Previous Topic Next Topic

Can't get to my Desktop

Closed
salmen45 Posts 7 Registration date Monday March 28, 2011 Status Member Last seen April 3, 2011 - Mar 28, 2011 at 05:03 PM
salmen45 Posts 7 Registration date Monday March 28, 2011 Status Member Last seen April 3, 2011 - Apr 3, 2011 at 09:32 AM
Hello,



<config>Windows XP / Firefox 4.0</config

Please, I hope you can help me,

I can't get to my desktop. I have to use task manager to run anything. I believe I have an infection. AVG popped up just before my computer locked up. It said something like Blackhole virus detected or something of that sort. After I rebooted, I had the problem. I ran ,from task manager, AVG, Super Anti Spyware, MalwareBytes,and a Registry cleaner. I also tried to restore to an earlier date, but after it looked like it went through, I said it couldn't restore. Then I did a repair with my Windows disk. I had an error while loading, couldn't find mscoree.dll. Same problem after that completed too. I installed Firefox and I'm able to get to the internet now. IE will never start up. I also tried changing explorer.exe in the registry. I hope you can help me avoid doing a format and clean install.

Thanks in Advance,
Sal
Related:

4 responses

Answer 1 / 4
Ambucias Posts 47310 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,163
Mar 29, 2011 at 05:42 AM
To help you, I must make a diagnostic and to do so, I require a log.

Open this link and download ZHPDiag :

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html


Register the file on your Desktop.

Double click on ZHPDiag.exe and follow the instructions.

the tool created two icons ZHPDiag and ZHPFix (we will use ZHPFix at the next step).

Double click on the short cut ZHPDiag on your Destktop.

Click on the Magnifying glass and run the analysys.

Wait for the tool to finished (maybe a long time)

Close ZHPDiag.


To transmit the report, click on this link :

https://authentification.site

Click on Parcourir and search the directory where you installed ZHPDiag (usually C:\Program Files\ZHPDiag).

Select the file ZHPDiag.txt.

Click on "upload »

Copy the url and post it here
0
Answer 2 / 4
salmen45 Posts 7 Registration date Monday March 28, 2011 Status Member Last seen April 3, 2011
Mar 29, 2011 at 05:32 PM
Here is the diagnostic you requested:

https://authentification.site/files/27678679/ZHPDiag.txt

Thanks so much for all you help,
Sal
0
Answer 3 / 4
Ambucias Posts 47310 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,163
Mar 30, 2011 at 04:56 AM
Dear Salmen,

Thank you for the log which was very long and took time to analyse.

I have good news and bad news.

The good news is that the system does not have any apparent virus.

The bad news is that I can bet you a dime to a dollar that your system will get infected again. I predict within a month or two minimum. Your system is a lamed lamb ready to be pounced on.

If you wish advice on how to better secure your system, all you need to do is ask.

I don't know what you did to the registry to fix explorer.exe, anyhow, to fix your issue, my suggestion is:

1- copy explorer.exe from other clean computer (from C:\WINDOWS)
2- in your computer go to C:\WINDOWS
3- show hidden files from (Tools - Folder Options - View - Show hidden files and folders)
4- delete explorer.exe and any other files start with explorer...
5- put the new file (explorer.exe)
6- log off or restart
7- log on

Good luck
0
salmen45 Posts 7 Registration date Monday March 28, 2011 Status Member Last seen April 3, 2011
Mar 30, 2011 at 05:49 PM
Thanks for looking it over. I feel a better knowing the virus is gone. But after I did what you said with the explorer.exe file, I still only have my wallpaper with no taskbar or icons. The only thnig is I copied the file from my laptop which has windows 7 on it , if that would make a difference. Do you have any more suggestions or do you think is time for a clean install of windows?

I really appreciate your time and effort,
Sal
0
Answer 4 / 4
Ambucias Posts 47310 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,163
Mar 30, 2011 at 03:45 PM
Salmen,

I received a tip from jack4rall and here is what he said:

Please have a look at this location my friend

O4 - Global Startup: C:\Documents And Settings\Sal\Desktop\Shortcut to explorer.exe.lnk . (.Microsoft Corporation.) -- C:\WINDOWS\explorer.exe

I don't know what the explorer.exe.lnk is doing at the startup.

I just ran a scan with our tool in my PC and failed to find the explorer.exe.lnk in

my log.

Seems like first we have to delete that file and remove from the startup.

Then we can delete the file from the location C:\Windows and then

copy the file from the backup folder found in the location C:\Windows\System32

\dllcache

If the problem still exists then the solution that you have given is effective

my friend. Copying the explorer.exe file from a clean PC.

Regards
Try the above before my solution as it is more simple.
0
salmen45 Posts 7 Registration date Monday March 28, 2011 Status Member Last seen April 3, 2011
Mar 30, 2011 at 07:33 PM
I tried them both and I still can't get my icons or taskbar. Maybe the registry?
0
salmen45 Posts 7 Registration date Monday March 28, 2011 Status Member Last seen April 3, 2011
Mar 30, 2011 at 08:41 PM
Another thing I just noticed. When I delete explorer.exe from C:\windows it relplaces by itself before I can even copy the new file there.
0
Ambucias Posts 47310 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 11,163
Mar 31, 2011 at 04:48 AM
You said that you tried to change explorer.exe in the registry, did you restore the change to what it was? If not, do so. If so, continue on...

Try renaming the explorer.exe to explorer2.exe, then paste the new one, then delete the renamed explorer2.exe. If it fails, I shall need to prescribe to you some heavy medicinal compound which just may fix it, but your machine may feel pain.

Again, after the fix, I will give you some tips to prevent future infections as you system is presently very vulnerable.
0
salmen45 Posts 7 Registration date Monday March 28, 2011 Status Member Last seen April 3, 2011
Apr 3, 2011 at 09:32 AM
I think it's time for me to medicate! I'm at a loss. I've tried everything you said and then some, still no luck. I've tried a program called combofix too. I guess it's time to reload software. Would like some sugggestios on security when i'm back in bussiness though. Thanks for your time and dedication.

Sal
0