Virus ate my Desktop Explorer

Hi What the Tech, I posted in the hijack this forum, and you were all very helpful in clearing my system of all malware. It was recommended that I post in this forum to get some help with windows. I have no explorer, and have no idea how to get it back. I don't have a system restore disk unfortunately (who knows where it ended up). Can anyone help? Toby

Hi Toby… Are you saying that when you boot windows none of your icons/start menu come up? But, if you open task manager (ctrl-alt-del) and select file -> run -> type 'explorer' and press Enter that it will come up? Malware tends to destroy to important registry entries that could be causing this problem. Please do this: Click start -> run -> type 'regedit' and press ENTER. EDIT: Obviously you cant click start. Open task manager, select file -> run -> type 'regedit' and press ENTER. Sorry for my lapse. Navigate to the HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon folder. First, right click the Winlogon folder and select export. Choose a filename like JanRegBackup.reg and save it to your desktop. This will protect you from any accidental mistakes you might make following the rest of my instructions. Now, check the following three entries under the Winlogon folder to make sure they are correct: Shell REG_SZ = Explorer.exe UIHost REG_EXPAND_SZ = logonui.exe Userinit REG_EXPAND_SZ = C:\WINDOWS\system32\userinit.exe, (Please pay attention to the trailing comma. It does belong there!) If any of the entries are different, please double click them and change their values to the above listed value. Reboot your PC and see if explorer boots normally now.

everything was the same except the Userinit REG_EXPAND_SZ was only listed as userinit REG_SZ. (without the expand)

oh yeah, and no the explorer can't be brought up with the task manager. It says windows cannot find explorer.exe

Ahh.. that is a critical piece of information. Please open My Computer and do a search of your C: drive for explorer.exe and explorer.ex_ Post back here all the files it finds and their locations, as well as their size and date modified. In order to see this information make sure you are viewing by details. (View -> details) Edit: I keep forgetting you can't see any of this stuff. I don't know of a better way to do this, so do this: open task manager, click file -> run -> type 'cmd' and press ENTER. At the command prompt type 'cd \' and press ENTER. Then type 'dir explorer.ex* /s' and press ENTER. You will hopefully see at least one or two files listed with similar information you would've seen in a standard windows search. Please post the above mentioned information back here in the forum. Double Edit: Do you have a windows XP installation disc for your computer?

Hi,

Let's see if we can get explorer.exe from another location

Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as All Files and name it "expl.bat" (including quotation marks). Please save it on your desktop.

copy /-y c:\windows\system32\dllcache\explorer.exe c:\windows\explorer.exe

Double click expl.bat. A window will open and close. This is normal. If it does not close and asks you to overwrite an already existing file, deny that and let me know it wanted to overwrite.

Please let us know.

Regards,
John.

ok, for the first posting, I did the search in cmd and came up with 5 files. They are as follows directory of C:\windows directory of C:\windows\$hf_mig$\kb938828\sp2qfe directory of C:\windows\$ntuninstallkb938828$ directory of C:\windows\softwaredistribution\download\dd9ab5193501484cf5e6884fa1d22f9e Directory of C:\windows\system32\dllcache Under each was a date, time and explorer.exe. Before the files it says "volume in drive C has no label. Volume serial number is D81C-74AE" No, I unfortunately don't have a back up cd for my desktop. I do have one for my lap top, but I'm nervous to use it. Is it a lot different do you think? As for the second posting, I created the notepad file and ran it through task manager. The window opened and quickly closed. No prompts.

The directory listing that you gave corresponds with the information John B gave you. If you typed the commands in properly, explorer.exe should've been moved to the proper location and you should now see different results when you reboot your computer. (Hopefully it boots properly now) If it doesn't, go back to a command prompt and type 'dir c:\windows\explorer.exe' and press ENTER. See if it says File not found. If it says File not found, please try typing 'copy c:\windows\system32\dllcache\explorer.exe c:\windows' and press ENTER. See if it is successful, or if there is an error. If successful, try rebooting again and see what happens. If an error, let us know.

Hi,

As for the second posting, I created the notepad file and ran it through task manager. The window opened and quickly closed. No prompts.

Through task manager? You just need to double-click the file you just created on your desktop. Does your system boot properly now?

Please let us know.

Regards,
John.

John, the user's desktop is not available because explorer is not starting. The only access the user has is through task manager.

Alright, but I thought he'd be starting explorer in the dllcache by Task Manager. Well, then, do you still have the problem of explorer.exe not starting at startup? Can you please check if it is in the C:\Windows folder now.

So I restarted the computer, and sure enough, I have explorer again. Thank you so much for the help. It's been a month since I've had explorer working.