Member Avatar for HadYourPhil

I discovered I had ctfmona on my computer. A search led me here, where installing and using Combofix was suggested. I did that, and now I have nothing. My desktop picture and the taskbar w/Start, the clock, and icons for AVG and Windows firewall are there, but all desktop shortcuts are gone. While the start menu will pop up (reluctantly), 'My Documents' can't be found. 'Control Panel' results in a 'null' error message. 'Search' doesn't work. Actually, nothing normally found on the right side of the start menu will work. Cntrl+Alt+Delete does bring up the Task Manager; al the processes seem to be there. Performance shows a zig-zag up and down between 10-25%, with the PF usasge at 600mb (albost a full graph).
I also can not boot up in 'safe' mode. HijackThis can be started from the process page at C+A+D, but it doesn't show anything out of the ordinary, other than teo 'file missing' entries: 021 catdmgqt.dll and 023 rpcapd.ini

What can I do??

  • 4 Contributors
  • 9 Replies
  • 119 Views
  • 20 Hours Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

— the symptoms you described (partial desktop, Start menu items on the right failing, inability to boot Safe Mode) are classic signs that the Windows shell, user profile, or related registry hives have been damaged or overridden. , and touched on reinstall/repair and checks; below are targeted, non-destructive checks to try before a full reinstall.

Use Task Manager (Ctrl+Alt+Del) -> File -> New Task to run regedit. Export the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon first, then inspect the Shell and Userinit values. Shell should point to explorer.exe; Userinit should include userinit.exe. If those values were altered, restoring them and restarting Explorer can often return Start-menu/right-side functionality. Always export the key before making changes.

If the registry values look normal, test whether the problem is per-account. From Task Manager create an elevated command prompt and add a temporary local administrator account (use localized, safe passwords). Log into that account — if the Start menu and My Documents work there, the original profile is corrupted and files should be migrated to a new profile rather than trying risky repairs.

Before attempting deeper fixes, back up personal data. If Windows GUI is unreliable, boot from a trusted rescue USB or Linux live disk to copy Documents, Mail, and browser profiles off the disk. That preserves data if a Repair Install or full reinstall becomes necessary. Combofix is powerful and can remove system entries that break Windows; it should be used only with expert guidance and after a full backup.

Recommended Answers

All 9 Replies

Member Avatar for jbennet

reinstall windows

Member Avatar for HadYourPhil

I would love to, but although it's a valid copy, I have no disc, and thus, no idea.

Member Avatar for jbennet

some malware detects when its being removed by combofix and deletes the system

Member Avatar for HadYourPhil

I'd be hard pressed to disagree with you, but what can I do to remedy this?

Member Avatar for jbennet

try going to run and typing sfc /scannow

you may need a windows cd. it doesnt have to be your one (borrow a friends if you need to), it just has to be the same version + service pack.

sfc will check for missing system files

Member Avatar for HadYourPhil

Typing "sfc/scannow" into the 'run' box doesn't work. Did I leave something out?

Member Avatar for jasimp

I am pretty sure there needs to be a space between "sfc" and the "/"

Member Avatar for jbennet

yes, sorry

sfc /scannow
Member Avatar for crunchie

System restore to before you used combofix. Who instructed you to run it?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.