Missing Desktop Icons

[vapctech]

Hello,

I'm a Newbie here so please bear with me if this has already been answered. I've looked through a ton of threads but I haven't seen this exact issue answered...

Windows Xp. Loads to desktop but then there are no icons. It was auto logging off, but I've been able to stop that (got that from a thread here) but now it just sits at the desktop.

Ctrl+Alt+Del does not work
Safe Mode doesn't work-get BSOD

I ran the UBCD4WIN(got that from a thread here too) and SuperAntiSpyware found hundreds of malware. Got that cleaned off. Attempted to check the registry but I don't know what I'm looking for at this point.

Oh yeah, prior to running the UBCD4WIN I ran Kapersky's virus boot CD and that didn't find anything which surprised me.

I'm stuck at this point. Any help will be greatly appreciated.

 

[NYJimbo]

Not knowing what your fix was for the auto logoff its hard to tell what the next step should be.

If you replaced userinit.exe or did something in the registry that would help to tell why you are where you are right now.

 

[vapctech]

Thank You for your quick reply.

I did Shift+F7 to stop the auto log off. But actually, I just let it sit now for about 15 mins on the desktop and it logged off again.

I didn't edit or delete anything in the registry. Just looked to see if I saw anything that looked suspicious. I've been able to find viruses/malware that way before but nothing looked suspect so I left it alone.

 

[NYJimbo]

I really would do a deeper inspection for viruses. Either a Dr. Web boot disk or something like GMER.

Stopping a auto-log off with a keystroke is not a permanent fix. You might have a root kit that has done a dozen "tweaks" to your registry and replaced your userinit with its own shim off code. Kaspersky alone is not enough.

You need to really be sure you are clean and then after that you might even need to use a boot disk like UBCD4win and run the remote registry editor to check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon to see if it calls userinit.exe

Lots of other things, but first is to make sure the machine is not under a viruses control.

 

[vapctech]

Got it. Will try those things you suggested and see how it goes...

 

[NYJimbo]

Got it. Will try those things you suggested and see how it goes...

Yeah, because the Shift F7 might just have halted the normal logoff that would happen for a missing "winlogon" entry or missing file for that entry. So that would give you the blank screen and a catatonic machine. Not sure why it eventually logged off, but it probably was some kind of timer that kicked in (idle keyboard, some intertask communication failure, etc) but I would really suspect something with the registry entry at this point.

If you do manage to get into regedit or some other reg editing tool and find that the entry is different from userinit.exe then that would explain the logoffs.

Correcting the entry (I think its "C:\WINDOWS\system32\userinit.exe," but not sure as I am on a Vista box right now) and booting might get you back, but if userinit.exe is really gone you will have to get a copy of it as well. Could be elsewhere on the drive/drivecache or some windows disk you have.

 

[anonymous Mac Tech]

Hello,

I'm a Newbie here so please bear with me if this has already been answered. I've looked through a ton of threads but I haven't seen this exact issue answered...

Just throwing this in there to make sure the simplist thing wasn't overlooked, but how about right click on desktop ->show desktop icons?

 

[vapctech]

Yep Mac Tech..tried that..I usually do those things first, as I've been embarassed before

NyJim..I was able to run a registry scan using UBCD4WIN and looks like you're right...Found Antivirus 2010 and smss32.exe..about to run another scan

 

[NYJimbo]

Yep Mac Tech..tried that..I usually do those things first, as I've been embarassed before

NyJim..I was able to run a registry scan using UBCD4WIN and looks like you're right...Found Antivirus 2010 and smss32.exe..about to run another scan

BINGO ! Thats it. That virus will do the exact thing I mentioned. Once you get control of the machine you should be seeing the desktop again.

There might be a winlogon86.exe or something like it in regedit in place of userinit.exe

It might not have damaged the original userinit file, but not sure as the engine that runs AV2010 is being updated regularly. Most recent ones will kill RKILL even though there are posts here that tell you to run RKILL to kill AV2010.

Just get ready to have to do more. If I recall the last version turned off several things like autoupdate, abililty to change the desktop wallpaper, ability to run task manager, etc. Not too many, but probably a half dozen things. Didn't require a reformat but took a bit of time.

Its a tough battle but we learn a little more each day and "keep on keeping on".

 

[vapctech]

Thanks for all your help..Yeah, I see it's going to be a long night hehe..but at least now I know I'm headed in the right direction.