DR. WATSON POST MORTEM ERROR: hijackThis log included.

I have lost all my files in "my documents." I tried system restore and it didn't restore the files. Then once when i was restarting my pc, an error came up as dr. watsom post mortem. I have never installed this, and when i looked at google, people said it could be a virus. can anyone help me? Below i have a HijackThis log file, hope it helps:

Logfile of HijackThis v1.99.1
Scan saved at 4:11:39 PM, on 4/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe
C:\Program Files\Offline Course Player\OlpSynch.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\Chinky\LOCALS~1\Temp\Temporary Directory 1 for KillBox.zip\Killbox.exe
C:\Documents and Settings\Chinky\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop&parm1=seconduser
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop&parm1=seconduser
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop&parm1=seconduser
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop&parm1=seconduser
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop&parm1=seconduser
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Firefox is Better than me
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [OLPSYNCH] C:\Program Files\Offline Course Player\OlpSynch.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136585911437
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.18.39/ttinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WBSrv - C:\WINDOWS\
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: OracleOraHome92PagingServer - Unknown owner - C:\oracle\ora92/bin/pagntsrv.exe
O23 - Service: OracleOraHome92SNMPPeerEncapsulator - Unknown owner - C:\oracle\ora92\BIN\ENCSVC.EXE
O23 - Service: OracleOraHome92SNMPPeerMasterAgent - Unknown owner - C:\oracle\ora92\BIN\AGNTSVC.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Smart Card (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

yknihcAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David-HowardCommented:
Here's an analysis of your log file.
http://www.hijackthis.de/index.php#anl
You can post them at this link in the future for free analysis.
http://www.hijackthis.de/
It doesn't show anything really malicious.
I would suggest running your anti-virus and antimalware utilities in Safe Mode.
Anti-malware: http://www.ewido.net/en/
Anti-Virus: http://usa.kaspersky.com/downloads/trial-versions.php
(Both are free to try)
:-)
0
David-HowardCommented:
Just visited the first link I gave you and the log file was gone.
Locate the first entry in your log file that starts with R1 and copy everything from that point to the last 023 entry. Paste them in this url. Go to the bottom of that link and select Analyze.
http://www.hijackthis.de/
0
r-kCommented:
Here is a link to the saved analysis:

 http://www.hijackthis.de/logfiles/2de9c7d914502e5b89625ee074912640.html

I can't see anything there that would explain your problem, though the following is a bit odd:

 O20 - Winlogon Notify: WBSrv - C:\WINDOWS\

Can you explain a bit more about how you came to lose files in "My Documents"
FYI: System Restore will not restore user files, only certain system settings and files.

It is possible the files are there in some other folder on your C: drive. I would right-click on the C: drive (in Explorer or My Computer), select "Search" and type in the name of a file that I knew for sure was in "My Documents". Then repeat this for a couple of other files.
0
Top Threats of Q1 & How to Defend Against Them

WEBINAR: Join WatchGuard CTO and our Threat Research Team on Aug. 2nd to hear the findings from our Q1 Internet Security Report! Learn more about the top threats detected in the first quarter and how you can defend your business against them!

yknihcAuthor Commented:
I turned on my PC a few days ago, and up until then, everything was top notch. Then, when i first logged in, i noticed my wallpaper and all desktop icons exept my computer and recycle bin were gone. when i tried to refresh my destop it said that C:\documents and settings\[user name]\desktop was not found. Then i looked in my music folder and all my songs were gone, and also my files in my documents. when i tried SFC/ SCANNOW in safe mode, it gave me one of those windows error reporting messages.
0
r-kCommented:
If your files are/were important, I would use the system as little as possible until they are recovered.

Did you have any luck with "Search" on the C: drive to look for specific files that seem to be missing?
0
yknihcAuthor Commented:
No, it didn't find anything, but i am pretty sure that the used disk size is the same from before, which means im the files are probably here.
0
r-kCommented:
Here is what I suggest:

Connect your drive as a slave drive to another system, then get and install the demo version of GetDataBack from:

 http://www.runtime.org/gdb.htm

on that other system, and see what files can be recovered with that.

If you install programs on the disk with missing files you'll be putting them at risk.
0
David-HowardCommented:
Have you attempted to create a new user account?
If you can do that and the desktop under that account appears normal then you have some of the answers that we need.
0
yknihcAuthor Commented:
I created a new acount and it when i first logged in, the desktop had recycle bin, help and support, and internet explorer icons. there was no my computer. Then as it loaded, a error message came up saying C:\Hp\wallpaper\WBDCC341.DLL was corrupt. Thats all it said.
Note: WBDCC341, the 1 might have been a "l" as in lion.
0
r-kCommented:
Depending on how important your lost files were, I would suggest not doing anything on the disk, such as creating new accounts or installing new files/programs. Every new thing you do has the potential to destroy any files that could be recovered.

It is better to boot from another disk and then do troubleshooting or data recovery.

If the files were not important or you have a good backup, then consider reformatting the disk and starting over.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
David-HowardCommented:
Yknihc,
At this point (and if this were my system) I would copy desired data (Office files, tax files, IE Favorites, etc.) and either do a repair: http://www.michaelstevenstech.com/XPrepairinstall.htm#warning2
or perform a clean installation. You'll obviously need your XP CD and your CD key for this.
Your problem reminds me of one I've encountered before. IE was corrupted and it affected my desktop icons. I never realized how intertwined IE and the OS were until that issue. A repair of IE solved my problems. If you decide to nuke your hard drive and start completely from scratch you might try a reinstall of IE just for fun.
IE Reinstall:
While you are logged on as an administrator, (Or as a user with Administrative privileges) click Start, and then click Run.
In the Open box, type regedit, and then click OK.
Locate the appropriate registry subkey, right-click the IsInstalled (REG_DWORD) value, and then click Modify.
To reinstall only the Internet Explorer 6 browser component on Windows XP, use the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
To reinstall only Outlook Express 6 on Windows XP, use the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
Change the value data from 1 to 0, and then click OK.
Quit Registry Editor, and then install Internet Explorer 6.
To reinstall Windows XP updates, visit the following Microsoft Windows Update Web site:
http://windowsupdate.microsoft.com/
Remember...save desired data first no matter which action you choose. :-)

0
David-HowardCommented:
One more item. If you haven't performed a search for your data/doucments you can do that easily enough.
Click Start>Search>Files or Folders. Do a search for *.doc and see what you get. If you have Excel and Access items you can search for *.xls and *.db.
0
r-kCommented:
Look in the folder named "c:\documents and settings" You may see a couple of user names that are similar to yours. Browse there for the missing files.
0
yknihcAuthor Commented:
AppName: explorer.exe       AppVer: 6.0.2900.2180       ModName: occache.dll
ModVer: 6.0.2900.2180       Offset: 00009449
Thats part of the windows error message when windows explorer closes. When i tried to search for my files, it started searching then said windows explorer has encountered a error and needs to close. Thanks for all you details about how to fix my computer, but i really need to recover my files first (or figure out where they are.
0
David-HowardCommented:
If you are unable to browse or search for files I recommend reinstalling IE. Reinstalling IE will not delete any data files. This should allow you to perform a normal search. :-)
0
r-kCommented:
If the files are important please refrain from installing anything more on that disk. Instead, either attach that disk to another computer as a slave disk, or boot from a CD that contains data recovery software. If you're not familiar with how to do either of these then try to find a local expert (friend, computer store etc.) who can assist you. It all depends on the importance of the lost files, of course.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Vulnerabilities

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.