PDA

View Full Version : Desktop and start bar don't show.



jonathan
17-11-2009, 07:13 AM
I load the computer fine, but when I log in, only the wallpaper shows, nothing else. the only way to open something is by going ctrl-alt-delete, which brings up task manager, the going file-new.
I have tried system restore, but it didn't work. Any ideas at all?

Chilling_Silence
17-11-2009, 07:19 AM
What happens if you grab ReactOS Exporer and run that, do you get a desktop starting to load up after that?
http://www.foxplanet.de/explorer/

You should be able to load up IE by running "iexplore" and then going to that URL.

Sounds like you've got some description of an infection on your PC, Malware / Virus. I'll wait for those who're more skilled in doing that sort of thing to assist you with disinfection.

Welcome to PressF1

Cheers


Chill.

jonathan
17-11-2009, 07:23 AM
Thanks. By people more skilled, what do you mean. And, do you think my computer might need a proper virus scan? Because last time I had a virus scan I lost over $1000 worth of songs I had stored on there.
Thanks!

Chilling_Silence
17-11-2009, 07:45 AM
That doesn't mean you shouldn't do a scan. Just because last time you took your car for a service and it cost you $100 to get the oil changed doesn't mean you shouldn't take your car for a service again...

Grab Microsoft Security Essentials, install it, update it, run a Full / Complete scan (Not the quick scan it does when it first installs) and see what it comes up with.

Now, if the songs are really that important, surely you'd have a backup, yes?

baabits
17-11-2009, 07:50 AM
Hi there Jonathon

Do you think you could download HijackThis from

http://www.hijackthis.de/downloads/HJTInstall.exe

and post the log on here?

pctek
17-11-2009, 08:07 AM
I load the computer fine, but when I log in, only the wallpaper shows, nothing else. ?

You have tried right clicking the taskbar and selecting SHOW THE DESKTOP?

And if you lost some songs it's probably because they were infected. It's what happens when you get music off someone's elses PC rather than buying it.

wainuitech
17-11-2009, 08:31 AM
What OS are you using, XP, Vista or Windows 7 ?? Pressing ctrl-alt-delete starts the task manager in all 3.

Also right click the desktop - View - Make sure " Show Desktop Icons" is selected, if it is, untick it, then retick it. See if that does anything.

If thats not working, then its more than likely a damaged explorer.exe in windows.

kamo1
17-11-2009, 09:00 AM
Firstly, try wainuitech advice to see if it works. If not, run regedit in Task Manager(CTRL-ALT-Del)-File/New Task/run
Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\Cu rrentVersion\ImageFileExecution.options
Under this key, see if there are any subkeys named explorer.exe and iexplorer.exe. If there are, delete these two keys, close registry editor and restart.

wainuitech
17-11-2009, 09:03 AM
Try this as well, press ctrl-alt-delete / File- New, type in explorer.exe <Press Enter>-- If every thing appears, then try this - it may or may not work but the other method requires a possible reg alteration.

Click Start/ run OR from the task manager ctrl-alt-delete - file/New cmd once the command prompt box is open type in sfc /scannow (note space between c /s) press Enter. you may need your OS CD when asked. Let it fully run, then reboot - see what happens.

lakewoodlady
17-11-2009, 10:12 AM
Thanks. By people more skilled, what do you mean. And, do you think my computer might need a proper virus scan? Because last time I had a virus scan I lost over $1000 worth of songs I had stored on there.
Thanks!

He says he lost $1000 worth of songs, so I guess that means that he did pay for them somehow.

LL

jonathan
18-11-2009, 04:10 PM
He says he lost $1000 worth of songs, so I guess that means that he did pay for them somehow.

LL

Yes, you are right. I bought some off iTunes, and most were cds I bought from music stores.

jonathan
18-11-2009, 04:36 PM
Here is my 'Hijack This' log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:40:42 p.m., on 18/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINNT\system32\PMService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\taskmgr.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neopets.com/~neo____zafara
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {870E2C55-0138-4F56-8316-DF72367A826F} - C:\WINNT\system32\dmcomposm.dll (file missing)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINNT\system32\zhi220.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [eMulateCD] "C:\Program Files\Ingrasys\eMulateCD\EmuCD.exe" /s
O4 - HKLM\..\Run: [StartKey] C:\WINNT\system32\tcpserv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [EPA_EZ_GPO_Tool] C:\WINNT\system32\EZ_GPO_Tool.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunOnce: [*Restore] C:\WINNT\system32\restore\rstrui.exe -c
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-839522115-1035525444-2146758339-1005\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe (User 'pmace')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://intranet
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://webmail.corran.school.nz/msrdp.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINNT\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Energy Star(TM) EZ GPO Power Management Configuration Tool (EPA_GPO_PMService) - TerraNovum - C:\WINNT\system32\PMService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 7055 bytes

Speedy Gonzales
18-11-2009, 04:46 PM
You can tick these then tick fix checked

Close browsers

Disable system restore

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

I dont know what this is

O2 - BHO: (no name) - {870E2C55-0138-4F56-8316-DF72367A826F} - C:\WINNT\system32\dmcomposm.dll (file missing)

This looks dodgy

O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINNT\system32\zhi220.dll (file missing) < find this file then delete it

This will be the prob

O4 - HKLM\..\Run: [StartKey] C:\WINNT\system32\tcpserv.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\RunOnce: [*Restore] C:\WINNT\system32\restore\rstrui.exe -c

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

Then reboot

Is this PC at home or is it a work one?

jonathan
18-11-2009, 05:20 PM
it is a home pc.

Speedy Gonzales
18-11-2009, 05:53 PM
Ok, Tick the entries I posted then tick fix checked. Then reboot. See if that fixes it