BleepingComputer.com: PUM.Hijack.StartMenu Found....Program windows dont minimise to taskbar & no start menu shortcuts stay pinned

Hi there,

Im currently using windows 7 & recently I havent been able see any programs in the first view of the start menu, whereas before I had a couple of shortcuts pinned to it, but i cant see any of them. Also I cant see any open programs in the taskbar, hence have to use task manager to switch between different open programs.

I recently ran a full scan on malwarebytes and it found something called PUM.Hijack.StartMenu. I'm not quite sure what to do next as the start menu/taskbar hasnt gone back to normal.
If someone could help me with this, I would really appreciate it.

Thanks!

This post has been edited by hamluis: 30 June 2011 - 01:43 PM
Reason for edit: No logs, moved from MRL to AII.

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=======================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

Thank you for your reply & your help, below are the logs you requested.

Results of screen317's Security Check version 0.99.7
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
McAfee Security Scan Plus
McAfee SecurityCenter
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 24
Out of date Java installed!
Adobe Flash Player 10.0.45.2
Adobe Reader 9.4.4
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.16)
````````````````````````````````
Process Check:
objlist.exe by Laurent
``````````End of Log````````````


Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6981

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

30/06/2011 09:58:28
mbam-log-2011-06-30 (09-58-28).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 443238
Time elapsed: 2 hour(s), 54 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

How is your Start Menu now?

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
  
• Accept any prompts.

================================================================================

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

==============================================================================

Please download Rootkit Unhooker from one of the following links and save it to your desktop.

Link 1 (.exe file)
Link 2 (zipped file)
Link 3 (.rar file)

In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can download, install and use the free 7-zip utility.

• Double-click on RKUnhookerLE.exe to start the program.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• Click the Report tab, then click Scan.
  
• Check Drivers, Stealth, and uncheck the rest.
  
• Click OK.
  
• Wait until it's finished and then go to File > Save Report.
  
• Save the report to your Desktop.
  
• Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

Hi there,

Thanks again for your reply. I have updated java & adobe as requested. I also attempted to use the rootkit unhooker, however after downloading it, i double clicked the application and recieved an error saying "sorry, but unhandled exception has occured. Program will be terminated. Exception code: 0xC0000005. Instruction address: 0x00402EAA. Attempt to read at address: 0xffffffff. error log generated, please report to developers'

Also the start menu/taskbar still have not returned to normal.

Many thanks!

This post has been edited by starlight24: 01 July 2011 - 07:29 PM

Let's see, if we can recover your missing features.
Download and run UnHide

=================================================================

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

Hi there,

I used the programs you told me to, unfortunately the unhide program didnt recover the items from the 1st page of the start menu & also open programs still do show up on the taskbar.

Below is the log from gmer:
GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-07-02 08:10:33
Windows 6.1.7600
Running: zurbgbpp.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\5063138bfa70
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\5063138bfa70@3cf72afa8298 0x39 0x95 0x4B 0x78 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\5063138bfa70@002345cedd23 0x92 0x49 0xCE 0x20 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\5063138bfa70 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\5063138bfa70@3cf72afa8298 0x39 0x95 0x4B 0x78 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\5063138bfa70@002345cedd23 0x92 0x49 0xCE 0x20 ...

---- EOF - GMER 1.0.15 ----

Many Thanks!

GMER log looks fine.

Quote

What do you mean by "1st page"?

Quote

That's unclear. Please explain.

Hi there,
Sorry what i meant to say is that when you intially open the start menu, there should be recently opened items and shortcuts to my computer, control panel, etc pinned, however, since this problem - these things have disappeared and all i can see now is the all programs button, which leads to the drop down menu. Since then i have attempted to repin items to the start menu but it doesnt work.

With regards to the taskbar, generally when you open several programs, you can see a list in the taskbar & also the programs will minimise to the taskbar & you can easily switch between programs by clicking on the taskbar. However, the problem im having is that when I do have programs open, they will minimise but nothing appears on the taskbar, making it difficult to switch between programs - so right now i've been using task manager to switch between different programs i have open.

Also another thing i forgot to mention as im not sure if its relevant, but i have been having programs updating windows with one particular update - its the windows 7 service pack 1 update, it continually fails so im not sure if this is all related.

I hope this makes things a lil clearer, many thanks!

Quote

What happens?

As for your taskbar issue...
WARNING!!! This suggestion involves editing of the registry. Improper editing of the registry can cause your computer to become unbootable. ALWAYS backup your registry before modifying the registry.

To backup your registry, create a System Restore point. Alternatively, you can use the free utility ERUNT to create backups of your registry: http://www.larshederer.homepage.t-online.de/erunt/

For more information about modifying the registry, see this Microsoft article: http://support.microsoft.com/default.aspx/kb/256986

~~~~~~~~~~~~~~~~~

Try 240. Programs Aren't Minimized in the Taskbar here: http://www.kellys-korner-xp.com/xp_tweaks.htm
It's listed as Windows XP fix, but apparently it works in Vista and Windows 7.

This post has been edited by Broni: 03 July 2011 - 10:34 AM

Hey,

Thanks again for your swift reply. I tried to fix the taskbar problem as you requested, unfortunately that didnt solve the problem.

With the start menu, you can drag and attempt to pin something to it, e.g. my documents, but instead a not allowed sign (red circular sign with a diagonal line through it) appears on whatever you attempt to pin. Hence it doesnt work.

Many Thanks!

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64-bit users go HERE

• Double-click SystemLook.exe to run it.
  
• Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
  
• Copy the content of the following box into the main textfield:
  

  :dir
  C:\ProgramData
  

  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook 04.09.10 by jpshortstuff
Log created at 22:38 on 03/07/2011 by Beena
Administrator - Elevation successful

========== dir ==========

C:\ProgramData - Parameters: "(none)"

---Files---
ezsidmv.dat --a---- 56 bytes [21:14 31/03/2010] [21:14 31/03/2010]

---Folders---
Adobe d------ [19:00 16/12/2009]
Advanced Chemistry Development d------ [12:45 07/04/2010]
Apple d------ [21:58 31/03/2010]
Apple Computer d------ [21:59 31/03/2010]
Application Data d--hs-- [05:08 14/07/2009]
Creative d------ [11:45 31/03/2010]
CrioGames d------ [00:12 08/03/2011]
CyberLink d------ [12:03 31/03/2010]
Dell d------ [19:06 16/12/2009]
Desktop d--hs-- [05:08 14/07/2009]
Documents d--hs-- [05:08 14/07/2009]
Favorites d--hs-- [05:08 14/07/2009]
GOA d------ [10:19 12/03/2011]
Hewlett-Packard d------ [08:33 08/07/2010]
HipSoft d------ [12:21 04/06/2010]
Immortal Lovers d------ [05:04 17/11/2010]
Installations d------ [00:14 05/11/2010]
iWin Games d------ [12:28 21/06/2010]
Macrovision d------ [19:18 16/12/2009]
Malwarebytes d------ [21:24 09/04/2010]
McAfee d------ [20:08 23/03/2010]
McAfee Security Scan d------ [21:36 10/05/2010]
Microsoft d------ [03:20 14/07/2009]
Microsoft Help d------ [00:01 05/04/2010]
Mozilla Firefox d------ [00:20 11/05/2010]
MumboJumbo d------ [19:58 14/11/2010]
Nokia d------ [23:02 04/11/2010]
NokiaInstallerCache d------ [20:25 04/11/2010]
NokiaMusic d------ [23:20 28/09/2010]
Oberon Media d------ [14:41 24/04/2010]
OviInstallerCache d------ [23:17 28/09/2010]
PC Suite d------ [23:23 28/09/2010]
PCDr d------ [19:02 16/12/2009]
PlayFirst d------ [02:57 17/11/2010]
Playrix Entertainment d------ [19:48 09/03/2011]
Skype d------ [21:09 31/03/2010]
Sonic d------ [19:18 16/12/2009]
Start Menu d--hs-- [05:08 14/07/2009]
Sun d------ [17:27 01/04/2010]
SupportSoft d------ [19:02 16/12/2009]
TEMP d-a---- [14:49 24/04/2010]
Templates d--hs-- [05:08 14/07/2009]
Uninstall d------ [19:18 16/12/2009]
Yahoo! Companion d------ [14:15 01/07/2010]
{93E26451-CD9A-43A5-A2FA-C42392EA4001} d------ [22:29 31/03/2010]

-= EOF =-

Re-run System Look with this code:

:reg
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage

SystemLook 04.09.10 by jpshortstuff
Log created at 08:33 on 04/07/2011 by Beena
Administrator - Elevation successful

========== reg ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage]
"StartMenu_Start_Time"=65 35 1b 5e c6 d0 ca 01 (REG_BINARY)
"StartMenu_Balloon_Time"=15 a0 7a 37 c3 39 cc 01 (REG_BINARY)

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts]


-= EOF =-