After login, only wallpaper shows - no icons/taskbar ???!!!

[pcmangler]

Hi,

I have a PC on site that allows you to login to a domain as normal, but
then just displays only the desktop wallpaper & the mouse pointer -
nothing else at all. Ctrl-Alt-Del will allow you to enter Task Manager
and Explorer.exe is missing from the Process list. Manually starting
Explorer.exe causes the task bar to briefly flash up then vanish.
Nothing in the Event Logs (mmc runs ok from Task Mgr).

Tried replacing Explorer.exe and a "Repair Installation" of XP - no
change.

Any ideas anyone ? - or am I destined to wipe and reinstall ?

Any suggestions would be greatly appreciated - I have to return to this
PC and either fix it or reinstall it, in just over 12hrs - so anything
would be welcome !!

Cheers.

Kev.

 

[David H. Lipman]

From: <[email protected]>

| Hi,
|
| I have a PC on site that allows you to login to a domain as normal, but
| then just displays only the desktop wallpaper & the mouse pointer -
| nothing else at all. Ctrl-Alt-Del will allow you to enter Task Manager
| and Explorer.exe is missing from the Process list. Manually starting
| Explorer.exe causes the task bar to briefly flash up then vanish.
| Nothing in the Event Logs (mmc runs ok from Task Mgr).
|
| Tried replacing Explorer.exe and a "Repair Installation" of XP - no
| change.
|
| Any ideas anyone ? - or am I destined to wipe and reinstall ?
|
| Any suggestions would be greatly appreciated - I have to return to this
| PC and either fix it or reinstall it, in just over 12hrs - so anything
| would be welcome !!
|
| Cheers.
|
| Kev.

Some things to check and test...

Execute Regedit.exe form the Task Manager.

Go to...
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

do you have ...

"Shell"="Explorer.exe"

or...

"Userinit"="C:\WINNT\SYSTEM32\Userinit.exe,"
or
"Userinit"="C:\WINDOWS\SYSTEM32\Userinit.exe,"


What happens when you execute Explorer.exe from Task Manager ?

How about..

Userinit.exe

 

[pcmangler]

I'll check the registry entries when I get on site in a few hours, but
to answer your question about starting Explorer.exe from Task Mgr - the
taskbar briefly appears then vanishes - exactly as it does when you
first log in.

I also forgot to mention that it has the problem regardless of who logs
in, even local Administrator, and Safe Mode makes no difference either.

It's weird, because Windows *seems* to be working in the background,
but Explorer.exe just won't run. I've also tried System Restore, but
there were no restore points listed, even though the service is not
disabled - and should therefore have several.

There is one user on this site who 'fiddles' with the PCs - and there
is a possibility that he may have been playing about - not that he'll
admit to anything !

 

[Malke]

I'll check the registry entries when I get on site in a few hours, but
to answer your question about starting Explorer.exe from Task Mgr -
the taskbar briefly appears then vanishes - exactly as it does when
you first log in.

I also forgot to mention that it has the problem regardless of who
logs in, even local Administrator, and Safe Mode makes no difference
either.

It's weird, because Windows *seems* to be working in the background,
but Explorer.exe just won't run. I've also tried System Restore, but
there were no restore points listed, even though the service is not
disabled - and should therefore have several.

There is one user on this site who 'fiddles' with the PCs - and there
is a possibility that he may have been playing about - not that he'll
admit to anything !

Since we don't know anything about the computer... This is a classic
symptom of malware infection, so the first task is to make sure the
computer is clean. This can certainly be done without explorer.exe. Use
the Task Manager to run cmd to copy scanning tools to the hard drive
and then use TM to run the tools. Or go outside the operating system
with something like ERD Commander or Bart's PE to see what is
happening.

See here for systematical malware removal steps:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Malke

 

[Guest]

Have you right clicked on the desktop and choose the arrange icons by. It
should have a check mark by display desktop icons. This will fix your
problem if you are using Windows XP.

 

[David H. Lipman]

From: <[email protected]>

| I'll check the registry entries when I get on site in a few hours, but
| to answer your question about starting Explorer.exe from Task Mgr - the
| taskbar briefly appears then vanishes - exactly as it does when you
| first log in.
|
| I also forgot to mention that it has the problem regardless of who logs
| in, even local Administrator, and Safe Mode makes no difference either.
|
| It's weird, because Windows *seems* to be working in the background,
| but Explorer.exe just won't run. I've also tried System Restore, but
| there were no restore points listed, even though the service is not
| disabled - and should therefore have several.
|
| There is one user on this site who 'fiddles' with the PCs - and there
| is a possibility that he may have been playing about - not that he'll
| admit to anything !

The fact that is happens to ALL users means it is not associated with User Registries and
therefore such entries that are in ...
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Is quite possible.

 

[s.satoko]

hi,
i'm having the same problem. but when i log on as admin, it works
fine.
i also checked registry keys in
HKLM\SOFTWARE\Microsoft\WindowsNY\CurrentVersion\Winlogon
Shell is set to explorer.exe
and
Userinit is set to C:\WINNT\SYSTEM32\Userinit.exe

Execute explorer.exe from task manager will run but it ends in less
than a second automatically.

since it works fine for admin, is it some kind of authentication
problem??????

 

[David H. Lipman]

From: <[email protected]>

| hi,
| i'm having the same problem. but when i log on as admin, it works
| fine.
| i also checked registry keys in
| HKLM\SOFTWARE\Microsoft\WindowsNY\CurrentVersion\Winlogon
| Shell is set to explorer.exe
| and
| Userinit is set to C:\WINNT\SYSTEM32\Userinit.exe
|
| Execute explorer.exe from task manager will run but it ends in less
| than a second automatically.
|
| since it works fine for admin, is it some kind of authentication
| problem??????

This could be a User Registry modification made by malware. The following tool can correct
this and hopefully find and remove the malware.


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://harrisonrj.home.comcast.net/step_by_step_pc_cleaning_process.htm#Step_3_%96_Getting_Help


* * * Please report back your results * * *