Hi,

I saw a posting on a problem that is very similar to mine. I am unable to view my desktop icons, start menu bar, or explorer after logging in either threw a normal startup or threw safe mode. I have attempted to use the Task Manager to run Windows Explorer and am unable to do so. I have also attempted run Internet Explorer and have been unable to run that either. I have run CHKDSK and found no bad sectors and have run sfc /scannow without any indications of issues but still have the same issue. I have looked in my registry under the following location for Explorer or IExplorer and did not find it.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

I still have access to the internet threw my main computer however the machine that has the trouble is my laptop and I just started having this issue late last night. I will do my best to provide you with any more information that I can and hope this issue can be resolved.

I am using a Sony Vaio VGN-FS1760/W Laptop with upgraded memory to 2Gigs and 100 GB HDD. I have Windows XP home SP3 and it generally has the latest updates from Microsoft.
Eric

This post has been edited by StarrEj: Oct 27 2009, 09:54 AM

Hi StarrEj, welcome to WTT.

When you boot to Safe Mode, can you login as Administrator (no password)? If so, is it's desktop (icons, taskbar, etc.) okay? If yes, you can try creating a new account, then boot normally and login as the new account and see if that desktop is okay. If yes then you have a couple options.

1. Keep the new account and copy everything from the old, non-working (aka corrupted) account to the new one.

If you have a corrupted account (user profile) where things are all messed up when you login or you can't login then follow the directions here to create a new account and copy all your user data over to it:

http://support.microsoft.com/?kbid=811151

Or follow these directions posted in GeeksToGo.com

• Boot to Safe Mode, login as Administrator
• Show hidden files by opening My Computer, Tools menu, View tab, check Show Hidden Files/Folders and uncheck Hide extensions for known filetypes. Click Apply then OK.
• Create a new Administrator level account via Control Panel / User Accounts.. Pick a good name as you will be keeping it.
• Reboot the computer.
• Login with the new account so the folder structure under Documents and Settings gets created, then log off.
• Boot to Safe Mode, login as Administrator
• Browse to c:\documents and settings\OldUserAccount
• Select everything in that folder except the three files called ntuser.dat, ntuser.dat.log, and ntuser.ini.
• Copy all those files into c:\documents and settings\NewUserAccount. Reply Yes or Yes to all when duplicate folders or files are found.
• Reboot the computer and login with your New user account.

Once you confirm that all your documents are located in My Documents of the New user, you can delete the old profile.[/list]

2. Try to repair the registry entry that points to the old account.

Before doing any of the following, make a backup of your registry. I suggest you install ERUNT to do this.

Your files are still there. Sounds like your user profile has lost it's connection with where it's data is stored.
If you are comfortable with using regedit, try this by booting to Safe Mode by pressing F8 during boot. Login as Administrator, no password.

The key is a registry entry that redirects Windows back to the ProfileImagePath of the original profile.

Click on Start then Run, type regedit[/b] and press Enter. Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Once there, you will see the SID's listed for all of the profiles on the machine. Something like this:

S-1-5-18
S-1-5-19
S-1-5-20
S-1-5-21-1343024091-1409082233-839522115-1003

Within the Key for each SID there is an entry called ProfileImagePath that will look like

%SystemDrive%\Documents and Settings\UserName...

Scroll through the SID's until you find the one with the screwy name, like

%SystemDrive%\Documents and Settings\youruserid.2

This is just an example, could be someithing else weird.

Just edit the Key to remove the ".2", and it will point the user back to their old profile...

Got this from: http://techrepublic.com.com/5208-6230-0.ht...ssageID=1914470

Also some excellent information here: http://www.lockergnome.com/it/2004/12/15/g...p-user-profile/

Hi Rich,

When trying to login to either my main account or the administrator account I experience the same issue with no icons, start menu or the ability to run almost any program. I am able to open “regedit” when logged in to either account in normal mode or safe mode by using the task manager new task button. I am wondering if I should go ahead with your step 2 recommendations and try to repair the registry entry. I do feel comfortable with registry editing and would like to proceed with that step.

When looking at the ProfileImagePath I found no anomalies in the user names. The 2 users along with administrator and NetworkService and LocalService and finally %systemroot%\system32\config\systemprofile

All users besides the last one were under %SystemDrive%\ Documents and Settings.

I hope that this information helps narrow down the issue.

Thanks,
Eric

I would try solution #1 then.

Does Ctrl+Alt+Del bring up the Task Manager? If so, enter nusrmgr.cpl in the FIle / New Task (Run) box. That should bring up the User Accounts dialog. Follow the directions as posted to create a new account and see what happens.

Rich,

When attempting to run nusrmgr.cpl from File/ New Task (Run) it thinks about the process and closes the task manager, then I have to bring it back up.

Eric

One more attempt. Try

control nusrmgr.cpl

see if that works.

Rich,

The operation results in the following message being displayed:

"Windows cannot open the User Accounts control panel."

This is the first time it has even tried to open that application, however it still did not succed but actually made the attempt without closing the task manager. When I attempted the command you suggested I had to reboot the machine as it had gotten locked up and right after selecting the user, I opened the task manager to run the command. I attempted to run the command a second time 5 min later and did not get the message as before. Instead the task manager closed and I re-opened it. I am posting a list of what is running currently in my task manager.

SYSTEM: System Idle Process, System, VESMgr.exe, svchost.exe(4), VCSW.exe, ViewpointService.exe, VzCdbSvc.exe, DkService.exe, gearsec.exe, smss.exe, csrss.exe, jqs.exe, winlogon.exe, services.exe, lsass.exe, MDM.exe, EvtEng.exe, sqlservr.exe, S24EvMon.exe, nvsvc32.exe, PWIUtilityService.exe, RegSrvc.exe, ISWSVC.exe, Spoolsv.exe, vsmon.exe, VzFw.exe, VzRs.exe, alg.exe

LOCAL SERVICE: svchost.exe(2)

NETWORK SERVICE: svchost.exe(2), wmpnetwk.exe

My User: taskmgr.exe, ctfmon.exe

I hope this information helps further isolate the problem. I suspect I either have a corrupted/infected file, or a virus program running as there are some things running I do not recognize.

Thanks,
Eric


**Update**
I feel very dumb for not noticing sooner, but I have been trying this while in normal mode. When attempting the same steps in safe mode I was able to create another administrative level user. When logging into that new user, I found myself with the exact same set of problems. No desktop icons, no start menu bar and unable to run explorer or internet explorer from the task manager. I rebooted back into safe mode and logged into the newly created user and had the same issues.

I appologize for the mistake on my part.

Thanks,
Eric

This post has been edited by StarrEj: Oct 30 2009, 11:44 AM

Eric, all your running processes look legitimate. I don't see anything that is virus/malware related.

This does smell like malware of some kind though. I'd suggest you go to the HijackThis™ Logs and Infections Removal forum, read the info there and follow the posted directions. Once you receive a clean bill of health, come back here if you have any additional questions or concerns or it turns out not to be a malware problem.

Please be patient as that is a very busy area. If you do not receive a response in 3 days, post a message here: http://forums.whatthetech.com/What_Do_If_Y...ays_t78698.html

When you post there, be sure to include a pointer back to this thread. It may help the malware person check your system).