XP: Desktop without taskbar or icons, explorer.exe & iexplore.exe messed up
I had a machine that booted fine, but had a lot of spyware and virus. After removal, the machine would boot to the desktop wallpaper, but no further. Opening task manager and trying to run explorer generated an error that the file was not found, when it was there. I found a fix online that worked great, and I wanted to share with anyone who might be having the same problem. Here is the transcript of the message....
However I finally sussed this one out. Basically it was down to StartPage as root cause as far as I can make out. On 'my' machine Norton had had problems with StartPage, then eventually cleaned it. However it looks like although it finally managed to clean the files associated with StartPage, it left behind some registry entries.
By poring over what was logged in Sysinternals REGMON tool as I tried to do Start>>Run>>Explorer.exe, I found that when I tried this the following key was looked at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe - in here there was a value of 'explorer32dbg.exe' for Debugger
Alarm bell here - as in explorer32dbg.exe was one of the files previously listed as infected by StartPage - I figured to fix it I'd probably need to copy in a good one from elsewhere, but actually when I checked my own clean PC that registry key was not even present, sooo I took a deep breath ... backed the key up, then deleted it, and lo and behold after a reboot everything came back to life just fine
On another forum I had seen that Internet Explorer was also subject to this issue, and again I found the same issue (iexplore_dbg.exe was referenced this time), and pretty much the same fix - just needed to delete the following:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
And it all came back to life!! My guess is that StartPage used these entries to run its nasties any time explorer or iexplore ran (even in Safe mode - not nice )
I imagine that the fix being a simple registry hack is annoying if you already rebuilt - but honestly didn't post this to wind you up at all - just thought I'd put this info out there for the next poor person who ends up trying to sort this one out - it cost me about 8 hours work before I got there with this one, and frankly I could have rebuilt twice over in that time, but I just couldn't let this one go - you could just tell that the underying machine was still working fine, just unable to throw up a shell (I even eventually ran a copy of explorer.exe renamed to exploder.exe as a custom shell for a while).
Anyway - hope this helps some other unfortunate soul in the future
