Hi joe5, sorry and apologies for being a bit flakey, I have been caught up with stuff.
Anyway I evenually managed to delete unregmp2.exe However the search function on the pc is not working but I removed taskmgrs.exe using hijackthis but I have no way to search the entire drive manually for taskmgrs.exe or rsmon.exe.
I have looked manually in a lot of directories but it could take days to cover the entire drive. Still no start menu but really looking forward to fixing this problem.

Cheers

Ian

oophs...hijackthis log file.

That was one long weekend.


Download and run this regfix and then try the searh again:

http://www.kellys-korner-xp.com/regs...ngservice2.reg



This file is from a worm , or the "Security Task Manager" application:

C:\WINDOWS\system32\taskman.exe

Do you use that app? If you dont know then please upload the file in bold to this site:

http://www.virustotal.com/en/indexf.html

And post back with the scan results.

Then boot in safemode (hit f8 when booting up)

Click Start>Run and type in: services.msc
Click OK
In the Services window find: Hardware Clock Driver
Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click Apply, then OK

Open HJT and click config > misc tools > ?delete an NT service?
Copy and past: hwclock
Click OK.

Then fix these with hjt if still present:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe

Delete the file in bold , reboot , and post a new hjt log please.


And where you just using system restore?

Joe5....update below

search still does not work, error msg says " windows cannot find "null", make sure........" and so on.

Taskman scanned clean on that site.

PC went through a restore process and I selected the April 25th. There was no restore points going back to last year when the problem started.

HJT log file attached......help

Cheers

ian

That sounds good , but do you also have the "Security Task Manager" installed on youre pc?

And it looks like this log was made in safemode? If yes , could you post a new hjt log made in normal mode?

hi joe5, back again, this time problems with buying new house, wish I could buy time.

How do I check if security task manager is installed?

I will post a fresh HJT file in normal mode tonight.

determined to get this fixed soon.

Cheers