Malware Removal Forums

missing desktop ?!

CWB · 2005-07-08T15:53:10+00:00

hi all , i am new to these forums and certainly do not wish to run afoul of any protocol ... i kinda figured this is the place/way to start . i have a comp (XP) that is infected with "startpage.21.ar" (and possibly other nasty stuff) ... i tried a system restore (safe mode too) to no avail . i reloaded (repaired) windows with the same results ... boot up is normal untill just past the startup logo and then there is a black screen with an arrow . i can bring up task manager/applications and browse thru the folders and files . everything seems to be normal except for the obvious . i am not certain as to how to impliment "hijack this" or load it in this case . i am familiar with comps (but by no means a guru) and not afraid to try something ... as long as i have instructions on what to do . any help in this matter would be most appreciated . thanks in advance ... Larry

17 min read

CWB

July 13, 2005, 1:20 AM UTC

i got the final piece to solving the problem ... another chap was having an identical problem after cleaning out smitfraud ... i tried it and my desktop is now fully functional !!
thanks for all your help on this problem .

Larry

here is what i recieved :

I had the same problem after getting rid of smitfraud.c. I found a fix for it from another site. hope it works for you.....

Here's how to fix this issue:

1. CTRL-Alt-Del to bring up Task Manager.
2. Click File | New Task(run).
3. Type regedit in the Run box and click OK.
4. Browse to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution.options

5. Under this key there will be subkeys named explorer.exe and iexplorer.exe.
These keys are pointing to files that have been removed (virus/spyware); explorer32dbg.exe and iexplore_dbg.exe. Delete the explorer and iexplorer keys entirely (note: the "dbg" files only !) . They should not be listed under the Image File Execution.Options key.
6. Close the Registry Editor.
7. Restart the computer.

Bertha

July 13, 2005, 9:46 PM UTC

Hi CWB,

Can you post a final HJT Log then please, and let me know how things are running?

Bertha

Bertha

July 14, 2005, 9:34 AM UTC

Hi CWB,

Please do as follows,

Download next tool to your desktop:

http://users.pandora.be/bluepatchy/FixO.exe

Doubleclick FixO.exe
This will create a new folder on your desktop called FixO
Open the folder and doubleclick FixO.bat

It will generate a log afterwards. Copy and paste the contents of that log together with a new hijackthislog

Bertha

'KotaGuy

August 8, 2005, 3:15 PM UTC

Whilst we appreciate that you may be busy, it has been 14 days or more since we heard from you.

Infections can change and fresh instructions will now need to be given. This topic is now closed, if you still require assistance then please start a new topic in the Malware Removal Forum

If you wish this topic reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.