Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

blank desktop [RESOLVED]


  • This topic is locked This topic is locked

#1
trimtran20147

trimtran20147

    Member

  • Member
  • PipPip
  • 41 posts
the laptop got stuck on the desktop wallpaper after trying to shut it down. And now all I have is the wallpaper regardless what mode I boot up with. I ran virus protection and Spybot from command line and get rid of some Trojans and some spyware but no changes. I have to run FIXO.EXE but nothing shown in the change.txt. Can anyone help? I dont want to reload Xp since it has my wife work software on it. It would be a real hassle for her to get her IT at work to re-install their software for her to VPN to work.

Attached Files


Edited by trimtran20147, 14 September 2005 - 12:29 PM.

  • 0

Advertisements


#2
Linkmaster

Linkmaster

    Visiting Staff

  • Member
  • PipPipPip
  • 940 posts
Hi trimtran20147, Welcome to GTG !! :tazz:

I am working on your log. As soon as a GTG Staff Member reviews my fix, I will post it for you.
Thank you for being patient.
  • 0

#3
Linkmaster

Linkmaster

    Visiting Staff

  • Member
  • PipPipPip
  • 940 posts
Lets see if we can get your Desktop back to normal first.
Bootup in Normal mode
Hit Ctrl-Alt-Delete, Click on TaskManager
Select Applications tab
Select New Task
In the name field, type "regedit" then hit OK
Navigate to :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ImageFileExecutionOptions

Click on the "+" and delete these 2 keys:

• Explorer.exe
• Iexplorer.exe

Close Regedit and Reboot
Let us know if desktop returns to normal.

If it does, I need you to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here
Apply the update, reboot, and post a fresh Hijack This log.
  • 0

#4
trimtran20147

trimtran20147

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
There area no IExplorer or Explorer underneath ImageFileExecutionOptions. These are what it shows:
_INSTPGM.EXE
cqw32.exe
enc98.exe
front.exe
install.exe
mngreg32.exe
photohse.exe
printhse.exe
prwin8.exe
ps80.exe
psdmt.exe
qfinder.exe
qpw.exe
setup.exe
setup32.exe
sevinst.exe
ua80.exe
wpwin8.exe
xwsetup.exe
YourImageFileNameH
  • 0

#5
Linkmaster

Linkmaster

    Visiting Staff

  • Member
  • PipPipPip
  • 940 posts
Sorry trimtran20147 for the delay!!

Bootup in Normal mode
Hit Ctrl-Alt-Delete, Click on TaskManager
Select Applications tab
Select New Task
Navigate to where IE is install and select the IE exe
See if that gets you on the internet.

If so download SP1a from HERE and install it

After reboot see if your desktop returns.
  • 0

#6
trimtran20147

trimtran20147

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
I can still go task manager and do everything else. I had the laptop with automatic update on always before. So I am sure SP1 must be on it already. Because once I click on the link you send it does not take me to downlad SP1 but SP2. After SP2 is done and laptop got reboot it came back with the screen "Windows Security Center" screen on but the desktop still not back. Do I still have to go back to the first reply I got from you to follow that instruction? That is to delete those 2 keys? I can not believe microsoft dont have a program to rebuild desktop.
  • 0

#7
trimtran20147

trimtran20147

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
I just look into the registry and those 2 keys still dont exist. But the system now is installed with SP2 as system properties stated.
  • 0

#8
Linkmaster

Linkmaster

    Visiting Staff

  • Member
  • PipPipPip
  • 940 posts
Open IE again to get on the internet like you did before

Download smitRem.exe and save the file somewhere so you know where it is. Then you will go through Taskmanager again to find the file.
Double- click it to extract it to it's own folder

Next, reboot your computer in SafeMode by doing the following:
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear
Select the first option, to run Windows in Safe Mode.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed.
Reboot into Normal Mode
Please post that log along with all others requested in your next reply.

See if Desktop comes back
  • 0

#9
trimtran20147

trimtran20147

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
Sorry, I ran RunThis.bat twice so there is nothing in the Smitfiles.txt. So, there is nothing in the file. I reboot the laptop and all I got is the blue screen just like the batch file stated. However, it asks me to do CTRL+ALT+DEl to log in which I've never done it before! Also there are two processes keep running and then going away as if they are in some infinite loops. They are update.exe and wuaudt.exe under my login name shown in Task Manager. There is one with the same name of wuaudt.exe unfer SYSTEM. Only those two under my names seems like they hog the CPU usage.


Another quick but not related to my desktop problem at all. I cannot run any DOS based programs (i.e pkzip.exe - see picture) under DOS -Command Prompt window unless I have to run expand the config.NT_, autoexec.nt_, and command.co_. First it happens on the laptop and laster all of my XP or XP pro will behave the same way. Do you know if SP do that or spyware or virus do that?

Attached Thumbnails

  • cannot_run_DOS.jpg

Attached Files


  • 0

#10
Linkmaster

Linkmaster

    Visiting Staff

  • Member
  • PipPipPip
  • 940 posts
Here is a link that may help with the 16 bit subsystem error !! 16 Bit Subsystem

Please download the trial version of
Ewido Security Suite
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Run Ewido:
  • Click on scanner
  • Click Complete System Scan and the scan will begin.
  • During the scan it will prompt you to clean files, click OK
  • When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
  • When the scan is finished, click the Save report button at the bottom of the screen.
  • Save the report to your desktop
Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present.

See if desktop returns.
  • 0

Advertisements


#11
trimtran20147

trimtran20147

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
It choked when Ewido scan memory at location VM_7FFE0000. I am trying to have it scan Registry and Drive only. Let's see what happen
  • 0

#12
trimtran20147

trimtran20147

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
Ok, I run Ewido to scan drive and registry. It has a bunch of spyware and 3 trojans. I went to desktop -.customized desktop but I dont have any option like you said.
  • 0

#13
trimtran20147

trimtran20147

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
No desktop still, just the blue wall paper.
  • 0

#14
Linkmaster

Linkmaster

    Visiting Staff

  • Member
  • PipPipPip
  • 940 posts
Can you run another HijackThis log and post it ??
  • 0

#15
trimtran20147

trimtran20147

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
I run EWido again in safe mode for registry and hard drive and it is clean. One other thing I want to mention here is that sometimes I dont see Control Panel in explorer. I dont know if it gives you a hint of what happens here.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP