Member Avatar for jovana

Hi!

Since yesterday i have a problem with my computer. My PC is infected by some kind of virus when i was trying to install one program for unpacking rar files with passwords, from mininova:(
Result is - all icons on desktop and taskbar is showing for 30sec and then they all disappeare and again appeare 2 times and then again vanish and there is only background with wallpaper and mouse arrow. So i tried to solve the problem - Task Manager -> File -> New Task -> explorer, and they appeare again for only 30 sec. Then File->New Task->regedit.exe -> hkey_local_machine -> Software->Microsoft->Windows NT-> Current version-> winlogon in Shell i retype Explorer.exe but noting happen, the problem still exists.
I scanned it with nod32 and then with SuperAntiSpyware, but again no results.
I am not an expert so if anybody can explain me in simple words what would i do to solve the problem. Thanks!

  • 5 Contributors
  • 5 Replies
  • 499 Views
  • 10 Months Discussion Span
  • Latest Post Latest Post by orestrada

Dani AI

Generated

Short expert summary and context: the pattern described (desktop and taskbar appear briefly, then disappear) most commonly means the Windows shell is being interfered with — either explorer is crashing repeatedly or a malicious component is replacing or re‑directing the normal logon/startup sequence. Community suggestions here (notably ’s shellfix idea and ’s explorer workaround) can work when the problem is a single, reversible registry change; they won’t fully remove hidden persistence, rootkits, or damaged system files. ’s choice to format is a definite way to stop reinfection but sacrifices recoverability. (cisa.gov)

Practical, staged recovery (safer than immediate formatting)

  • Make a read‑only backup of personal files first (do not restore them until scanned).
  • Update AV signatures, then run a full offline/bootable scan — this detects threats that hide while Windows runs. From elevated PowerShell you can trigger the offline Defender scan: 
    Update-MpSignature
Start-MpScan -ScanType FullScan
Start-MpWDOScan
  • After removing malware, repair system files before trying to restore the shell:
    dism /online /cleanup-image /restorehealth
sfc /scannow
  • Use a trusted autorun/startup inspector to find remaining persistence entries. (support.microsoft.com)

When to accept a reinstall: if offline scans, rootkit checks and system‑file repair don’t stop the behavior, a clean install is the most reliable recovery. Before reinstalling, scan any backups you intend to keep (don’t restore backups made after the infection). Formatting and reinstalling removes hidden hooks at the cost of time and settings; for many compromises that is the safest path. (support.microsoft.com)

Notes and cautions: avoid reusing untrusted installers (the original source), don’t rely on a single scanner, and consider using rescue/boot disks when malware persists. Community fixes helped many on this thread (, reported success), but modern best practice is: backup safely, run offline/bootable scans, repair system files, then only reinstall if the system remains compromised. (cisa.gov)

Recommended Answers

All 5 Replies

Member Avatar for Doctor Inferno

This is most probably caused by the malware "F-Nimda"

The SHELLFIX.REG (download below) file is used to fix Explorer startup problems
resulted from unconditional termination of F-Nimda tool during
its operation.

If F-Nimda tool is terminated by a user or operating system while
it is scanning a hard disk, there will be no icons and no taskbar
on Windows desktop. To fix the problem you will have to run the
SHELLFIX.REG file.

Info here:

Download:


Also, post a hijackthis log

Member Avatar for might_halo

HI. I know the solution for this kind of problem what you have to do is....

1. hit ctrl+alt+delete
2. New task, browse C:\windows.
3. Copy explorer and paste it in C:\windows. rename it explore.
4. Open regedit in C:\windows.
5. Hkey_local_machines\software\microsoft\windows nt\current version\winlogon. (single click on winlogon)
6. Double click on shell (which is in the column beside winlogon). In the place where it is written explorer.exe write C:\windows\explore.exe (the new one you just pasted)
7. hit ctrl+alt+delete.
8.newtask, browse C:\windows\explore.exe.

This would solve your problem
Bye.

Member Avatar for jovana

Hi!

Thanks for advice, but i resolve the problem, i format my disc:)
And i've tried that, but it didn't help me.

Member Avatar for cushbin

Thank you my dear friend...

Thanks a lot...

I was so disappointed with this shitty virus/malware that affected to my laptop.

Its been solved with your valuable suggessions.

Thanks again buddy.


---- A B CUSHBINSHAD

Member Avatar for orestrada

Thanks a lot. You saved me a lot of time and aggravation.
I had exactly the same problem and I followed your advice. It worked perfectly for me.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.