None responding PC after removing malware using combofix

See my only other thread on malware removal.

Getting past user login, then nothing. No desktop icons. See my wallpaper and can open task manager, but can do nothing else.

Hi cobber, glad you got rid of the malware, sad you're having other problems but that is not unusual. Malware inserts itself into a lot of areas that XP needs to run correctly and sometimes in removing the malware, some part of XP itself is damaged. In your case it sounds like some kind of user corruption problem so please try creating a new user account and if it works okay, copy your data from the old, corrupted account to the new one. Then after a while, if you're satisfied you have everything you ned from the old account, delete it and all it's files.

http://support.microsoft.com/?kbid=811151

How do I get my START box to appear? Literally seeing nothing apart from my wallpaper

You can start Task Manager, right?

If so, use the File / New task (run) and enter explorer, see if that brings up your desktop with the Task bar. If not, boot to Safe Mode and login as Administrator (no password) and create the new account from there. Follow the section titled:

Create a new user profile on the workgroup computer

Explorer from task manager worked. Set up new admin account but having exact same issues. Once I run explorer I can do everying as normal. Just having to do this is a pain in the backsie.

See my only other thread on malware removal.

Getting past user login, then nothing. No desktop icons. See my wallpaper and can open task manager, but can do nothing else.

You told me this in the Malware topic:

It's still hanging between when I go through my login screen and when I'd expect my desktop icons to appear.

Does your desktop never show or is it just slow in showing?

Tried it without success. No change in behaviour. I'm logging on to my usual "~~~INTERNET~~~" user at the windows login screen. I then get the "Loading Your Personal Settings" feedback, which is staying on screen much longer than it is ever done before. After a minute it flicks off the blue log on screen and loads up my personal wallpaper and nothing else, no icons, no START, just the wallpaper. The box clicks away for a minute or two as if it trying to do something but never does - even left it overnight just to make sure it wasn't going extremely slow. But no, it just stops on the wallpaper. After opening up Explorer via Task Manager everthing works well. I've noticed that my USER in the Task Manager screen is 'Adrian' although I login through "~~~INTERNET~~~". When I ran 'Fix Explorer' it said I was in 'C:\documents and settings\Adrian'. I messed about with Users about 4 months ago when I had some issues with my wireless router/modem. The issues were resolved and never had issues since. Perhaps this is a contributory factor? Thanks Mohit AB

Cobber,

I am sorry you are having problems with you machine, I suggest you do the following:

Please post back and let us know how you get on and if we can help further.

kind regards,

Backup/archive/copy

To be on the safe side I strongly recommend that before doing anything at all you check that your back up/archive/copy of all your important data, drivers, files, settings, work, etc is 100% up to date accurate and reproducible, (even if your back up is even only a day or so out of date, it's worth updating it now.)
Also don't forget to check that you have all your application Installation CD's to hand together with the product keys (including those for Windows itself)

Windows Protected System File Checker SFC

• Start
• Run
• type:sfc /scannow (note the space between the c /)

Have your Win XP installation disc handy as if damaged files are found they will need to be copied across from your disc, if SFC can't find correct copies elsewhere.

Windows XP Installation disc not available or wrong Service Pack or SP1 when SP2/SP3 is needed. Please note that windows does not show a report at the end of the scan if all is fine with your system.

There are work- arounds to this problem but the easiest, by far is to borrow one and use that. It is perfectly OK to do this, for the purposes of running SFC,and if you ask around all your friends, you are likely to find someone who will be able to help you out.

SFC no disc, no friends able to help.

Well you will need to do it the harder way and as a registry edit will be required it is essential that you back up your registry before you do anything else. Then in the event of trouble it will be easier to repair your registry. Download ERUNT from here: link and take a moment to familiarise yourself with the programme and how to repair your registry with it if it should become necessary. At the same time it would be wise to create a System Restore point, post back here if you need instructions on how to do this.

For the alterations needed to run SFC If you go here link you will find detailed instructions on the copying of files and the system changes you need to make. When you have followed all the instructions, reboot you machine and try to run SFC again, and please let us know how you go.

Post back with more questions and an update.

kind regards,

Mohit, I have moved your post with the registry fix. Please don't post registry fixes unless one of the Team has looked at it. As you may very well know, registry changes can cripple a pc if not created or performed correctly.

Sorry Tate, I didn't know that. I will be more careful with them the next time. Thanks for removing the offending post. – Mohit

Hi Again I never got a CD with my machine, but I notice that I do have a c:\i386 directory. I don't have access to a CD either. I ran Scannow, without success - it asked for the CD about 2/3rds through. I checked all the registry keys. All of them were correct except HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ServicePackSourcePath which I changed to "C:\WINDOWS\ServicePackFiles" Rebooted and attempted SCANNOW again. But it's now asking for me to "Insert your Windows XP Professional Service Pack 2 CD now" right from the off. Guidance suggests that my C:\i386 folder is corrupt.

Hi Cobber,

It is unfortunate you have no OS CD, please attempt to borrow one as we cannot proceed until you at least are able to run SFC Scannow to verify your OS is not missing .dll files. The alternative is to get in touch with Microsoft, buy a CD, then proceed with the scan. Here is another contact that my also assist you.

best regards,

The following are the registry changes I used to make so that SFC would not require a XP CD if the C:\I386 directory existed, and was fully populated. I don't know if this still works with SP3 applied though.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]

"SourcePath"="C:\\"
"ServicePackSourcePath"="C:\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]

"SourcePath"="C:\\"

These were changed when I installed SP3 so I suspect it will no longer work as the \I386 directory probably has SP2 level files. If you decide to try it, please make sure you backup your registry first, using ERUNT.