Virus - Explorer.exe not found
Posted on 2011-05-02
A clients computer has been infected with a virus and when booting into Windows, has no desktop. One sees the background and after a while the screensaver. (This was only after fixing a log off issue caused by the virus, were the computer logged into a Windows profile and then immediately logged out. This needed a clean wininit file and registry edit to resolve.)
CTRL-ALT-DELETE for Task Manager (henceforth TM) --> Run --> Explorer.exe got an error (paraphrase) "Exlorer.exe can't be found". Trying regedit got a (para) "Registry editing has been turned off. Need admistrator privileges." UBCD4Win and the included Adware took care of that regedit issue. Google said, that to solve the explorer.exe issue, one needs to edit the Registry key as follows: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution.options
Under this key there will be subkeys named explorer.exe and iexplorer.exe. Delete the explorer and iexplorer keys entirely. They should not be listed under the Image File Execution.Options key."
The problem is that Registry key doesn't exist on this system! I've seen other people say the same thing, that they can't find the offending key, on various forums and as yet, have seen no solution suggested. (I saw a TechNet forum post that suggested a winlogon registry key to be checked for a bad Shell value, but the value is correct on this system.)
What is causing the lack of desktop (no shell) and how do I fix it? Failing that, short of removing the HD and attaching to another computer, is there a way to connect to the internet and download other antivirus programs on this system? (iexplorer.exe does not work from TM --> Run, but is there some cmd window that can?)