[Closed] No icons, start menu or taskar on login

Hi All, I dearly need help with my computer issue. My system recently and for the very first time does not show any desktop icons or startmenu button when i log into my account. My OS is Win XP Sp3 / norton corporate edition / sypbot teatimer / On login, there is a brief flash of the taskbar with the Start menu button, but then it goes blank and displays only the desktop background. I am able to access task manager by CTRL-ALT-DEL, but right click on the desktop does not bring any response. Even in safe mode, it does not show the icons. I have tried running explorer.exe through taskmanager, but nothing happens. I can run any other programs through new tasks under task manager. When i look at the processes running, I notice it is not loading any of the user startup programs and sometimes none of the usual system programs. I have run Spybot search and destroy, Malwarebytes anti-malware, spywareblaster on the system. None of them found any infections. Recently installed and untinstalled Microsoft Activesync 4.5; When installed, the program first recognized my phone but could not do any syncing at all. So I removed it. System was running properly after I did that, but within a day this issue popped up. So not sure if Activesync messed up anything. I have the log of Hijackthis, but not sure what the proper procedure is in this forum to post it here. (paste or Attach as file?) I really hope one of you can guide me. Thank you so much, Raam. Just wanted to add to this the following: a) I have tried to restore the system to the working configuration before the installation of active sync, but even then it does not work. Surprisingly, it did not have any restore points for the previous months while I was under the impression, it will be there for atleast a month's time. I looked at the registry settings and do not see any of the following key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe There is no keyword 'image file execution options' at all under current version.

Hi Raam ,welcome to the forum.

To make cleaning this machine easier

• Please do not uninstall/install any programs unless asked to
  It is more difficult when files/programs are appearing in/disappearing from the logs.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
• Do not attach any logs/reports, etc.. unless specifically requested to do so.
• If you have problems with or do not understand the instructions, Please ask before continuing.
• Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

We'll see if there is a copy of explorer.exe somewhere on your computer and check for the registry key just to be sure.

It is important that you do not minimize you browser, taskmanager or the tool I'm going to have you download. If you do you will loose them and will need to start over.

Note: When you download this tool to the specified location, it will not be visible to you. We will launch it via the run command.

Please download SystemLook from one of the links below by

• right clicking the link and clicking Save Target As
• In the Save As window, using the dropdown menu set the Save In box to Local disk (C:)
• make sure the filename is SystemLook.exe and the type is Application
• click Save

Download Mirror #1
Download Mirror #2

Open Task Manager with ctrl,alt,del as you have been doing.

• In Task Manager, click the Options button
• check mark Allways on Top
• This will keep Taskmanager from disappearing when you click on anything else.
• Using your left mouse button, click on the top blue portion of Task Manager and slide it down to the lower part of your screen so these instructions are visible.

Next

• Holding down your left mouse button, highlight all the text in the codebox below.
• Do not copy the word CODE , please note the script starts with the :
• right click the highlighted text and choose copy

:reg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe

:filefind
explorer.ex*

In Task Manager

• click file
• click New Task(Run…)
• type the following line into the open: field
  C:\Systemlook.exe
• click ok

SystemLook should appear on your screen.

• Right click anywhere in the white field and choose paste.
• the text you copied earlier should appear
• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan.

Please post this log in your next reply.

If you loose the notepad before you can post the contents, you may retrieve it copying and pasting this command in the Task Manager open box.
%userprofile%\desktop\SystemLook.txt

Thanks

Hi, Thank you for your reply. I am unable to download anything from the web as t does not seem to restore the internet access when i log in. so i download the program to a jumpdrive, copied onto the desktop and ran it. I have attached the result to this post

Hi Raam,

Since you are using a jump drive and a clean computer, let's try to give them some meassure of protection.

On the clean computer

When running this tool on the clean computer make sure your jump drive is attached. When attaching the jump drive, please hold down the shift key while attaching the drive.

Download Flash_Disinfector.exe by sUBs and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

Download OTL to your jumpdrive.

Next

Create this file to be transfered to the infected computer.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav

In the notepad

• Click File, Save as…, and set the Save in to your jump drive
• In the filename box, type (including quotation marks) as the filename: "OTLScript.txt"
• Click save

On the infected computer

Transfer OTL to your computer's desktop

• Open the text file you created
• Right click the text and select Select all
• Right click again and select copy

In Task Manager

• click file
• click New Task(Run…)
• type the following line into the open: field (including the "" marks")
  "%userprofile%\desktop\otl.exe"
• click ok

OTL should appear on your screen.

• When the window appears, underneath Output at the top change it to Minimal Output
• Check the boxes beside LOP Check and Purity Check.
• In the window below Custom Scan/Fixes, right click and select paste. The text from the text file should appear
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

You may not be able to see the Extra.txt as it will open minimized. The OTL.txt should open, please save it to your flashdrive. If you can locate the Extra.txt please save it to youe junp drive also.

Please post back with the OTL.txt and the Extra.txt if you found it.

Thanks

Hi there, Thank you for the detailed instructions. I ran the files as you said and please find attached the OTL.txt. I could not find the extra.txt. I looked for it ,but nothing opened up on the task manager. Please let me know if I have done it correct. Thanks much for your time, Raam.

I Raam,

I see you have Avira antivirus and Symantec antivirus installed. 2 antivirus programs are not better that one. They will conflict and lead to problems.

We can try to access add/remove programs from task manger and uninstall one of them. Please let me know which one you decide to remove.

I see you also ran combofix. This is a very powerful tool that should not be used without supervision. Unexpected results may occur. Let's see if we can retrieve the logs.

Save these 2 lines in a notepad and copy them to your flash drive.


c:\ComboFix.txt
C:\Qoobox\combofix-quarantined-files.txt


On the infected computer

In Task Manager

• click file
• click New Task(Run…)
• copy and paste the lines from the notepad, one at a time into the open: field , clicking ok after each.

If the text files are there they should open. Please post them in your next reply.

Hi, I have always had only one antivirus on the system. only installed Avira just after this desktop issue happenned, since I could not figure out if norton was running. But now I have removed it. As far combofix, i came across one of your help for another person with similar problems. I was going through the steps and started combofix, but it did not complete since I dont have internet connection on the system. What do you suggest I do to run it without internet connection for recovery console? Thank you very much for your time and patience, Raam.

Hi Raam, Before we try combofix, have you tried booting to Safe Mode with Networking?

Hi, I did try safemode as well as safemode with networking…in both cases, no desktop or icons, but tank manager can be accessed. And no internet at all. Before this I had no issue at all with internet. When i look at the processes running, its loading only system processes. Nothing of the user processes are loaded.

I am sorry about the slow reply; just able to see it only in the evening to respond. Thank you, Raam.

Hi Raam,

Please use SystemLook again with this script.

• Do not copy the word CODE , please note the script starts with the :
  

  :reg
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Hi, I ran the system look again with the new code. I have attached the results of the run.

Hi Raam, When you started to run combofix, how did you run it? Was it from task manager?

Yes it was from task manager ….i had tried it only because I was reading one of the forum postings where you had another person successfully with the same missing desktop issue. Should I run it again?

Hi Raam, Please run it.