, the second section of the article. Those areas are not to be copied.

They can remove the older user account after testing.

Merry Christmas and keep me posted.

George

Hi SCB,

OK, I did as you suggested and created a new user account. That worked a treat and also gave me a chance for some spring cleaning of old options I no longer use. And the Quick Launch Toolbar loads beatifully.

Many thanks for all your help and thanks to Bill as well,

Andy

Hi Andy,

That's great news. Glad you got your Quick Launch back. It's one of those things that isn't a necessity but you certainly miss it when it's not there.

There is an interesting series of posts in the Debating Chamber here at MRU between Bill and Kimberly (one of the teachers here as well as a MS-MVP) regarding desktop/taskbar issues. Apparently the area of the registry which handles these tasks is quite a murky place to visit. I have to admit that after the first exchange, they left me in the dust. Fun to follow though.

I'll pass along your thanks to Bill.

Safe surfing!

George

Glad we could be of assistance.

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.