[wannabe1]

From Task Manager...New Task...regedit

In the left pane, expand (click +) HKEY_CLASSES_ROOT, then exefile, then shell, then open, and click on command Is the value for (Default) "%1" %*

Collapse those keys (click -)

Expand HKEY_LOCAL_MACHINE, then SOFTWARE, then Microsoft, then Windows NT, then CurrentVersion, and click on Winlogon What is the value in the right pane for Shell?

Edited by wannabe1, 25 April 2006 - 02:21 PM.

[Advertisements]

Yes, value for (Default) is "%1"%* and the value for Shell is xpsf.exe

[bcripps]

Yes, value for (Default) is "%1"%* and the value for Shell is xpsf.exe

[wannabe1]

BINGO!

Go to HKEY_LOCAL_MACHINE, then SOFTWARE, then Microsoft, then Windows NT, then CurrentVersion, and click on Winlogon

Double click on shell. In the Value Data field, type Explorer.exe and click "Ok".

Close Registry Editor and reboot. Any change?

[bcripps]

Bingo is right!!!!

You got it! Desktop is back and things seem back to normal.

A big THANK YOU from Palatka, Florida.

All best, Wannabe1...

Regards,

Bryan

[wannabe1]

The bad news is....xpsf.exe is probably malware related. Our fix may not hold until the machine is cleaned up. I'm going to see if I can get a buddy of mine over in malware have a look at it for you. Post a HiJackThis log there and title it "wannabe1 sent me"

Malware Forum

[wannabe1]

Duplicate Post

Edited by wannabe1, 25 April 2006 - 03:33 PM.