Member Avatar for NilePeppas

I'm trying to help a friend who's computer is in trouble.
Initially, everytime he wrote the word 'sex' in his computer, it rebooted. So in Word, IE, Firefox, Cubase, anything. Also in searching for spyware/malware removers it also reboot.
I went round to his house and downloaded a generic windows spyware/maleware remover (not remembering the name of the malewarebytes software). and installed.
On completion of scan the software automatically deleted any problem viruses/files.
and immeadiatly afterwards was fine, we checked with various essays he had previously saved with the term 'sex' in, and various songs (he had saved in cubase).
When we reboot however, Bigger Problems.
No desktop icons, and No task bar.
Ctrl alt del works to open anything, but there is still a problem.
Now I tried downloading Malewarebytes, AVG, and HJT, and none of them load. For maleware and HJT there are error messages pertaining to registry or .DLL files missing, and for AVG is says that he needs to upgrade from windows 2000 service pack 5 (i think) when he has XP SP1.
Have browsed around, and various forums suggest;
Safe mode System restore (doestnt work)
download RegisryFIx (cost money and others suggest it doesnt work)
PC CILLIN bug (He doesn't have Pc cillin).

Please Help.

  • 4 Contributors
  • 3 Replies
  • 226 Views
  • 5 Months Discussion Span
  • Latest Post Latest Post by cohen

Dani AI

Generated

Brief context tied to the existing replies: the behavior described by (system reboots on a specific keystroke, then loss of desktop icons/taskbar after a "clean") suggests either the interactive shell (explorer.exe) is no longer being started or core system files/Winlogon registry values have been altered by malware. Suggestions from and to use scanners and collect logs are appropriate, but when installers fail with DLL/registry errors the first objective is to confirm whether the shell is simply not running and to preserve user data before deeper repair attempts.

Quick triage (no downloads required)

  • From the secure desktop: open Task Manager (Ctrl+Alt+Del -> Task Manager) -> File -> New Task. Run explorer.exe. If the taskbar and icons return, the problem is the shell autostart rather than a missing GUI component.
  • If installers still fail, open the registry via Task Manager (New Task -> regedit.exe) and export a backup of the key below before making changes. Check these Winlogon values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  Shell   = explorer.exe
  Userinit = C:\WINDOWS\system32\userinit.exe,

Restore those exact defaults if they differ (export before editing), then reboot.

If explorer won't start or many executables error out, work offline: boot from a clean rescue/live environment (Windows PE or a Linux live CD) to copy critical files and run offline AV/rootkit scans. From Windows (with admin rights and the original XP media available) run chkdsk /r and sfc /scannow to repair disk and system files; if the OS won’t run, perform these checks from the recovery tools on boot media or use a rescue ISO. Imaging the drive first preserves data and allows rollback if a repair makes things worse.

For diagnostic completeness, produce logs (HijackThis-style and anti-malware logs) once a stable environment is available — portable copies run from removable media or output from a rescue environment are ideal; that output is the most useful next step for deeper analysis, and if repair becomes impractical the safest route is to back up user data, wipe, and reinstall a supported OS.

Recommended Answers

All 3 Replies

Member Avatar for acejames1

can you use the trend micro house call at all if not it could be a super virus that replaces your windows xp with something that looks and feels like its windows xp but just rewrote your computer and acts as tho its windows xp

Member Avatar for cvv.sale

Removed.

Edited by PhilliePhan because: Illegal
Member Avatar for cohen

OK, wierd replies......

Pls do the following:

1. - Download Malwarebytes' Anti-Malware (http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

2. - Download and post the log.

In your reply, post the logs (in this order):
1. - Malware Bytes Log
2. - Hijackthis Log

Thanks,

Cohen

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.