No desktop, explorer wont run

[buksida]

Have an XP box here that boots to windows desktop but shows nothing but the wallpaper image.

CAD brings up task manager but explorer wont run, gives a "Windows cannot find explorer" error.

All I can do with it is cmd and task manager.

Tried a few things from what I found online but nothing has worked so far, LKGC and safe mode do the same. Copied explorer.exe from another XP box but no joy.

Any ideas? Really don't want to format this one!

As a side note it recently had trojan.vundo cleaned using the Symantec removal tool.

[NooNoo]

Buksida, there are so many variants of vundo that I would suggest you have not yet got the machine clean and/or your virus checker has been screwed up and is preventing normal booting.

What happens in safe mode?

[buksida]

Does exactly the same, goes into windows but with no desktop or taskbar.

I'm actually running Firefox on it now typing this, run via task manager.

[CCT]

Try this:
http://www.microsoft.com/protect/pro...tyscanner.mspx ,

then, if that doesn't work, this;

http://www.tutorials-win.com/XPBasic...esktop-313894/

edit: Lastly, give this a shot:

http://download.bleepingcomputer.com...a/ComboFix.exe

[Ferrit]

Likely hiding in the restore files
A lot of people run the fix without shutting down restore and it immediately becomes reinfected

[buksida]

Thanks for the suggestions, gave them all a go.

First one failed, griped about IE and activeX

Second one failed, no change

Third one failed ran it several time with reboots but no difference.

The big "F" then ... there goes another days work

[CCT]

Get and use these:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

http://secured2k.home.comcast.net/to...undoBeGone.exe

http://www.atribune.org/content/view/24/2/

http://www.grisoft.com/doc/download-...otkit/us/crp/0

[slgrieb]

For what it's worth, buksida, some infections are just going to mess up a machine to the point that repairing the damage isn't practical. But there are some things to try that you might have missed. When you attempt to run explorer from the task manager, try typing the full path name C:\Windows\explorer.exe. If that gets you back to a desktop, then it's likely that some further fixes might get you going.

But if that fails, boot to the recovery console and verify that you have a copy of explorer.exe in the C:\Windows folder, and that it is about a megabyte in size. Next change to the C:\Windows\sytem32 directory and rename browseui.dll to browseui.old, and do the same for shell32.dll, then restart. You should now either have a desktop, or be able to get to it by running C:\Windows\explorer.exe from task manager. At that point running smitfraudfix and/or combofix should usually kill your pests.

If you go to the recovery console and find that explorer.exe is missing, or deviates much from one meg in size, I think you can safely assume that you are likely to find other damage in the system and it has to be reformatted. In all probability, the machine is still likely to be infected, so a repair installation will generally fail.

FYI, in recent months, I'm not finding that any of the dedicated Virtumundo removal tools (including VundoFix, etc.) are effective. Usually, you really want to clean up some of the infections that typically accompany Virtumundo these days before you tackle The Beast.

[buksida]

Thanks for the suggestions, I did try to replace a bunch of these files but with no effect.

Its now formatted and running sweet, I'll just have to remember for next time should I come across this most annoying problem again!