Windows Wont Load Properly - Help Needed ASAP Please...

doodah · 17 Jan 2006 at 17:38

A friend needed some help getting rid of some spyware and virsues, went to help and installed M$ Antispyware and AVG to rectify the problem. Restarted laptop to go into safe mode, realised it had restarted and logged in to normal windows.

The problem is only the wallpaper appears, nothing else! CTRL+ALT+DEL works to bring up task manager, and you can log off etc but thats it. Tried safe mode again but when you choose admin or other user it restarts straight after you select it.

Please help, i went there to fix her comp and it seems worse now and she has revision to do

Running Windows XP Home

NathanE · 17 Jan 2006 at 17:46

It sounds as though Explorer isn't starting to me.

Try CTRL+ALT+DEL then goto Task Manager. In TM, goto File->New Task and type "explorer" then hit OK.

See what happens then.

doodah · 17 Jan 2006 at 17:48

would installing AVG/Anti Spyware have anything with explorer not starting up?

She said F-Secure said there were 52 viruses, could a virus do this?

NathanE · 17 Jan 2006 at 17:57

Yes because the way some viruses hook into the system involves overwriting the Registry setting that holds the path to Explorer.exe. So instead of Explorer being started, the virus is - and then the virus in turn starts Explorer it self. So if the AV/AS software has removed the virus executable but has forgotten to fix the broken shell path in the Registry then you'll have to fix it manually.

Just try what I said in first post. If that works then it should just be a matter of fixing a Registry setting which I'll write a procedure for for you.

doodah · 17 Jan 2006 at 18:15

tried it but it says i dont have the right permission to do it. there are no other users avaliable to logon to either :confused:

NathanE · 17 Jan 2006 at 18:23

Looks like those viruses have really screwed up that computer. I'd reinstall. Plug the HD into another PC and copy her important files off of it (make sure you don't copy/run any files that could contain executable code, e.g. EXE's

, as they could still be infected)

doodah · 17 Jan 2006 at 18:29

i have access to the registry, could i not do the registry thing you suggest manually?

NathanE · 17 Jan 2006 at 18:38

Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.

Then make sure the "Shell" key is set to "Explorer.exe".

doodah · 17 Jan 2006 at 18:42

it is

doodah · 17 Jan 2006 at 18:50

could i replace explorer.exe with Win XP disk?

NathanE · 17 Jan 2006 at 19:06

I don't think Explorer is corrupt so that likely wouldn't change anything.

There's just too many things to try out. Even if you did manage to get Explorer working again there would likely be a whole raft of other issues to sort out.

Some viruses detect when they're about to be squashed and basically destroy your system just beforehand

doodah · 17 Jan 2006 at 19:56

bit unorthadox, but what about restoring the virus, its still in the vault.

NathanE · 17 Jan 2006 at 19:58

Worth a try but backup her important data first!

doodah · 17 Jan 2006 at 20:07

the file itself is xml2lib.dll, there 8 instances of it in the vault - all the same file as described as "trojan horse dropper.generic BEU". when i click restore it does it but the file doesnt move from the vault :confused:

Vietnow · 17 Jan 2006 at 21:02

I might be a bit late here, but one solution which has worked for me in the past with this exact problem is to perform a repair installation.

Boot from a Windows XP cd (it must be the same edition they have installed, eg home for home), then on the first screen where it asks you to install, repair using the recovery console, or quit.....you choose install and agree to the license agreement, it will then scan for operating systems and it should give you the option to press R to repair the installation it found.

This does not loose any data or settings, although you will probably need to download all the windows updates again.

Make sure you have the product key to hand also, it will require re-entering and re-activating.

This whole process should take less than an hour...good luck!

doodah · 17 Jan 2006 at 21:21

well after hours of trauling the internet found a solution which is rather weird. renamed explorer.exe to zexplorer.exe and i could run it, changed value in shell thing (in regedit) and restarted - hey presto it worked. im leaving the virus cleaning to someone else. This is the last time i help broken laptops (seem to have a knack for having problems with laptops!)

Thanks for the help NathanE