[trimtran20147]

the laptop got stuck on the desktop wallpaper after trying to shut it down. And now all I have is the wallpaper regardless what mode I boot up with. I ran virus protection and Spybot from command line and get rid of some Trojans and some spyware but no changes. I have to run FIXO.EXE but nothing shown in the change.txt. Can anyone help? I dont want to reload Xp since it has my wife work software on it. It would be a real hassle for her to get her IT at work to re-install their software for her to VPN to work.

Attached Files

•  check.txt   607bytes   227 downloads
•  hijackthis.txt   8.9KB   212 downloads

Edited by trimtran20147, 14 September 2005 - 12:29 PM.

[Advertisements]

Hi trimtran20147, Welcome to GTG !!

I am working on your log. As soon as a GTG Staff Member reviews my fix, I will post it for you.
Thank you for being patient.

[Linkmaster]

Hi trimtran20147, Welcome to GTG !!

I am working on your log. As soon as a GTG Staff Member reviews my fix, I will post it for you.
Thank you for being patient.

[Linkmaster]

Lets see if we can get your Desktop back to normal first.
Bootup in Normal mode
Hit Ctrl-Alt-Delete, Click on TaskManager
Select Applications tab
Select New Task
In the name field, type "regedit" then hit OK
Navigate to :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ImageFileExecutionOptions

Click on the "+" and delete these 2 keys:

• Explorer.exe
• Iexplorer.exe

Close Regedit and Reboot
Let us know if desktop returns to normal.

If it does, I need you to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here
Apply the update, reboot, and post a fresh Hijack This log.

[trimtran20147]

There area no IExplorer or Explorer underneath ImageFileExecutionOptions. These are what it shows:
_INSTPGM.EXE
cqw32.exe
enc98.exe
front.exe
install.exe
mngreg32.exe
photohse.exe
printhse.exe
prwin8.exe
ps80.exe
psdmt.exe
qfinder.exe
qpw.exe
setup.exe
setup32.exe
sevinst.exe
ua80.exe
wpwin8.exe
xwsetup.exe
YourImageFileNameH

[Linkmaster]

Sorry trimtran20147 for the delay!!

Bootup in Normal mode
Hit Ctrl-Alt-Delete, Click on TaskManager
Select Applications tab
Select New Task
Navigate to where IE is install and select the IE exe
See if that gets you on the internet.

If so download SP1a from HERE and install it

After reboot see if your desktop returns.

[trimtran20147]

I can still go task manager and do everything else. I had the laptop with automatic update on always before. So I am sure SP1 must be on it already. Because once I click on the link you send it does not take me to downlad SP1 but SP2. After SP2 is done and laptop got reboot it came back with the screen "Windows Security Center" screen on but the desktop still not back. Do I still have to go back to the first reply I got from you to follow that instruction? That is to delete those 2 keys? I can not believe microsoft dont have a program to rebuild desktop.

[trimtran20147]

I just look into the registry and those 2 keys still dont exist. But the system now is installed with SP2 as system properties stated.

[Linkmaster]

Open IE again to get on the internet like you did before

Download smitRem.exe and save the file somewhere so you know where it is. Then you will go through Taskmanager again to find the file.
Double- click it to extract it to it's own folder

Next, reboot your computer in SafeMode by doing the following:
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear
Select the first option, to run Windows in Safe Mode.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed.
Reboot into Normal Mode
Please post that log along with all others requested in your next reply.

See if Desktop comes back

[trimtran20147]

Sorry, I ran RunThis.bat twice so there is nothing in the Smitfiles.txt. So, there is nothing in the file. I reboot the laptop and all I got is the blue screen just like the batch file stated. However, it asks me to do CTRL+ALT+DEl to log in which I've never done it before! Also there are two processes keep running and then going away as if they are in some infinite loops. They are update.exe and wuaudt.exe under my login name shown in Task Manager. There is one with the same name of wuaudt.exe unfer SYSTEM. Only those two under my names seems like they hog the CPU usage.


Another quick but not related to my desktop problem at all. I cannot run any DOS based programs (i.e pkzip.exe - see picture) under DOS -Command Prompt window unless I have to run expand the config.NT_, autoexec.nt_, and command.co_. First it happens on the laptop and laster all of my XP or XP pro will behave the same way. Do you know if SP do that or spyware or virus do that?

Attached Thumbnails

• 

Attached Files

•  smitfiles.txt   839bytes   165 downloads

[Linkmaster]

Here is a link that may help with the 16 bit subsystem error !! 16 Bit Subsystem

Please download the trial version of
Ewido Security Suite
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Run Ewido:

• Click on scanner
• Click Complete System Scan and the scan will begin.
• During the scan it will prompt you to clean files, click OK
• When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
• When the scan is finished, click the Save report button at the bottom of the screen.
• Save the report to your desktop

Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present.

See if desktop returns.

[trimtran20147]

It choked when Ewido scan memory at location VM_7FFE0000. I am trying to have it scan Registry and Drive only. Let's see what happen

[trimtran20147]

Ok, I run Ewido to scan drive and registry. It has a bunch of spyware and 3 trojans. I went to desktop -.customized desktop but I dont have any option like you said.

[trimtran20147]

No desktop still, just the blue wall paper.

[Linkmaster]

Can you run another HijackThis log and post it ??

[trimtran20147]

I run EWido again in safe mode for registry and hard drive and it is clean. One other thing I want to mention here is that sometimes I dont see Control Panel in explorer. I dont know if it gives you a hint of what happens here.