Windows XP - Desktop and Start Menu are Missing - Malware?

just to clarify, it should read explorer.exe

I'll check that out tomorrow, but I have a feeling that it is a bigger issue than that. Many applications won't open that are named correctly. So I don't think this possible malware just simply renamed explorer.exe. Otherwise I would think that programs such as Malwarebyte's should run, but they don't and give me the same exact error.

yup, this may be a start to at least get you to the desktop.

MalwareBytes is great stuff but like most AV/Spyware scanners works much better in safe mode. I realize that you are doing this remotely but you will probably need to go hands on.

you may try the followings:
1. map to the client's C: drive.
2. enable viewing hidden files in explorer.
3. have a look at your client's C:\, C:\Windows, C:\Windows\system32, C:\Windows\system, C:\Windows\system32\drivers\etc, C:\Program Files and etc.
4. check any modified files or folders are happened in the recent dates.
5. check any strange file names.
6. if you find strange files or folders in the above directories, i think most likely this PC is being hijacked or infected.

the best solution is you take out the harddisk and do a antivirus scan on another healthy pc. but if you need to work remotely, i would suggest you to do the followings:
1. map the client's C: drive.
2. use your own antivirus program to scan it and see if it can be healed.

good luck!

Most of the time you need to rename the tools before saving to the desktop or before in contact with the infected pc so the nasties can't block it from executing.

First we need you to check on this one.
Since MalwareBytes is already installed, locate the Malwarebytes executable, mbam.exe and rename it to "winlogon.exe"(don't rename with any other name) and run it.

Let us know if it runs completely.


If you can access the registry also check for this key and if explorer.exe is listed as a subkey, delete it.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

To also check for virut download and run Combofix, if virut is present you'll be alerted by the tool

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Rename Combofix before in contact with the pc.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..


Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

I will attempt renaming Malwarebyte's today and start with that. I can't get into explorer at all, so I hope I can at least get into the command prompt to rename the exe file.

I'll also check out the registry, if it allows me too. I have a few things to try at least, and I should be able to walk him through using safe mode. Hopefully.

Then I will give ComboFix a shot.

So far nothing is working.

1.       New Task, appwiz.cpl  - Removed what I could, didn't help.

 ------------------------------------------------------------------------------------------------------------

2.       New Task, CMD - Couldn't rename, but sent customer a copy of one I renamed and was able to run Malwarebytes'. Program closed after 6 seconds and could no longer be run.
a.       C:\Program Files\Malwarebytes Anti-Malware
                                                               i.      Rename mbam.exe to winlogon.exe
                                                             ii.      Winlogon.exe

--------------------------------------------------------------------------------------------------------------
 
3.       New Task, regedit  - Didn't exist.
a.       HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
                                                               i.      If explorer.exe is listed as a sub key, delete it

-----------------------------------------------------------------------------------------------------------------
 
4.       New Task, regedit - Made no difference. Get the same error.
a.       HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
                                                               i.      Change value of shell from explorer.exe to  view.exe
                                                             ii.      New Task, explorer

-----------------------------------------------------------------------------------------------------------------
 
5.       New Task, CMD - Did nothing.
a.       netsh winsock reset

-----------------------------------------------------------------------------------------------------------------
 
6.       New Task, msconfig - Couldn't modify anything in here. Permissions error.

-----------------------------------------------------------------------------------------------------------------
 
7.       Send customer cf.exe (ComboFix) - Just like Malwarebytes', it starts to run and then just closes.
a.       Close all windows and kill anti-virus and firewall processes
b.      http://www.bleepingcomputer.com/combofix/how-to-use-combofix
 
8.       New Task, c:\windows\system32\restore\rstrui.exe - The restore goes through, but then it boots back into Windows and everything is the same and it states the restore failed.

I rebooted the customer's computer into Safe Mode and was able to login as the administrator. Didn't make any difference. Everything was still missing and couldn't access the same files.

This just doesn't look good. It seems like after running certain files, they close and the permissions get changed and they can't be run again. I haven't seen anything like this.

Any other suggestions before I have him bring his computer somewhere to have Windows reinstalled?

" i.      Change value of shell from explorer.exe to  view.exe "

Sorry, should worded differently. I just wanted you to ensure that the value was "Explorer.exe"

Yes, it was already explorer.exe. I renamed it back.

The best thing to do would be to remove the OS from the equation entirely. Most antivirus vendors (eset, symantec etc.) will provide options for running their AV from a preboot environment. This will probably end up being your best option given the issues you are having. You may even try downloading a trial version of Eset Nod32 Version 4 because i know that you can create a preboot using that. You may also be able to make a disk using BartPE also.

I am trying Eset Nod32 Version 4 now. Hopefully it will work. It appears that I am dealing with a rootkit.

If the problem stil persists:
Try this, download Process Explorer and rename it to "winlogon.exe" or svchost.exe"(not any other name.
http://live.sysinternals.com/procexp.exe

Rename the file to winlogon.exe or svchost.exe run it.
Then look for any random numbers executables e.g.,3425631.exe, highlight any random.exe and rightclick and select "kill process".

Once the process is killed, you can then run MalwareBytes or Combofix.



If the above won't work.
Download RootRepeal.zip "You will need to rename RootRepeal to winlogon.exe" and unzip it to your Desktop.
"Terminate Process and Delete File", which should do exactly that. Then, click Scan again. If the process isn't gone, or re-spawns on reboot, use "Force-Kill Process and Wipe File" to make sure it's gone. Other anti-malware should be able to take care of the rest then.



Download RootRepeal.zip and unzip it to your Desktop.
http://rootrepeal.googlepages.com/RootRepeal.zip

   * Double click RootRepeal.exe to start the program
   * Click on the Report tab at the bottom of the program window
   * Click the Scan button
   * In the Select Scan dialog, check:

         o Drivers
         o Files
         o Processes
         o SSDT
         o Stealth Objects
         o Hidden Services

   * Click the OK button
   * In the next dialog, select all drives showing
   * Click OK to start the scan

         Note: The scan can take some time. DO NOT run any other programs while the scan is running

   * When the scan is complete, the Save Report button will become available
   * Click this and save the report to your Desktop as RootRepeal.txt
   * Go to File, then Exit to close the program

I ended up using Sophos Anti-Rootkit which appeared to eliminate most of the infected files. Now I am able to run Malwarebytes' without it closing. Hopefully it will be clean after this, but I will most likely need to repare or replace explorer.exe and other files. Maybe I will get lucky and the system restore will now work if that wasn't infected too.

Is there any easy way of repairing explorer.exe and other windows files? I was just going to try making a new copy of explorer.exe, but I think quite a few files ended up being deleted because of the infection.

Well that good.. check to see if Combofix is able to run now... if it may find a clean copy of explorer.exe and other system files(in the system)and will replaced it, if there is a clean copy.

We might also see other bad files on the log that are still lurking there.

Or if you still have the Windows CD, you can try running the sfc /scannow and system files that are corrupted will be replaced.

Great, I will give that a shot.

I was looking into the sfc command, but unfortunately the customer doesn't have the original disks which were probably a Dell restore disk anyway.

Task Manager can recover explorer if you are able to open it.  Press Ctrl-Alt-Del to open Windows Security Dialog.  Select Task Manager.  In the Task Manager window, go to File then New Task (Run).  Type explorer and click OK.