Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Explorer.exe missing- no desktop after sign in

  • Please log in to reply
3 replies to this topic

#1 grogall


  • Members
  • 23 posts
  • Local time:06:17 AM

Posted 30 September 2014 - 02:33 AM

After I sign into windows, I have a black screen and the My documents folder opens.  No right click ability, no desktop, no start menu, but I can navigate, etc.


I've tried several options but none have worked so far.  

Here's what I've tried


-Restore to earlier point (no restore points were found due to no memory being allotted. That has been changed)

-Created new user, instead of a black screen, it gets a blue one, but still my documents opens, and have to navigate that way

-Looked through the regedit in order to change  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell as seen on other forums. I have no winlogon in the currentversion section. 

-Tried to run my avira virus scan, but avira doesn't work now.. might be some connection

-Ran malwarebytes and superantispyware at different times. Both found objects, mostly were cookies, but some were files/exe/reg.  I will include the malwarebytes scan log at the end of this.

-Other fix I've seen was to reinstall windows with the CD but I have no clue where my CD is if I even got one.



So, prior to this happening, my computer quit connecting to my home network while other devices could connect. Went a whole day like that, then I restarted the computer to see if that would fix anything, and thats when the black screen started happening. Took it too school and was able to connect on their wifi, brought it home and its now connected to the home internet so, these two might not be related, but.. never know..


It's a toshiba satellite L555 laptop. Running windows 7.  Any help on a way to repair this would be great. Thanks :D




Malwarebytes Anti-Malware

Scan Date: 9/29/2014
Scan Time: 10:46:56 PM
Administrator: Yes
Malware Database: v2014.09.29.14
Rootkit Database: v2014.09.19.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7
CPU: x64
File System: NTFS
User: Ryan
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 332158
Time Elapsed: 20 min, 46 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 10
PUP.Optional.DefaultTab.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{7F6AFBF1-E065-4627-A2FD-810366367D01}, Delete-on-Reboot, [cba77d76433838fe8eaeabed4ab8a65a], 
PUP.Optional.DefaultTab.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{7F6AFBF1-E065-4627-A2FD-810366367D01}, Delete-on-Reboot, [cba77d76433838fe8eaeabed4ab8a65a], 
PUP.Optional.FrostwireTB.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{D4027C7F-154A-4066-A1AD-4243D8127440}, Delete-on-Reboot, [ef83b83b6813999da0a504ca1ae8d828], 
PUP.Optional.FrostwireTB.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D4027C7F-154A-4066-A1AD-4243D8127440}, Delete-on-Reboot, [ef83b83b6813999da0a504ca1ae8d828], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\TotalRecipeSearch_14, Quarantined, [d2a06f84512a0630fff2680ba163dd23], 
PUP.Optional.FBPhotoZoom.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\mpieaakhacmfleokhjcjnpcnmnmpfkid, Quarantined, [83ef40b34734e650728101752dd7a65a], 
PUP.Optional.SweetIM.A, HKLM\SOFTWARE\WOW6432NODE\SWEETIM, Quarantined, [5a18ec07bcbf979f6b8464f5d034fc04], 
PUP.Optional.DefaultTab.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\DefaultTab, Delete-on-Reboot, [6909e40fb1caef47edb2b98ce3203bc5], 
Rogue.MultipleAV, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CLASSES\AH, Delete-on-Reboot, [5a18f9fa17643df979e1aea71be8fe02], 
PUP.Optional.MindSpark.A, HKU\S-1-5-21-1394663217-2439825344-4002662712-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\TotalRecipeSearch_14, Quarantined, [8fe305eee8936bcbe3e010179c67827e], 
Registry Values: 15
PUP.Optional.FBPhotoZoom.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|fbphotozoom@installdaddy.com, C:\Program Files (x86)\fbphotozoom\fbphotozoom14.xpi, Quarantined, [244e48ab98e3ad890de5babc12f25ea2]
PUP.Optional.SweetIM.A, HKLM\SOFTWARE\WOW6432NODE\SWEETIM|simapp_id, 1605756709017386020, Quarantined, [5a18ec07bcbf979f6b8464f5d034fc04]
Rogue.MultipleAV, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CLASSES\AH|Content Type, application/x-msdownload, Delete-on-Reboot, [5a18f9fa17643df979e1aea71be8fe02]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_options, NEWOPTS, Delete-on-Reboot, [254df102e09bb383a94cada38380f50b]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_server1,, Delete-on-Reboot, [c9a9be35a7d46cca8e67232d8b78d927]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_reserv,, Delete-on-Reboot, [c0b25f9428539b9b9560c38de81ba060]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_forms, /system/prinimalka.py/forms, Delete-on-Reboot, [70023eb53f3cc76fc13449071ee5c43c]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_options, /system/prinimalka.py/options, Delete-on-Reboot, [ef8341b22d4ea0963abbea66db286d93]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_command, /system/prinimalka.py/command, Delete-on-Reboot, [b1c1797a7a011c1ad71e62eefb08fb05]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_file, /system/prinimalka.py/cookies, Delete-on-Reboot, [cda5945f5a21181e27ce232d28db8e72]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_ss, /cgi-bin/trash.py, Delete-on-Reboot, [d69c2cc7cbb053e37f764f010ff47888]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_pstorage, /cgi-bin/trash.py, Delete-on-Reboot, [7df56b88fd7e221436bf2d230df6629e]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_certs, /cgi-bin/trash.py, Delete-on-Reboot, [abc7ad4679025ed87c79de720df6df21]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_idproject, 022201, Delete-on-Reboot, [a7cbe70cadceff37b93c80d028dbde22]
Malware.Trace, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION|nah_opt_pauseopt, 1800, Delete-on-Reboot, [abc72cc75b201d1947ae78d85ca7e818]
Registry Data: 0
(No malicious items detected)
Folders: 1
PUP.Optional.Sweetpacks, C:\Program Files (x86)\SweetPacks, Quarantined, [83efb340afcc4beb2858a837fc06b848], 
Files: 1
PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot64.exe, Quarantined, [39391ed5a1da7eb8fb0d0e1349b755ab], 
Physical Sectors: 0
(No malicious items detected)

Edited by hamluis, 30 September 2014 - 11:23 AM.
Moved from Win 7 to Am I Infected - Hamluis.

BC AdBot (Login to Remove)


#2 lmalinofsky


  • Members
  • 2 posts
  • Local time:07:17 AM

Posted 30 September 2014 - 06:00 AM

I wonder whether Windows has gone into limited mode because there is a problem with your license?  In this case doing a repair install from your original media is the best answer.  If you don't have one they are easy to find, unless you have an OEM version of Windows for only, say, HP computers-- then you would need one of those which HP would send you free.


Of course if you unknowing bought a system with an unauthorized copy of Windows, expect more trouble, especially if the seller is no longer around.  It would certainly be worth talking to him if you could.


If you must have a computer on an emergency basis, load up a live version of Linux, which runs from CD or DVD without interfering with Windows.  Save your work to a thumb drive before shutting down unless that Linux let you create persistent storage.  One Linux I know is very good for this is Puppy Linux.





#3 grogall

  • Topic Starter

  • Members
  • 23 posts
  • Local time:06:17 AM

Posted 04 October 2014 - 01:15 AM


#4 grogall

  • Topic Starter

  • Members
  • 23 posts
  • Local time:06:17 AM

Posted 10 October 2014 - 02:03 AM



Solution for others with similar problems


-Download SuperAntiSpyware (free)


-Once installed, click the System Tools next to the scan button


-Click the Repairs button


-Click the Reset Winlogon Shell. It will prompt to restart computer. Once restarted everything should be fixed. 

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users