see if you can get malwarebytes downloaded to a usb stick, and in safe mode maybe you can execute it from the task manager, file, new task

alternatively, hit F8 at reboot, and instead of safe mode, go  "last known good configuration".

it's probably not explorer.exe, but a "driver" that's required to start before explorer does, and the "driver" is really a hook to the virus (if the virus is gone, but the registry entry remains, this happens)

No can't do. Although I can get into safe, I can't see any icons nor can I get to the task manager. So there is no way for me to access any files, at least visually.

Last known good configuration doesn't work either.

well, if you can get to regedit via task manager, this will likely fix you up:

The exact procedure (note, you can do this even though there is no desktop)

1. CTRL-Alt-Del to bring up Task Manager.
2. Click File | New Task(run).
3. Type regedit in the Run box and click OK.
4. Browse to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution.options

5. Under this key there will be subkeys named explorer.exe and iexplorer.exe. Delete the explorer and iexplorer keys entirely. They should not be listed under the Image File Execution.Options key.
6. Close the Registry Editor.
7. Restart the computer.

Can't get to task manager. Clicking on task manager will not trigger any windows.

so when you press alt-control-delete, or even control-shift-escape, does nothing at all come up?

or do you get a task manager window which is missing the standard file/options/view/help menus?

if you're missing the menus, you can double click the border and get them back

if you cant get task manager to come up at all then we can trick safe mode into executing regedit instead of doing anything else and go from there

[Admin Edit] is classified as a malware site by malwarebytes, and is blocked by most antiviruses and firefox's built-in security.

disabling all security, the link is 404 not found - dead, anyway.

erd commander 2005 is an EXPENSIVE program, and if you just posted a link to a warez version of it, shame on you.

malwarebytes is free, www.malwarebytes.org  and is an excellent program to clean/prevent viruses/malware.

firefox is free too, www.getfirefox.com :)

erd commander 2005 costs $150, is not free, not even a trial.  the link that was posted by the other expert will download a working copy, but is illegal.

i never suggested he install malwarebytes, i simply said that your warez link is blocked by malwarebytes, firefox, and most antivirus programs.

My opinion is this. With the situation this machine is in, I think I would do this. I would remove the drive and hook it up to another pc as a slave. I would retrieve any information the user may need from the drive. I would put the drive back in and format it and reload a fresh copy of windows.

It is going to take a fair amount of time to try this that and the other. In the mean time you could be working on a solution you know that is going to work. Aslo, who is to say that if you get the machine back up and going that you fully de-infected the system? It has been my experience in the past that I have worked much longer trying to fix a problem than it takes to just reload the OS.

ok that means exactly what it says - execute it from a usb stick... what part of that is unclear?

you know what, ajkreddy, i'm going to stop crapping up this guys thread with useless arguments.  if you want to continue your futile attempts at arguing with me, contact me directly.

Can you get to a DOS prompt?

If so....

Tasklist /svc

Paste the output here.....

You can go straight to c:\windows\system32\cmd.exe

If you cant, try Safe Mode /w Command Prompt....

crt+shift+ESC does nothing. Clicking on the task manager does nothing. I basically cannot access anything in any modes (not even safe mode with command prompt). I will try the rescue CD approach but past experience hints that it probably won't work. If that is the case, I will just backup the data with pre-Win and just repair install. I will let you guys know how it goes.

I don't think a repair install will work here.  A fresh install might be called for.  Then you'll also be sure of getting rid of whatever got you.

Their live cd is fairly "bulletproof"! :)
Key is to let the database update (obviously!)

ajkreddy's thought about the erd commander WILL likely fix the problem (by using my registry setting change), but only if you're ok violating a few laws by downloading that software and violating copyrights.

posting links to warez/illegal software is against the terms of service of experts exchange, and i wouldnt be surprised to see ajkreddy and his posts just disappear in a few minutes.

Try thi
http://support.microsoft.com/default.aspx?scid=kb;en-us;818150&Product=winxp

The cause is your 'explorer.exe' file may be deleted or corrupted. Check  for it once. If so, Copy the 'explorer.exe' file from 'C:/WINDOWS'  folder from any working/healthy(eg., your friend's)computer and paste it  in your 'C:/WINDOWS' directory and Restart your system.
 That's it. All desktop icons and taskbar will be visible and working.

Or try using combofix.exe

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

The Kaspersky rescue CD fixed the issue this time. I got to admit though that the local policy of the system was changed a lot and still needs some work but at least I'm able to see everything now. Thanks for the suggestions, especially those who read my situation clearly.

Did you get to save its report?
One to watch out for if it messes with policies, unless malware affected them prior.

Unfortunately I forgot to save the report and now I gotta figure out how to reverse back some of the policies to its original state. Especially the one that disables the Symantec client.

Unfortunately, I can't help you with your new issue :(

If you need more assistance you could open up a related or new thread and add the relevant zones.

Or reopen this one and get the required zones added.