Solved

XP - After login only see desktop wallpaper

Posted on 2006-11-07
7
365 Views
Last Modified: 2008-03-03
XP Professional SP2 - when user logs in all they get is their desktop wallpaper, explorer start-bar pops up for a split second, but then disappears. Task manager work. I have tried the following:

1. Restarted in safe mode - the same
2. Logged in as alternative user including Administrator, also in safe mode - the same
3. Removed drive and scanned for viruses/spyware in another machine - none found
4. Tried SFC scan - all system files intact
5. Windows XP Repair Install - made no difference
6. Examined startup file using HiJack This - nothing unusual there. Stripped back to bare startup - no difference.

Anything I can try, before I do complete system re-install?

Thanks in advance

 
0
Comment
Question by:emagination2006
  • 3
  • 3
7 Comments
 

Author Comment

by:emagination2006
Comment Utility
Also tried Restore point from 2 weeks ago and still the same.
0
 
LVL 38

Expert Comment

by:younghv
Comment Utility
Hi emagination2006,

This advice from morris1186 is worth trying:

Can you press Control-Alt-Delete and get the task manager up?  If so, you can then goto file....NewTask...  and type in "explorer.exe".  If that can run, then you can try to figure out what is causing it not to open explorer on startup...  Try this:
Start ---> Run ---> "Regedit.exe"

Expand HKEY_LOCAL_MACHINE.
Expand SOFTWARE
Expand MICROSOFT
Expand Windows NT
Expand CurrentVersion
Expand WinLogon

there will be a Key called "Shell".  It should contain the value "Explorer.exe".  If not, Make it that.

(You can also do this is safemode if you cant control-alt-delete)


If that doesn't work, did you try this repair process?
"How to perform an in-place upgrade (reinstallation) of Windows XP"
http://support.microsoft.com/?kbid=315341
0
 

Author Comment

by:emagination2006
Comment Utility
I can run task manager and run most applications without problem. Checked the Shell entry in the registry and looks ok.

If I try run 'explorer' manually from the task manager, the bar pops up for a second and then disappears again. I can't figure out what's crashing it.

I have also tried a repair re-install from the XP CD, but didn't make any difference.

I'm on site at the moment, so think it's gonna be a complete system reformat !!!
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 21

Assisted Solution

by:briancassin
briancassin earned 250 total points
Comment Utility
Are you using a local profile or server based profile when you are logging on

It sounds like something got in the machine...

Can you get to the processes tab in task mananger ?

If you can get to task manager, go to the Processes tab, and look for a process called 'SYSU.EXE'. If it's running, kill it.

Now, if your desktop suddenly returns to normal, then yes, you've got this virus. You're not out of the woods yet. There is probably a folder on your machine called 'C:\Program Files\ddm'. Delete that, of course. You'll probably also want to search your registry for the string 'ddm' and kill most of what you find. In particular the key HKEY_LOCAL_MACHINE/SOFTWARE/ddm, and anything under HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run and/or RunOnce that refers to 'ddm' or 'sysu.exe'.


If you do not find that look for any other odd processes and or anything using CPU time.

Sounds like you got hit with a newer trojan.

You can either format the drive and reinstall or run some anti virus anti spyware tools..

I would try running Panda active scan from http://www.pandasoftware.com I would also run symantec's online scanner and http://www.bitdefender.com

Also you could run rootkit revealer.

0
 
LVL 38

Accepted Solution

by:
younghv earned 250 total points
Comment Utility
emagination2006,

Are you seeing anything in your Event Viewer for Errors or Warnings?

If you had this computer back on your bench and could spend the time tracking down all the potential problems (to include identifying and removing malware) I might suggest taking the time.

If you're on-site and have to get this box up and running, a data back up and 're-load' might be faster.


Vic
0
 

Author Comment

by:emagination2006
Comment Utility
Thanks for the quick responses and suggestions lads!

I'm afraid money is going win out over time in this case and need to get the machine back up and running on the network.

Does look like a virus/malware of some sort, but I'm going to go ahead and reformat. I hate letting these things beat me, but need to move onto the next job.

Going to split the points between younghy and briancassin for such quick replies.

Cheers
0
 
LVL 38

Expert Comment

by:younghv
Comment Utility
E-2006,
Sadly, I agree.
Much more fun to track down these little bugs and pound a stake through their hearts.

Thank you for the points.

Vic
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

I don't know if many of you have made the great mistake of using the Cisco Thin Client model with the management software VXC. If you have then you are probably more then familiar with the incredibly clunky interface, the numerous work arounds, and …
In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now