• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 376
  • Last Modified:

XP - After login only see desktop wallpaper

XP Professional SP2 - when user logs in all they get is their desktop wallpaper, explorer start-bar pops up for a split second, but then disappears. Task manager work. I have tried the following:

1. Restarted in safe mode - the same
2. Logged in as alternative user including Administrator, also in safe mode - the same
3. Removed drive and scanned for viruses/spyware in another machine - none found
4. Tried SFC scan - all system files intact
5. Windows XP Repair Install - made no difference
6. Examined startup file using HiJack This - nothing unusual there. Stripped back to bare startup - no difference.

Anything I can try, before I do complete system re-install?

Thanks in advance

 
0
emagination2006
Asked:
emagination2006
  • 3
  • 3
2 Solutions
 
emagination2006Author Commented:
Also tried Restore point from 2 weeks ago and still the same.
0
 
younghvCommented:
Hi emagination2006,

This advice from morris1186 is worth trying:

Can you press Control-Alt-Delete and get the task manager up?  If so, you can then goto file....NewTask...  and type in "explorer.exe".  If that can run, then you can try to figure out what is causing it not to open explorer on startup...  Try this:
Start ---> Run ---> "Regedit.exe"

Expand HKEY_LOCAL_MACHINE.
Expand SOFTWARE
Expand MICROSOFT
Expand Windows NT
Expand CurrentVersion
Expand WinLogon

there will be a Key called "Shell".  It should contain the value "Explorer.exe".  If not, Make it that.

(You can also do this is safemode if you cant control-alt-delete)


If that doesn't work, did you try this repair process?
"How to perform an in-place upgrade (reinstallation) of Windows XP"
http://support.microsoft.com/?kbid=315341
0
 
emagination2006Author Commented:
I can run task manager and run most applications without problem. Checked the Shell entry in the registry and looks ok.

If I try run 'explorer' manually from the task manager, the bar pops up for a second and then disappears again. I can't figure out what's crashing it.

I have also tried a repair re-install from the XP CD, but didn't make any difference.

I'm on site at the moment, so think it's gonna be a complete system reformat !!!
0
Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
briancassinCommented:
Are you using a local profile or server based profile when you are logging on

It sounds like something got in the machine...

Can you get to the processes tab in task mananger ?

If you can get to task manager, go to the Processes tab, and look for a process called 'SYSU.EXE'. If it's running, kill it.

Now, if your desktop suddenly returns to normal, then yes, you've got this virus. You're not out of the woods yet. There is probably a folder on your machine called 'C:\Program Files\ddm'. Delete that, of course. You'll probably also want to search your registry for the string 'ddm' and kill most of what you find. In particular the key HKEY_LOCAL_MACHINE/SOFTWARE/ddm, and anything under HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run and/or RunOnce that refers to 'ddm' or 'sysu.exe'.


If you do not find that look for any other odd processes and or anything using CPU time.

Sounds like you got hit with a newer trojan.

You can either format the drive and reinstall or run some anti virus anti spyware tools..

I would try running Panda active scan from http://www.pandasoftware.com I would also run symantec's online scanner and http://www.bitdefender.com

Also you could run rootkit revealer.

0
 
younghvCommented:
emagination2006,

Are you seeing anything in your Event Viewer for Errors or Warnings?

If you had this computer back on your bench and could spend the time tracking down all the potential problems (to include identifying and removing malware) I might suggest taking the time.

If you're on-site and have to get this box up and running, a data back up and 're-load' might be faster.


Vic
0
 
emagination2006Author Commented:
Thanks for the quick responses and suggestions lads!

I'm afraid money is going win out over time in this case and need to get the machine back up and running on the network.

Does look like a virus/malware of some sort, but I'm going to go ahead and reformat. I hate letting these things beat me, but need to move onto the next job.

Going to split the points between younghy and briancassin for such quick replies.

Cheers
0
 
younghvCommented:
E-2006,
Sadly, I agree.
Much more fun to track down these little bugs and pound a stake through their hearts.

Thank you for the points.

Vic
0

Featured Post

2018 Annual Membership Survey

Here at Experts Exchange, we strive to give members the best experience. Help us improve the site by taking this survey today! (Bonus: Be entered to win a great tech prize for participating!)

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now