G
Guest
I have a user with W2K professional workstation that proceduces a blank desktop after logging in. The first instance of the blank desktop occurred after I uninstalled Cisco VPN client 3.6.3. The machine does not hard-lock, as the mouse and keyboard are functional....Control+ALT+DEL does work. This issue occurs under all logins including administrator, power user logins, and domain administrator logins.
I started to troubleshoot by removing startup applications while in safe mode (no problems in there), then proceeded to disable services until the OS was loading just the bare minimum. On a whim, I stopped the explorer.exe process and restarted it...the desktop loads normally. So, I tried to rename the shdocvw.dll file, detailed in a technet article. No change...the desktop will not load unless I kill the explorer process and run it manually. Next, I ran Windows Update and installed SP4 (was on SP3) and the misc patches and updates. No change afterwhich. Next, I ran AV ( McAfee version 4.5)...found 3 variants of Gaobot, 1 Spybot trojan, plus two others trojans. Cleaned off this crap and upgraded the AV to 7.1 Enterprise. This version found a residual Gaobot and Spybot file. I installed Spybot Search and Destroy and Adaware to clean up any spyware....nothing offensive here. However, the existing problem still occurs. I also verified that the Shell key under HKLM\Software\Microsoft\WindowsNT\Winlogin was pointing correctly.
The final straw was to do an in-place upgrade. This corrects the issue for the first successful login, but successive logins revert back to the same issue.
Reformat and reinstall is not popular option with the user (Senior VP).
Short of sprinkling holy water on the PC, any other ideas out there?
Many thanks for reading....
I started to troubleshoot by removing startup applications while in safe mode (no problems in there), then proceeded to disable services until the OS was loading just the bare minimum. On a whim, I stopped the explorer.exe process and restarted it...the desktop loads normally. So, I tried to rename the shdocvw.dll file, detailed in a technet article. No change...the desktop will not load unless I kill the explorer process and run it manually. Next, I ran Windows Update and installed SP4 (was on SP3) and the misc patches and updates. No change afterwhich. Next, I ran AV ( McAfee version 4.5)...found 3 variants of Gaobot, 1 Spybot trojan, plus two others trojans. Cleaned off this crap and upgraded the AV to 7.1 Enterprise. This version found a residual Gaobot and Spybot file. I installed Spybot Search and Destroy and Adaware to clean up any spyware....nothing offensive here. However, the existing problem still occurs. I also verified that the Shell key under HKLM\Software\Microsoft\WindowsNT\Winlogin was pointing correctly.
The final straw was to do an in-place upgrade. This corrects the issue for the first successful login, but successive logins revert back to the same issue.
Reformat and reinstall is not popular option with the user (Senior VP).
Short of sprinkling holy water on the PC, any other ideas out there?
Many thanks for reading....