Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Missing Desktop, no task manager XP Media Center 2005


  • Please log in to reply
37 replies to this topic

#1 Nerdful Things

Nerdful Things

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Location:Portland Maine, USA, Earth, Sol
  • Local time:02:37 AM

Posted 10 November 2009 - 08:48 AM

Greetings,

This machine is a hand me down, and no install disks are available. Has valid COA sticker.
In addition to the symptoms I will describe, I would appreciate the following questions answered, and it may help others in their search.

1. Is Windows Media Center Edition 2005 an enhanced XP Home or Pro?

2. Can a slipstreamed XP Home or Pro be used as a recovery disk?

3. How to enable RAID array in mirror mode using a windows boot disk recovery console. I have XP Home, PRO original disks plus slipsteam versions of sp2 and sp3 available.

Windows does not recognize any drives when trying to run recovery console off the cd.

Ok, symptoms. User was running the machine when it blinked, and maybe froze, but he restarted it.
User login screen comes up, 4 users I a couple with no password needed.

Desktop appears to load, but all that is available is the background picture and mouse pointer.
Cannot get into task manager, ignores any attempt, no error message.

Safe mode loads just a black screen with safe mode in the corners, again with ctrl-alt-del ignored, no task manager.

If I try to run sfc /scannow, I get error to effect service not available.

Tried safe mode command prompt, was able to initiate chkdsk /f, on restart, in which it found and corrected a large amount of errors.

Ran a PCLinuxOS remastered Livecd with an updated KLAMAV virus check, it found nothing substantial, just broken executables and encryped zip files.

Ran independent drive tests, found no bad sectors or other problems.

Dell Model XPS Dimension 400/9150. Note: No standard KB/mouse connector, all USB. RAID drive pair in mirror mode.

Edited by Nerdful Things, 10 November 2009 - 08:50 AM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,260 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:37 AM

Posted 10 November 2009 - 11:12 AM

<<Windows does not recognize any drives when trying to run recovery console off the cd.>>

What CD might that be? The XP Recovery Console actually appears as an option when you use this CD?

<<Tried safe mode command prompt, was able to initiate chkdsk /f, on restart, in which it found and corrected a large amount of errors.>>

I would go back and run chkdsk /r, attempting to recover data which may lie in bad sectors. Chkdsk /f doesn't do that.

Since you made it into safe mode...did you check Event Viewer for possible clues?

Is the RAID properly recognized in XP? In the BIOS?

I don't understand at all...how you can enter safe mode...yet the Recovery Console reflects no valid XP install.

<<Is Windows Media Center Edition 2005 an enhanced XP Home or Pro?>>

I wouldn't say "enhanced" but it's assumed to a modified version of XP Pro. See Features at http://en.wikipedia.org/wiki/Windows_XP_editions.

<<Can a slipstreamed XP Home or Pro be used as a recovery disk?>>

Depends on what you mean by "recovery disk" and on what system.

If you mean can one or the other be used to access the Recovery Console on a MCE system...either one can.

If you mean can a XP MCE user accomplish a repair install with either...I don't know. From what Wiki said, I get the impression that the keys are not the same for MCE and XP Pro...and the proper key is necessary to do any repair install of XP.

<<How to enable RAID array in mirror mode using a windows boot disk recovery console.>>

Are you talking software RAID or hardware RAID?

A hardware RAID cannot be initiated by anything related to Windows...Windows XP has no native recognition of a RAID, which is why the drivers must be installed during the XP install.

I don't know anything about software RAIDs, other than the fact that they are possible on some editions of Windows. See http://www.techimo.com/articles/index.pl?photo=149.

Offhand...since the system boots into Windows (somewhat)...I would be thinking "malware" but malware is not the only reason XP system files may become damaged.

The fact that you cannot run sfc /scannow...suggests that a repair install effort needs to be made. But that seems to be complicated by the fact that the RC recognizes no valid Windows install/hard drive.

All of which just may point to the fact that the RAID is broken...I don't know.

Louis

Edited by hamluis, 10 November 2009 - 11:13 AM.


#3 Nerdful Things

Nerdful Things
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Location:Portland Maine, USA, Earth, Sol
  • Local time:02:37 AM

Posted 10 November 2009 - 01:38 PM

Thank you for the reply.
FYI the raid drives show up ok when I boot with a livecd, linux PCLos, so I should be able to add or remove files, etc. For example, I have a working laptop with Media Center installed (not sure if it is 2005). Possibly for example, putting another explorer.exe in for example.

I will try some of your suggestions now, and later elaborate on your questions.
I just tried taskmgr.exe from within the windows\system32\ folder, it shows in the dir list, but when I type it it says file not found. I'll go now and follow some of your help.

Thank you much for the response.
At worst, there is a system recovery partition available.

#4 Nerdful Things

Nerdful Things
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Location:Portland Maine, USA, Earth, Sol
  • Local time:02:37 AM

Posted 10 November 2009 - 01:59 PM

<<Windows does not recognize any drives when trying to run recovery console off the cd.>>

What CD might that be? The XP Recovery Console actually appears as an option when you use this CD?

<<Tried safe mode command prompt, was able to initiate chkdsk /f, on restart, in which it found and corrected a large amount of errors.>>

I would go back and run chkdsk /r, attempting to recover data which may lie in bad sectors. Chkdsk /f doesn't do that. <I ran chkdsk /r, it started, but within seconds it said found no errors and booted back to the problem.
FYI, I can hit the front button or the sleep button on the KB and shut down gracefully from the desktop>

Since you made it into safe mode...did you check Event Viewer for possible clues?
13:56PM <will do that now soon as I find the command>
14:19PM <ok, was able to run event viewer, poking around, I see lots of info, and lots of errors of the recent boot attempts. I am going to rename explorer to myexplorer.exe and see if it runs, else I will put back to normal. Must head out soon, so If I get nowhere now, please advise, event viewer info etc.>

Is the RAID properly recognized in XP? In the BIOS?

I don't understand at all...how you can enter safe mode...yet the Recovery Console reflects no valid XP install.

<<Is Windows Media Center Edition 2005 an enhanced XP Home or Pro?>>

I wouldn't say "enhanced" but it's assumed to a modified version of XP Pro. See Features at http://en.wikipedia.org/wiki/Windows_XP_editions.

<<Can a slipstreamed XP Home or Pro be used as a recovery disk?>>

Depends on what you mean by "recovery disk" and on what system. <I meant using the XP Pro sp2,3 slipstream boot disks I made>

If you mean can one or the other be used to access the Recovery Console on a MCE system...either one can. <is what i figured>

If you mean can a XP MCE user accomplish a repair install with either...I don't know. From what Wiki said, I get the impression that the keys are not the same for MCE and XP Pro...and the proper key is necessary to do any repair install of XP. <that's what I figured>

Are you talking software RAID or hardware RAID?

<maybe there is an independent raid driver from Dell I can add at the f6 prompt on the RC, but I'll work on these other things first, since I can get at a safe mode prompt.>

Offhand...since the system boots into Windows (somewhat)...I would be thinking "malware" but malware is not the only reason XP system files may become damaged.
<He said the screen blinked, then I think he had to do a hard reset. I also suspected hardware, but mem tests, and overnight drive exercise went perfectly.>

EDIT: 14:30PM I got the malicious file removal tool running. It is doing quick scan. If nothing found, I'll start a full scan before I leave for the afternoon.

Edited by Nerdful Things, 10 November 2009 - 02:30 PM.


#5 Nerdful Things

Nerdful Things
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Location:Portland Maine, USA, Earth, Sol
  • Local time:02:37 AM

Posted 10 November 2009 - 10:02 PM

21:59PM Here is what I found after leaving it running in full scan:

Malware scan results
Trojan:Win32/FakeSpypro Removed
Trojan:Downloader:Win32/Renos.DY Removed
--
I rebooted and it went into dskchk without my asking it to. It found tons of stuff and fixed it. Then I manually ran chkdsk /r and it said no problems found.
I rebooted, and still no change, taskmanager unavailable, no icons or taskbar, just the background. At some point after the background screen comes on a McAffee splash screen shows for a second.
Event log I looked at earlier looks like it is running, maybe it gets hosed when starting.

Now what?

#6 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:04:37 PM

Posted 11 November 2009 - 06:39 AM

I rebooted, and still no change, taskmanager unavailable, no icons or taskbar, just the background.

Did you try re-naming &/or replacing explorer.exe in the Windows directory?
Using a Linux LIVE CD, re-name explorer.exe to "aaa.exe" in the Windows directory and then copy "explorer.exe" from C:\WINDOWS\ServicePackFiles\i386 to the Windows directory.
Start your system normally and see if that shows the taskbar/start button and desktop icons.

Try the following ...
Log into Safe Mode using the "Administrator" account (assuming of course, that you do get offered that option) and press Ctrl+Shift+Esc. Does the Task Manager window appear?
If the Task Manager appears, on the "Applications" tab, click on "New Task" and type "cmd" and press .
At the command prompt ...
Type "aaa.exe" and press
Does a Windows Explorer window open?
At the command prompt ...
Type "explorer.exe" and press
Does a Windows Explorer window open?

You said: "If I try to run sfc /scannow, I get error to effect service not available"
This cannot be run from Safe Mode: That is why you get the error message.
(Nor can it be run from the Recovery Console, in case you were thinking of trying it at any time in the future.)

You said: "I ran chkdsk /r, it started, but within seconds it said found no errors and booted back to the problem."
There is a problem here: chkdsk /r is not running at all. This command (scan and repair) takes considerable time to run if it is working properly.

There is no doubt in my mind that the problem is caused by malware, having seen a couple of similar cases very recently, with rootkits. The situation is recoverable though, and if you wish help in that direction please let us know so that we can arrange for a moderator to move this thread into the "Am I Infected?" forum area: That is the proper protocol here. You can then be assisted with malware removal advice.

Threads that may be of interest:
specialkman: http://forums.majorgeeks.com/showthread.ph...1397&page=4
possumbarnes: http://www.bleepingcomputer.com/forums/t/268785/no-icons-taskbar-start-menu/

Edited by AustrAlien, 11 November 2009 - 06:57 AM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#7 Nerdful Things

Nerdful Things
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Location:Portland Maine, USA, Earth, Sol
  • Local time:02:37 AM

Posted 11 November 2009 - 11:30 AM

I would appreciate if you would move me, next time I will be more careful where I post.

I tried renaming explorer.exe to myexplorer.exe yesterday and running it but it says file not found, even though it shows it in the system32 directory I am resident in.

I have a problem with the RAID array and the LiveCD: there is a mirror drive, both of course containing the explore.exe files, is it safe to drop a new file into each drive?

I am not going to do that at the moment, instead I will see if can do some copying and renaming of explorer.exe at the safe mode command prompt. At this point, this is where I miss floppy drives the most, I'm sure the USB system will not be running, so I may need to know what is safe way to drop a new explorer into the system. I searched all around for my situation with RAID, but no one has my particular problem.

Edit: 12:02PM I was able to see the usb key, and then renamed explorer.exe on the system to aaa.exe. Then I copied the explorer.exe from the usb key. However this was from a XP pro machine, not a home media center. I did this using safe mode command prompt, not the LiveCD. Same symptoms.
I will now try from the \windows\i386 as you said. Note: Task manager has never worked on this since I started this ctr-alt-del is just ignored as is ctr-shift-esc. . Neither will it run from command line in safe mode prompt.

Thanks again!

Edited by Nerdful Things, 11 November 2009 - 12:07 PM.


#8 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:04:37 PM

Posted 11 November 2009 - 12:22 PM

I tried renaming explorer.exe ............... shows it in the system32 directory.

Just a quick note for the moment ..... whoa !!!!
The correct location of the legitimate Windows file "explorer.exe" is in the WINDOWS directory.

C:\Windows\explorer.exe

If you have a file called "explorer.exe" in your System32 directory, it is malware.

Edit: Do NOT do anything rash at this stage or you may find yourself in more (deep) strife. Please await some sound advice on dealing with both the RAID situation and the malware.
I will go ahead and request that this thread be moved to the "Am I Infected?" forum area.

Edited by AustrAlien, 11 November 2009 - 12:35 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#9 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 34,565 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:11:37 PM

Posted 11 November 2009 - 02:19 PM

Topic Moved from XP to the Am I infected? What do I do? forum at the request of the member.

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+

#10 Nerdful Things

Nerdful Things
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Location:Portland Maine, USA, Earth, Sol
  • Local time:02:37 AM

Posted 11 November 2009 - 02:37 PM

OOPS! strike that from the record. It is in the c:\windows directory. I think I was trying to say: When I ran the explorer.exe from the command line it says file not found. even though the files show under DIR "Just like the commands I tried to run in the system32 directory" . No, explorer.exe, the original I renamed, and the one from the USB key I put in and worked from are in C:\windows.

#11 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:04:37 PM

Posted 11 November 2009 - 03:55 PM

Re the mirrored RAID situation:
If I was in your position this is what I would do ...

The RAID setup is an unnecessary complication in an otherwise complicated-enough situation.
Physically disconnect one of the RAID hard drives.
Enter the BIOS Setup Menu and change the configuration of the remaining SATA hard drive from RAID to "IDE compatible mode" (or some such similar wording).
(This will enable the use of the Recovery Console when booting from the XP installation CD if necessary.)
Save and exit the BIOS Setup Menu.

Then proceed to make the system usable and remove the malware.

If you later wish to restore the RAID configuration when one hard drive is repaired and clean, you can then clone one hard drive to the other and restore the RAID settings.

Do NOT proceed based on what I have written above: I have NO experience with your situation.
Please await further input.

FURTHER ADVICE REQUESTED HERE PLEASE
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#12 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:04:37 PM

Posted 11 November 2009 - 06:55 PM

Try the following ...
Log into Safe Mode using the "Administrator" account (assuming of course, that you do get offered that option) and press Ctrl+Shift+Esc. Does the Task Manager window appear?

Have you tried the above?

When you choose to start in Safe Mode, are you offered the chance to log on to the "Administrator" account? If so, do so, and try the above step please.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#13 Nerdful Things

Nerdful Things
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Location:Portland Maine, USA, Earth, Sol
  • Local time:02:37 AM

Posted 11 November 2009 - 11:40 PM

Thanks for the help. It seems that in all the posts above, no one has noticed I repeatedly said the task manager is not available. It neither comes up in ctrl-alt-delete, ctrl-shift-escape, or trying from command line. Nor does it come up and say it has been disabled as in other malware situations.

I have the go-ahead to do as little as re-install, but I would like to solve this for the sake of the owner, and any others in my situation.

I thought the thing to do was to disconnect a mirror drive, put it aside for a backup if I want to start over. I assume the drive I take out will have all files the owner wants, accessible by linux.

I would then get the system running on the remaining drive and go from there.

So assume I have the system running in non-raid, then what?

#14 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:04:37 PM

Posted 11 November 2009 - 11:58 PM

I thought the thing to do was to disconnect a mirror drive, put it aside for a backup if I want to start over. I assume the drive I take out will have all files the owner wants, accessible by linux.
I would then get the system running on the remaining drive and go from there.

That is what I was thinking.

I have indeed noticed each and every time that you have stated that Task Manager is not accessible: I have not queried, doubted or ignored what you have said, nor offered advice to the contrary. I am not sure what makes you think that I haven't "noticed".
I am puzzled that you do not answer the question that I have been asking: I ask it for a very good reason, and I would like you to answer it before moving on and attempting to get the system working. I have been working with other people in your predicament and have been able to get the system going again by using Safe Mode, when logged into the "Administrator" account. Do you get offered the option of logging in to the "Administrator" account after choosing to start the system in Safe Mode?

Hmmm ... maybe we are not going to get any better advice re the RAID situation?

Edited by AustrAlien, 11 November 2009 - 11:59 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#15 Nerdful Things

Nerdful Things
  • Topic Starter

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Location:Portland Maine, USA, Earth, Sol
  • Local time:02:37 AM

Posted 12 November 2009 - 08:40 AM

<<QUOTE(AustrAlien @ Nov 11 2009, 10:39 PM) *
Try the following ...
Log into Safe Mode using the "Administrator" account (assuming of course, that you do get offered that option) and press Ctrl+Shift+Esc. Does the Task Manager window appear?>>

Anyway I was negligent in saying if I can get into safe mode as admin.

Yes on booting from hard drive, hitting f8 I get the gui user login screen with an administrator choice. I can click it without a password and get into admin, and a c: prompt panel, although it often says 'file not found' when trying to execute a file shown in the directory I am resident in. No way found to get taskmgr going, but I can do dos commands, and can move a file from a usb key if needed..

Thanks!

Edited by Nerdful Things, 12 November 2009 - 08:42 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users