rand1038
ok, you need to show hidden files so please do the following.
Copy the contents of the code box to a plain text (notepad) document, name it showhidden.vbs and save it as type all files. Double click to run it. If you get a malicious script warning click to allow it to continue, it is perfectly safe.
Once that is done, boot into safe mode, then run HijackThis! and place a check mark in next to each of the following.
Close all browser windows and shut down all other programs with a placeholder in the taskbar.
Click "fix checked."
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll
O3 - Toolbar: TheSearchMall.com Bar - {4B8F38C7-62FC-4762-B9A0-27E63F768167} - C:\WINDOWS\System32\winsrm32.dll (file missing)
O4 - HKLM\..\Run: [nfcegplah] C:\WINDOWS\System32\nbwggw.exe
Do NOT reboot yet
Delete the following
File
You should be able to see it now since running the script
C:\WINDOWS\System32\nbwggw.exe
Search your computer for rundll32.exe which is a valid windows file, you will find copies of it unless it has been deleted which is a problem in itself. It is a hidden file so that may be why you couldn't find it before. We need to know the full path to each copy that you find with that exact filename in order to determine if there is one in the wrong place, which can cause the problem you are having with accessing folder options.
Once that is done, Reboot normally
Post a fresh log to this thread along with where you found rundll32.exe.
Copy the contents of the code box to a plain text (notepad) document, name it showhidden.vbs and save it as type all files. Double click to run it. If you get a malicious script warning click to allow it to continue, it is perfectly safe.
'Windows XP and 2000 only
'sets the search and explorer settings to show all files
'by Mosaic1
Dim Wshshell
Set Wshshell= Wscript.CreateObject("Wscript.Shell")
Wshshell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\IncludeSubFolders", 1, "REG_DWORD"
Wshshell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchHidden", 1, "REG_DWORD"
Wshshell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchSystemDirs", 1, "REG_DWORD"
Wshshell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden", 1, "REG_DWORD"
Wshshell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden", 1, "REG_DWORD"
MsgBox "Done"
Wscript.quit
Once that is done, boot into safe mode, then run HijackThis! and place a check mark in next to each of the following.
Close all browser windows and shut down all other programs with a placeholder in the taskbar.
Click "fix checked."
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll
O3 - Toolbar: TheSearchMall.com Bar - {4B8F38C7-62FC-4762-B9A0-27E63F768167} - C:\WINDOWS\System32\winsrm32.dll (file missing)
O4 - HKLM\..\Run: [nfcegplah] C:\WINDOWS\System32\nbwggw.exe
Do NOT reboot yet
Delete the following
File
You should be able to see it now since running the script
C:\WINDOWS\System32\nbwggw.exe
Search your computer for rundll32.exe which is a valid windows file, you will find copies of it unless it has been deleted which is a problem in itself. It is a hidden file so that may be why you couldn't find it before. We need to know the full path to each copy that you find with that exact filename in order to determine if there is one in the wrong place, which can cause the problem you are having with accessing folder options.
Once that is done, Reboot normally
Post a fresh log to this thread along with where you found rundll32.exe.
