[Metallica]

You're welcome.

Later,

[Advertisements]

Hi. The download for SP2 was still taking way too long so I ordered a cd of it instead on ebay. [It takes alot less time to deliver than it would ordering directly from Microsoft.] It should be delivered sometime next week, I'll make my next post after I get it and have it installed. Thanks.

[ctdgcrsntf]

Hi. The download for SP2 was still taking way too long so I ordered a cd of it instead on ebay. [It takes alot less time to deliver than it would ordering directly from Microsoft.] It should be delivered sometime next week, I'll make my next post after I get it and have it installed. Thanks.

[Metallica]

That is funny when you think about it.
I bought a copy an English XP Pro version from MS in the USA recently and the CD arrived 4 days later.

You'd figure that they should be able to get it to you a lot quicker.

[ctdgcrsntf]

Hi. I just wanted to say I still haven't got the SP2 cd. I can't believe it takes so long just to ship a single cd!

[Metallica]

Me neither. Like I said. It took them 4 days to get it across the big pond.

No problem by the way. I'll be around.

[ctdgcrsntf]

Hi. I finally got the SP2 cd. I just finished installing it.

[Metallica]

Yahoooooo.

Errrmm. Did it at least work the way we wanted?

Before I spend it all on and

[ctdgcrsntf]

The cd took a lot less time to install, about an hour. Still have a blank desktop and missing explorer.exe in the processes tab in task manager.

[Metallica]

Copy the code below into notepad and save it as lookup.bat
Set Filetype to "All files"

dir %Systemdrive%\explorer.* /a h /s > files.txt
start notepad files.txt

Start the file by doubleclicking lookup.bat
That will open a file called files.txt. Post the content of that file.

Regards,

[ctdgcrsntf]

Volume in drive C has no label.
Volume Serial Number is 304E-C1B1

Directory of C:\Program Files\DAP\Skins\dap

10/20/2006 10:16 PM 5,264 Explorer.bmp
1 File(s) 5,264 bytes

Directory of C:\WINDOWS

08/04/2004 12:56 AM 1,032,192 explorer.exe
08/18/2001 07:00 AM 80 explorer.scf
2 File(s) 1,032,272 bytes

Directory of C:\WINDOWS\$NtServicePackUninstall$

08/18/2001 07:00 AM 1,000,960 explorer.exe
1 File(s) 1,000,960 bytes

Directory of C:\WINDOWS\I386

08/18/2001 07:00 AM 351,519 EXPLORER.EX_
08/18/2001 07:00 AM 181 EXPLORER.SC_
2 File(s) 351,700 bytes

Directory of C:\WINDOWS\Prefetch

10/30/2006 03:28 AM 32,684 EXPLORER.EXE-082F38A9.pf
1 File(s) 32,684 bytes

Directory of C:\WINDOWS\ServicePackFiles\i386

08/04/2004 12:56 AM 1,032,192 explorer.exe
1 File(s) 1,032,192 bytes

Directory of C:\WINDOWS\SoftwareDistribution\Download\6ca7b3a8efd5a9b6f87fff395a2eb989

08/04/2004 02:56 AM 1,032,192 explorer.exe
1 File(s) 1,032,192 bytes

Edited by ctdgcrsntf, 30 October 2006 - 02:44 PM.

[Metallica]

First, we need to backup your registry:
Please go to Start > Run
Paste in the following line:regedit /e c:\registrybackup.reg
Click OK.
It won't appear to be doing anything, that's normal.
Your mouse pointer may turn to an hour glass for a minute.
Please continue when it no longer has the hour glass.

Then copy the part in bold below into notepad and save it as shell.reg
Set Filetype to "all files"

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="C:\\WINDOWS\\Explorer.exe"

Doubleclick that file and confirm you want to merge it with the registry.

Then reboot and let me know if that helped.

Regards,

[ctdgcrsntf]

No, still have the same problem.

[Metallica]

Can you click Start > Run and copy this into the window:
C:\WINDOWS\Explorer.exe
> OK

Let me know if any errors come up.

Then repeat the same for
C:\WINDOWS\Explorer.scf

Regards,

[ctdgcrsntf]

C:\WINDOWS\Explorer.exe- explorer.exe came up for a second in the processes tab in task manager then disappeared


C:\WINDOWS\Explorer.scf- A box came up saying "There was a problem sending the command to the program."

[Metallica]

That sounds very suspicious.

• Surf to: Sophos free tools: Anti-Rootkit
• Click the "Download" button
• Read the conditions and fill out your Details.
• Click the Download Sophos Anti-Rootkit link.
• Save the sarsfx.exe to location on your harddrive where you can find it later on.

Installing

• Close as many applications as possible and execute sarsfx.exe by doubleclicking it.
• Accept the EULA and install the software to the loaction of your choice.(Default is C:\SOPHTEMP)

Running for analysis

• In that folder find and double-click sargui.exe
• Select the areas that you want to scan for hidden objects (Running processes, Windows registry, Local hard drives)
• Click Start > Run and copy this command into the window %TEMP%\sarscan.log and click OK to execute.
• A textfile will open. Post the content of that file.

Regards,