Virus scan using, rebooted, desk top completely blank

Helping a friend who had encountered several viruses on pc When I started sytem would boot, but would never stabilize as the screen kept changing and popping up new garbage. I took the drive out of the pc, put it in another one, used VIPRE to scan and clean the hard drive. When I reinstalled drive in original computer it booted and came up to a blank screen right after log in. Login never got to the welcome screen, and desktop is blank and blue now.

I ran XP repair on it, which appeared to go ok, but even after completion the problem persisted, with the same symptoms. I can get into task manager and can browse the system from there, but so far have not been able to get any progrems to run from the run screen.

Desk top shows up in the browser, and appears to have normal stuff in it. So far I have not been able to get anything on screen except a blue screen.

Anyone have any suggestions. I can just go ahead and format partition and reinstall,but unfortunately the friend does not have copies of all their programs, so would like to save as much as I can. So far, not much luck.

Thanks in advance for assistance.

 

When you pull up the task manager, click File>New Task (Run) then type explorer and hit Enter. If the desktop and taskbar load, read this post then post the dds logs in a new topic in the Malware Removal forum.

 

Thanks Evan,
Safe mode is the same screen as normal mode. In task manger I can browse and see drives and files, IE will run, as will Firefox. It just seems as though the logon never completes and I don't know enough about the process to really trouble shoot it. And data back up is not a problem, as I can do that from task manager. But the user does not have program disks of all their programs, and if I format it, then they will lose some of their programs. As a note, Vipre found 28 threats on the drive, with numerous threads as most had been saved in restore files several times.

I plan now to replace files one by one from another XP machine, and see what happens. I can't lose much by trying that.

Thanks for your input.

 

I do not recommend this. Many system files are version dependent.

 

I agree with that, and would not normally do it. In this case it is last resort stuff. I think that there are more than one corrupt file in this OS now, as a result of the numerous virus infestations. I think that this afternoon, I will probably just pull the trigger and format and move on.

Thanks for the help and advice.

 

Since you didn't give us any results of the recommendations from post #3 above, did it work? If not, please use the Browse feature to check for the existence of C:\Windows\explorer.exe
If present, select it then try to run it.
If not present, it can be extracted from the cd.

If you did a repair installation, the system files would have been replaced with fresh copies. Unless an infection is still present to re-infect them, they should all be OK. Transferring replacements from another machine would be for naught.
Running the system file checker would be more advisable in such a situation that the system files were re-infected or corrupted.

 

C:\windows\explorer.exe does exist and will not open, either by run in task manager or by double clicking from the directory. Both say that it can not be found, even though I look at the file, and it is there. I agree with you that files should be correct, but apparently the repaid did nothing to change files at all.

What is this system file checker you refer to? I did rerun both VIPRE and Avast against the hard drive with the problems, and both programs gave it a clean bill of health. Of course that does not testify to the validity of the files, or to whether there are files missing.

Another strange indication is that when I tried to run regedit from CMD, I got message that administrator had blocked Registry Editing. But since I can't log on, that could be because I do not have rights, especially since I don't think logon is complete.

I have a little time to continue to try to find problem, may try repair again, and this time check files before and after to see if any changes made. I bet one thing, and that is that my friend will keep a current virus checker and a back up from now on.

Thanks again, sorry that I did not get back to you on your prior suggestion.

 

Right click explorer.exe and check the properties for size, version, etc and let me know what you find. There may be another copy on the drive we can use if necessary.


System File Checker
Open a command window and enter the following bolded command, making sure to leave a space between sfc and /scannow.

sfc /scannow

The system file checker utility should run and begin verifying the system file's integrity. If any files are found needing to be replaced, you may be prompted to insert the XP cd. When the utility completes, try running explorer again.

 

Currently running repair, will take a few. But I have replaced the explorer.exe with one that was in the dll.cache. (which was the same size btw) .

Once repair has completed, if it still fails, then I will get that explorer info for you, as well as run the file checker.

Ken

 

I have completed repair, and as I suspected it failed also. Ran file scan with no errors reported. And here is the info on Explorer.exe Size 1,032,192 Version 6.0.2900.2180. It appears as if something is blocking the repair from actually updating files. I think the basic problem has to do with logon, as it never gets to the welcome screen, and the system does not reflect the right user. When it opens the CMD screen, it had the user as enduser, and not the one who appears on the intitial log on screen. Anyway, a lot of strange things. Another example is in the Windows directory, when you try to open the system folder, it shows as being blank, yet if you copy it to another place it opens and shows all the files which are in it.

I will keep looking around. Will update you tomorrow and let you know what happens.

 

Since you have use of IE, lets see if you can get a log that might give more clues as to what's going on. Download DDS from one of the 3 mirrors and save it to your desktop.

Mirror 1 Mirror 2 Mirror 3

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop.

Please include the contents of the following in your next reply:

DDS.txt

I may ask for the Attach.txt log later, so keep it handy.

 

Tues morning, 2-3. Bad news, ie opens but cannot access network from this machine. So not able to get the DDS test to run. I am about to get fed up with this and just go ahead and format and reload XP. By the way, have you had any experience dealing with a program called AV2009, supposedly an antivirus program. It seems to be malware in itself, and I suspect it is at the root of the problems on this machine. VIPRE listed it as a
rogue program, and it seems to have been well hidden on the machine and very difficult to remove. Again, thanks for your help and interest.

 

Final conclusion to this thing and you can close out the incident. I finally talked to owner and decided to format and reinstall windows XP. That has been done and all is working well.

Question still remains as to why reinstalling in repair mode did not have any effect on this problem, it appears that it just did not even install anything. OH, well Windows 7 is coming.

Again, thanks to all who gave help and advice on this weirdo.