Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Expansion System - no desktop


  • Please log in to reply
17 replies to this topic

#1 TiaMarie

TiaMarie

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 01 April 2011 - 12:06 PM

I'm new to this forum, so I apologize if this is posted in the wrong place. I was trying to help a friend that got Windows Expansion System on their computer. I followed the instructions for using rkill, however, I had to try several different options before I could get it to run. I had used the command prompt to copy the file, and also had copied the updates manually (from another computer) to run malwarebytes and had started it from the command prompt.

When I ran malwarebytes, it fixed the system and booted up in safe mode. At this point, everything looked fine.... desktop came up with all the icons, etc. Then I shut down the system and restarted it again. I now have NO icons or start menu on the desktop. Somehow I missed the following step about fixing my Windows Registry Shell value, which I did not do. I have since downloaded it and ran it, however, it doesn't appear to have fixed it.

I have tried numerous times to get it to work, but it does not. Could you please advise?

If I do Ctrl/Alt/Delete, the task manager takes a while to come up, but does not show any applications running. It does show processes of

spoolsv.exe
explorer.exe
WgaTray.exe
svchost.exe
EvtEng.exe
svchost.exe
svchost.exe
lsass.exe
services.exe
winlogon.exe
csrss.exe
smss.exe
taskmgr.exe
System
System Idle Process SYSTEM

BC AdBot (Login to Remove)

 


#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:07 PM

Posted 01 April 2011 - 12:18 PM

I see the explorer.exe running. Are you seeing the desktop? Or are you just getting a blank screen when you start windows?

#3 TiaMarie

TiaMarie
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 01 April 2011 - 12:44 PM

I am actually seeing the image that she had as her wallpaper. (standard beach scene (I thought that the rkill might have overwritten the actual iexplorer.exe or explorer.exe so then I copied both from another working computer from under the windows/prefetch directory. (I did copy the files that were there to a jump drive in the event I needed to copy it back.)

#4 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:07 PM

Posted 01 April 2011 - 12:56 PM

Ok, so your seeing the Windows background, but not the desktop.

Start the computer, press control-alt-delete to start task manager. When task manager starts, click on the File menu and select Run. In the Open: field enter explorer.exe and then press the OK button.

You should now see the desktop.

Download to the desktop:

http://download.bleepingcomputer.com/reg/shell.reg

Once downloaded, double-click on the shell.reg file and allow the data to be merged into the registry.

Once merged, reboot and the desktop should appear as normal.

#5 TiaMarie

TiaMarie
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 01 April 2011 - 02:26 PM

Oops. I was just about to send this to you and realized that you have responded to my previous post. Therefore this is before I have done anything that you have responded to.


Ok, now I had a pop up that Spy Doctor had been previously disabled, would I like to run it. I clicked yes (because I know that when I had attempted to install it, it would not run prior to the rkill.) Now I am not showing any applications running, but there are more processes running:

AOLacsd.exe SYSTEM
csrss.exe SYSTEM
EvtEng.exe SYSTEM
explorer.exe me
FrameworkService.exe SYSTEM
GoogleUpdate.exe SYSTEM
lsass.exe SYSTEM
LxrSIIls.exe SYSTEM
Mcsheild.exe SYSTEM
MDM.EXE SYSTEM
nvsvc32.exe SYSTEM
pctsAuxs.exe SYSTEM
pctsGui.exe me
pctsSvc.exe SYSTEM
PRISMXL.SYS SYSTEM
RegSrvc.exe SYSTEM
rpcnetp.exe SYSTEM
services.exe SYSTEM
smss.exe SYSTEM
spoolsv.exe SYSTEM
svchost.exe SYSTEM
svchost.exe NETWORK SERVICE
svchost.exe NETWORK SERVICE
svchost.exe SYSTEM
SymcPCCULaunchSvc.exe SYSTEM
System SYSTEM
System Idle Process SYSTEM
taskmgr.exe me
VsTskMgr.exe SYSTEM
wdfmgr.exe LOCALSERVICE
WgaTray.exe me
winlogon.exe SYSTEM

#6 TiaMarie

TiaMarie
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 01 April 2011 - 02:33 PM

I read your response to run the "explorer.exe" in the Task Manager. I had previously tried that, but I do not get the desktop up at all, except for the wallpaper and the Task Manager.

Yesterday, I had tried to run something else that had been suggested and I seem to recall that an explorer type window had come up, and I was unfamiliar, so I didn't do anything but X out of it.

The other thing is that the mouse no longer seems to work, I just have to use the touch pad.

#7 TiaMarie

TiaMarie
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 01 April 2011 - 02:38 PM

If I go to the task window, and click "BROWSE", The screen does come up on the side, "My Recent Documents, Desktop, My Documents, My Computer, My Network Places" However, my real desktop only has the picture, no icons, no start menu,etc.

It is almost as if everything is hidden behind it, but I can see it through the Browse window on the task manager.


(I won't have access to this for a few hours to try anything else..)

#8 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:07 PM

Posted 01 April 2011 - 05:54 PM

Try starting iexplore.exe instead of explorer.exe from the task manager. See if that works. If it does, download the file and when it prompts to save or run, select run and allow the info to be merged.

#9 TiaMarie

TiaMarie
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 01 April 2011 - 08:59 PM

When I try "iexplorer.exe" I get a pop up.

iexplorer.exe
Windows cannot find 'iexplorer.exe'. Make sure you typed thename correctly, and then try again. To search for a file, click the Start button, and then click Search.

Unfortunately, I can not get to the "Start button" to get to the search.

#10 TiaMarie

TiaMarie
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 01 April 2011 - 09:07 PM

Let me correct my response. When I click the "iexplore.exe" -the 'r' I get the hourglass for a few seconds, then the task bar comes back to the way it was without any actions or windows opening up. I even tried clicking on the "browse" and searching the desktop for the shortcut for iexplorer, which I then clicked on. It again gives me the hourglass and then nothing. (I do have it plugged into a lan connection.)

#11 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:07 PM

Posted 01 April 2011 - 10:02 PM

Try entering, including the quotes, "C:\Program Files\Internet Explorer\iexplore.exe"

#12 TiaMarie

TiaMarie
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 02 April 2011 - 08:26 AM

Still nothing... so, then I went to another computer, and copied those files, then on infected computer via command prompt and copied the files to that directory. Then ran your suggestion again... still nothing. I then downloaded that the shell file again from the location above from another computer, copied it via command to the non-working computer, and ran it... still nothing.

#13 TiaMarie

TiaMarie
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 02 April 2011 - 09:05 AM

Since I should have run the malwarebytes after I had run the shell, I am now in the process of rerunning malwarebytes. I updated the rules on another computer and copied them to the non-working computer via command prompt.

I am not trying to run malwarebytes from the jump drive, it starts the program, gets me to accept the terms, then extracts about 1/8 of the way and freezes with the installation.

#14 river58

river58

  • Banned Spammer
  • 75 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 02 April 2011 - 10:05 AM

Hmm You should go Here to update malwarebytes

#15 river58

river58

  • Banned Spammer
  • 75 posts
  • OFFLINE
  •  
  • Local time:03:07 PM

Posted 02 April 2011 - 10:17 AM

please do a full scan with malwarebytes. then when malwarebytes is done scanning please post the log

Edited by river58, 02 April 2011 - 10:17 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users