HELP: Desktop/Task Bar MISSING after Windows 2000 startup, but I can s

[mnalep]

I need expert help.

My Desktop, and my toolbars are Missing when I start my computer. All I get when I boot is a tube with my wallpaper displayed on it. (Up to then, all the normal boot processes seem to be working, such as logging on as ADMINSTRATOR, etc).


What really intrigues me, is that I can start desktop manually at this point by starting TASK MANAGER (with CTRL/ALT/DELETE) and then issuing the 'CONTROL' command from the TASK MANAGER/NEW TASK/RUN/"CONTROL" (But FIRST I MUST end the currently running 'explorer.exe' task, or CONTROL wont help).

When I do this all my desktop icons appear as well as mt toolbars (START button, quick launch bar, etc).

I suspect either a corrupt startup program, or a registry entry problem.

This all began right after I ran SPYBOT to eliminate nusiance ware on my pc. SPYBOT ran ok, and indicated it had to finish the removal on my next boot up, and I approved that. Then on my next boot everything seemed to go ok, SPYBOT started up ok and finished it's cleanup.

I then got a warning message window pop up that said Norton had found the HTML Redlof.A virus. I have seen that for a week, and just usually clicked the message off. This time, however, I could not click it off as my pc locked up. I shutdown the pc, then rebooted - and surprise - no desktop or tool bars !

I have tried several things to fix this:
Running Nortin Antivirus and removing know viruses (No Help)
Starting up in SAFE MODE (wont work, still no desktop)
Recovering Win 2000 from my last Emergency Repair Disk (No Help)
Recovering Win 2000 from the Re-installation CD (No Help)
Calling DELL Tech Support - REALLY NO HELP (They would only advise new install !!!)
Undeleting the spyware programs that SPYBOT removed.
Undeleting the Virusware Nortin had removed (OK, I got desperate),
Recovering Win 2000 again from the ERD, and Re-install CD.

I've searched using Google, and read any article that seemed to relate to fixing missing desktops, including articles in the Microsoft Knowledge Base and Tech Support.

I've run 'msinfo32' (I can't tell what should be there or not, but I pasted the STARTUP programs below...)

I've run 'sigverif' (no unusual unsigned drivers tha I could tell).


I've looked for a second version of explore.exe or multiple versions of explorer.exe in C:\WINNT and the entire ahard drive, and found none - so it does not look like the Trojan explore.exe as I've seen discussed on a few posts on this board
I dowloaded a freeware utility called StartUpTracker3 (from

http://www.dougknox.com/xp/utils/xp_starttrack.htm)

to log the boot process (that info is below also...)

I guess that's about it.

I REALLY don't want to back up and reformat my hard drive, and reload all my programs and data again.

Can anyone help? Either with what to look for (registry or logs start up programs). Or explain what is supposed to run so I can see if it is? Or point me to a resource that can help (human or internet).

Thanks so much for reading, and considering this problem.

Matt


===============================================================
The list of program that msinfo32 found that ran at STARTUP:
===============================================================

System Information report written at: 10/03/2003 09:25:28 PM
[Startup Programs]

Program Command User Name Location

DESKTOP desktop.ini D8QX8L01\Administrator Startup
PopUpStopperFreeEdition "c:\progra~1\panicw~1\pop-up~1\psfree.exe" D8QX8L01\Administrator HKU\S-1-5-21-1275210071-1682526488-1343024091-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Opad c:\documents and settings\administrator\application data\scbr.exe D8QX8L01\Administrator HKU\S-1-5-21-1275210071-1682526488-1343024091-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HXDL.EXE c:\program files\alset\helpexpress\administrator\hxdl.exe -from="hxiul.exe" -to="hxiul.exe" D8QX8L01\Administrator HKU\S-1-5-21-1275210071-1682526488-1343024091-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
discfix c:\dell\discfix.cmd .DEFAULT Startup
Resolution Assistant c:\progra~1\dell\resolu~1\motive~1\bin\matcli.exe -boot All Users Common Startup
Synchronization Manager mobsync.exe /logon All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RxUser c:\program files\dell\resolution assistant\common\bin\rxuser.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Speed racer c:\program files\creative\playcenter\ctsrreg.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AudioHQ c:\program files\creative\sblive\audiohq\ahqtb.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UpdReg c:\winnt\updreg.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adaptec DirectCD c:\progra~1\adaptec\directcd\directcd.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
madexe c:\program files\dell\resolution assistant\launchra.exe -boot All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SystemTasks c:\filez.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LoadQM loadqm.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NPS Event Checker c:\progra~1\navnt\npscheck.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Excite Private Messenger Pipe c:\program files\excite\prvtmsgr\bin\x8impipe.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RealTray c:\program files\real\realplayer\realplay.exe systemboothideplayer All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
tdyadnrc c:\winnt\system32\tdyadnrc.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Kernel32 c:\winnt\system\kernel32.dll All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IST Service c:\program files\istsvc\istsvc.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UpdateStats c:\program files\media\media\updatestats.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RunWindowsUpdate c:\winnt\uptodate.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KeenValue c:\program files\common files\keenvalue\keenvalue.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
36F4SAZ3QJAFKE c:\winnt\system32\elq0i.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
POPInstLite c:\docume~1\defaul~1\mydocu~1\data\popins~1.exe /autorun All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SchedulingAgent mstinit.exe /firstlogon All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winactive c:\program files\window active\winactive.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run




========================================================================
START UP LOG from StarupTracker3:
========================================================================

10/1/2003 10:04:15 PM

-- Registry --
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

No Items Found

-- Registry --
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager mobsync.exe /logon
RxUser C:\Program Files\Dell\Resolution Assistant\common\bin\RxUser.exe
Speed racer C:\Program Files\Creative\PlayCenter\CTSRReg.exe
AudioHQ C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
UpdReg C:\WINNT\Updreg.exe
Adaptec DirectCD C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
madexe C:\Program Files\Dell\Resolution Assistant\LaunchRA.exe -boot
SystemTasks C:\filez.exe
LoadQM loadqm.exe
NPS Event Checker C:\PROGRA~1\Navnt\npscheck.exe
Excite Private Messenger Pipe C:\Program Files\Excite\PrvtMsgr\bin\x8IMPipe.exe
RealTray C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
tdyadnrc C:\WINNT\System32\tdyadnrc.exe
stcloader C:\WINNT\System32\stcloader.exe
Kernel32 C:\WINNT\SYSTEM\Kernel32.dll
IST Service C:\Program Files\ISTsvc\istsvc.exe
UpdateStats C:\Program Files\Media\Media\UpdateStats.exe
RunWindowsUpdate C:\WINNT\uptodate.exe
KeenValue C:\Program Files\Common files\KeenValue\KeenValue.exe
36F4SAZ3QJAFKE C:\WINNT\System32\Elq0i.exe
POPInstLite C:\DOCUME~1\DEFAUL~1\MYDOCU~1\Data\POPINS~1.EXE /AutoRun
SchedulingAgent mstinit.exe /firstlogon
gllshcr C:\DOCUME~1\ADMINI~1\APPLIC~1\eabrchot.exe -QuieT
winactive C:\Program Files\Window Active\winactive.exe

-- Registry --
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

No Items Found

-- Registry --
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

PopUpStopperFreeEdition "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
Opad C:\Documents and Settings\Administrator\Application Data\scbr.exe
HXDL.EXE C:\Program Files\Alset\HelpExpress\Administrator\HXDL.EXE -from="HXIUL.EXE" -to="HXIUL.EXE"
ContentService C:\WINNT\System32\winservn.exe

-- Registry --
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce

^SetupICWDesktop C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

-- Registry --
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

No Items Found

-- Start Menu - Current User --
DESKTOP.INI

-- Start Menu - All Users --
Resolution Assistant.lnk
Microsoft Office.lnk
Norton AntiVirus AutoProtect.lnk
America Online 7.0 Tray Icon.lnk
hpoddt01.exe.lnk
hp psc 1000 series.lnk
DESKTOP.INI
KeenValue.lnk

-- Disabled Items --
No Items Found

-- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon --
Explorer.exe

-- Running Processes --
System Idle Process
System
smss.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
svchost.exe
spoolsv.exe
CTsvcCDA.exe
svchost.exe
LogWatNT.exe
navapsvc.exe
npssvc.exe
TNSLSNR.exe
ORACLE.EXE
OWASTSVR.EXE
regsvc.exe
MSTask.exe
RxMon.exe
stisvc.exe
wanmpsvc.exe
WinMgmt.exe
mspmspsv.exe
alertsvc.exe
taskmgr.exe
Explorer.exe
devldr32.exe
AHQTB.EXE
waol.exe
iexplore.exe
mshta.exe
CMD.EXE
NOTEPAD.EXE
winzip32.exe
StartupTracker3

-- Running Services --

Name: Browser
Description: Computer Browser
Startup Mode: Auto
Run from: C:\WINNT\System32\services.exe

Name: Creative Service for CDROM Access
Description: Creative Service for CDROM Access
Startup Mode: Auto
Run from: C:\WINNT\System32\CTsvcCDA.exe

Name: Dhcp
Description: DHCP Client
Startup Mode: Auto
Run from: C:\WINNT\System32\services.exe

Name: dmserver
Description: Logical Disk Manager
Startup Mode: Auto
Run from: C:\WINNT\System32\services.exe

Name: Dnscache
Description: DNS Client
Startup Mode: Auto
Run from: C:\WINNT\System32\services.exe

Name: Eventlog
Description: Event Log
Startup Mode: Auto
Run from: C:\WINNT\system32\services.exe

Name: EventSystem
Description: COM+ Event System
Startup Mode: Manual
Run from: C:\WINNT\System32\svchost.exe -k netsvcs

Name: lanmanserver
Description: Server
Startup Mode: Auto
Run from: C:\WINNT\System32\services.exe

Name: lanmanworkstation
Description: Workstation
Startup Mode: Auto
Run from: C:\WINNT\System32\services.exe

Name: LmHosts
Description: TCP/IP NetBIOS Helper Service
Startup Mode: Auto
Run from: C:\WINNT\System32\services.exe

Name: LogWatch
Description: Event Log Watch
Startup Mode: Auto
Run from: C:\WINNT\LogWatNT.exe

Name: NAV Alert
Description: NAV Alert
Startup Mode: Manual
Run from: C:\PROGRA~1\Navnt\alertsvc.exe

Name: NAV Auto-Protect
Description: NAV Auto-Protect
Startup Mode: Auto
Run from: C:\PROGRA~1\Navnt\navapsvc.exe

Name: Netman
Description: Network Connections
Startup Mode: Manual
Run from: C:\WINNT\System32\svchost.exe -k netsvcs

Name: Norton Program Scheduler
Description: Norton Program Scheduler
Startup Mode: Auto
Run from: C:\PROGRA~1\Navnt\npssvc.exe

Name: NtmsSvc
Description: Removable Storage
Startup Mode: Auto
Run from: C:\WINNT\System32\svchost.exe -k netsvcs

Name: Oracleora8iTNSListener
Description: Oracleora8iTNSListener
Startup Mode: Auto
Run from: c:\ora8i\BIN\TNSLSNR

Name: OracleServiceORA8I
Description: OracleServiceORA8I
Startup Mode: Auto
Run from: c:\ora8i\bin\ORACLE.EXE ORA8I

Name: OracleWebAssistant1
Description: OracleWebAssistant1
Startup Mode: Auto
Run from: c:\ora8i\BIN\OWASTSVR.EXE

Name: PlugPlay
Description: Plug and Play
Startup Mode: Auto
Run from: C:\WINNT\system32\services.exe

Name: PolicyAgent
Description: IPSEC Policy Agent
Startup Mode: Auto
Run from: C:\WINNT\System32\lsass.exe

Name: ProtectedStorage
Description: Protected Storage
Startup Mode: Auto
Run from: C:\WINNT\system32\services.exe

Name: RasMan
Description: Remote Access Connection Manager
Startup Mode: Manual
Run from: C:\WINNT\System32\svchost.exe -k netsvcs

Name: RemoteRegistry
Description: Remote Registry Service
Startup Mode: Auto
Run from: C:\WINNT\system32\regsvc.exe

Name: RpcSs
Description: Remote Procedure Call (RPC)
Startup Mode: Auto
Run from: C:\WINNT\system32\svchost -k rpcss

Name: SamSs
Description: Security Accounts Manager
Startup Mode: Auto
Run from: C:\WINNT\system32\lsass.exe

Name: Schedule
Description: Task Scheduler
Startup Mode: Auto
Run from: C:\WINNT\system32\MSTask.exe

Name: seclogon
Description: RunAs Service
Startup Mode: Auto
Run from: C:\WINNT\system32\services.exe

Name: SENS
Description: System Event Notification
Startup Mode: Auto
Run from: C:\WINNT\system32\svchost.exe -k netsvcs

Name: Service Request Monitor
Description: Service Request Monitor
Startup Mode: Auto
Run from: C:\Program Files\Dell\Resolution Assistant\Common\bin\RxMon.exe

Name: Spooler
Description: Print Spooler
Startup Mode: Auto
Run from: C:\WINNT\system32\spoolsv.exe

Name: StiSvc
Description: Still Image Service
Startup Mode: Auto
Run from: C:\WINNT\system32\stisvc.exe

Name: TapiSrv
Description: Telephony
Startup Mode: Manual
Run from: C:\WINNT\System32\svchost.exe -k netsvcs

Name: TrkWks
Description: Distributed Link Tracking Client
Startup Mode: Auto
Run from: C:\WINNT\system32\services.exe

Name: WANMiniportService
Description: WAN Miniport (ATW) Service
Startup Mode: Auto
Run from: "C:\WINNT\wanmpsvc.exe"

Name: WinMgmt
Description: Windows Management Instrumentation
Startup Mode: Auto
Run from: C:\WINNT\System32\WBEM\WinMgmt.exe

Name: WMDM PMSP Service
Description: WMDM PMSP Service
Startup Mode: Auto
Run from: C:\WINNT\System32\mspmspsv.exe

Name: Wmi
Description: Windows Management Instrumentation Driver Extensions
Startup Mode: Manual
Run from: C:\WINNT\system32\Services.exe

 

[bcastner]

A system file checking operation is not going to repair the issue.
You have several viri, but the most important infection is the entries:

Kernel32 C:\WINNT\SYSTEM\Kernel32.dll
UpdateStats C:\Program Files\Media\Media\UpdateStats.exe
RunWindowsUpdate C:\WINNT\uptodate.exe
KeenValue C:\Program Files\Common files\KeenValue\KeenValue.exe
36F4SAZ3QJAFKE C:\WINNT\System32\Elq0i.exe

See:

http://www.cert.org/incident_notes/IN-2001-14.html

If you applied the fixes from SpyBot 1.2 with current definitions, and perhaps Hijack This!, scan, fix; and with updated definitions a Norton AV scan I cannot believe these issues would persist.

http://www.spywareinfo.com/articles/hijacked/#removal

Try as well two from smah's FAQ list, I recommend Trend Micro and Panda: faq760-3862

 

[boltblue]

mnalep

i had the same issue and before i got this phenomenon (no desktop) my pc got infected with virus. I run the SP4 update, NVACE8 update and install zone alarm. After a few hours my pc boot's but no desktop.

you can still reinstall your windows 2000 pro and overwrite the system files when you get to the task manager and run new task then access your cd-drive where your windows 2000 cd is. you don't need to worry of re-installing all the programs again. if you can backup your data only it would be a better choice before starting this procedure.

good luck

boltblue

 

[bcastner]

Without offense boltblue, the question was premised on avoiding a clean install.

You notice that an sfc operation, and a repair reinstallation did not change things for this user in his description in the original thread.

I was trying to avoid a clean install of the OS.

 

[mnalep]

Thanks for replying.

Bcastner,
I have ran Norton Antivirus again, with my virus definitions updated as of 9 24 03. I have also ran Spybot 1.2 again, and removed everything these two tools found.

Neither found or tried to remove any of the following:

Kernel32 C:\WINNT\SYSTEM\Kernel32.dll
UpdateStats C:\Program Files\Media\Media\UpdateStats.exe
RunWindowsUpdate C:\WINNT\uptodate.exe
KeenValue C:\Program Files\Common files\KeenValue\KeenValue.exe
36F4SAZ3QJAFKE C:\WINNT\System32\Elq0i.exe

I ran StartUpTracker again, and it confirms all the above virus programs STILL EXIST!

If I really do have several virus type that Norton and Spybot will not remove - then what is causing that behavior?

Should I try HiJackThis?

Has something corrupted my Norton antivirus program? (I recall once before getting that Klez virus, and it actually prevented running Norton antivirus! I had to obtain a separate utility to get rid of Klez).


Boltblue,

Thank you also for replying. I am trying to just clean up what I have as my understannding is a complete reload of WIN 2000 would wipe the data and programs from my hard drive. I am also thinking that since the re-intstall, and the Emergency Repair that I tried did not work - that a complete reload could very well leave me at the same point I am currently.

 

[mnalep]

Bcastner,

I am still trying to work my way through the material on the CERT site and the spywareinfo site, but what did you mean by "Try as well two from smah's FAQ list, I recommend Trend Micro and Panda: FAQ760-3862"? When I click on that link i just go to the home page of Tek Tips. Is there something there I need to click to?

I also have noticed that I keep getting icons on my desktop for a shortcut to DESKTOP.INI which contains:

[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
WebViewTemplate.NT5=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0

Is this desktop.ini normal?

PS: I forgot to mention that the last run of Norton Antivirus also found and removed a trojan called "trojan.ByteVerify"

Thanks,
Matt

 

[bcastner]

The link to smah's FAQ resolves fine for me. Here is a snip that contains the important stuff:

To scan entire drives or directories:

http://housecall.trendmicro.com/

http://www.mcafee.com/myapps/mfs/default.asp

http://security.symantec.com/default.asp?productid=symhome&langid=ie&venid=sym

http://www.bitdefender.com/scan/licence.php

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

http://www.ravantivirus.com/scan/

http://www.freedom.net/viruscenter/index.html

And for single files:

http://www.kaspersky.com/remoteviruschk.html

http://www.ikarus-software.at/portal/modules.php?name=Content&pa=showpage&pid=4