Lost Desktop including TaskBar

Discussion in 'Software' started by craigharrison, Sep 27, 2006.

  1. craigharrison

    craigharrison Private First Class

    I have an Win2000 Pro user who went through the steps from the sheet I provided him detailing how to rid his desktop from all sorts of malware. The sheet came from the MajorGeeks standard step by step. I believe he had erased something himself in the system32 folder that now, when he rebooted, has no desktop or taskbar. Also, he emptied his recycling bin, so I can't even help to understand what file he deleted. I had him start in the safe mode but nothing and had him start in the last known good config but with the same results. Can anyone help here? Thanks
     
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Stick the w2k cd in the drive (exit out of it if it starts) and do a start / run / type "sfc /scannow" without qoutes....should restore the missing files.
     
  3. craigharrison

    craigharrison Private First Class

    Hey tim, I'm at his office now, thank goodness he at least has his W2KPro disk but he doesn't even have a Start button on his desktop.
     
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Hit the Windows key (the one with the flag) + "R" key.
     
  5. matt.chugg

    matt.chugg MajorGeek

    That won't work if explorer isn't running Tim. The hotkey WIN _ R is regeistered with explorer I think.

    Press Ctrl - Alt - Delete to get the task manager up. In Taskmanager select File --> New Task (run) and type in explorer.exe and hit enter.

    This should bring up the explorer shell and temporarily restore your desktop so you can run the command Tim mentioned.

    If it doesn't then instead of typing in explorer.exe type in sfc /scannow and hit enter.
     
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Hey Matt....do me a favor and post back to darlene_1947 in her malware thread and tell her to look at the post in the lounge that is directed at her ..she's such a goob!!!:)
     
  7. matt.chugg

    matt.chugg MajorGeek

    lol Done.
     
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Now that might work ..thanks Matt ...as long as she gets her head out of the jokes thread!!
     
  9. matt.chugg

    matt.chugg MajorGeek

    heh post in there too. (and lets stop hi-jacking this thread now lol ;) )
     
  10. craigharrison

    craigharrison Private First Class

    Tried but nothing. The only thing I can get is the Task Manager. I know you can run programs but can I run what you suggested from there?
     
  11. matt.chugg

    matt.chugg MajorGeek

    yes

    You can run sfc /scannow from there

    Nothing happens if you run explorer from there?
     
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You have tried this:
    Press CTRL + ESC or your Windows key to make Start menu appear.
    Click Settings and choose Taskbar & Start menu
    Verify that Auto Hide is not checked.
    If Auto Hide is not enabled move the task bar up by following the below steps.

    Press CTRL + ESC or your Windows key to make Start menu appear.
    Try to notice where the Start menu appeared; generally, it should be the bottom left corner.
    Press ESC. You should now notice a small gray line at the location of where the start was.
    Move the mouse over that gray line, when in the appropriate position your mouse cursor should change. Once the mouse cursor changes, click and hold the mouse button and move the bar up.
     
  13. matt.chugg

    matt.chugg MajorGeek

    @Tim: I don't think explorer is actually running.

    @craig: can you confirm whether explorer.exe is in your list of processes from taskmanager ?
     
  14. craigharrison

    craigharrison Private First Class

    Didn't see the other threads. I am amused by your banter though. I did run the explorer.exe and it worked. It brought up the entire desktop. I am now running the sfc /scannow. Thanks again.
     
  15. matt.chugg

    matt.chugg MajorGeek

    heh

    probably lost the startuplink to explorer.exe
     
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Hey, cut me a break ....I'm still trying to slurp down my first cup of coffee ...(which ain't easy out of a baby bottle!!)

    If he can't get explorer running ..he could just do a repair install.

    Gezzz.....late again with the post ....get me some more coffee!!!
     
  17. matt.chugg

    matt.chugg MajorGeek

    heh I don't think the problem was being to late tim ;) we were just both too fast lol
     
  18. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Well, speaking for myself ...I'm not fast, I'm not slow, I'm half fast!! (say it fast ...heheh)
     
  19. craigharrison

    craigharrison Private First Class

    Hey speedys, you two are a riot. Well, I ran the sfc /scannow and then rebooted and he still has no desktop. I ran taskmanager and say that explorer.exe is not listed. What to do?
     
  20. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Repair install .....
     
  21. Matacumbie

    Matacumbie Rocky Top

  22. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Oh, sure Steve ....give him the easy way ...gezzzzz.:)
     
  23. matt.chugg

    matt.chugg MajorGeek

    ahh well, some times the easy way is the best ;)
     
  24. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yeah, I've always said, "I'm not easy, I'm not hard, I'm half ....."
    Oh, nevermind.:rolleyes: :rolleyes:

    @Steve ....added to my bag of fixes ...thanks, again.
     
  25. craigharrison

    craigharrison Private First Class

    Steve, thanks for the help and you too Tim and Matt. Went to msft and it looks like the solution needed. The only problem is that the os can not find that shdocvw.dll. I tried to cd\ nearly every directory including winnt\system but can not find the directory for %systemroot%. Can anyone help me locate where this may be?
     
  26. Matacumbie

    Matacumbie Rocky Top

    Oh boy, I am not familiar with Win2000 at all. Just afew things you might look for or try. Also, do they have a camera or anything plugged into a USB? If so, unplug it and see if that does it. Try the steps below in any order you choose.


    1. Ctrl+Alt+Delete > File > New Task (Run...)

    2. Type: ftp://ftp.f-secure.com/anti-virus/tools/shellfix.reg

    3. Click Ok and it will prompt to download shellfix.reg file

    4. Click "Run" file. Do not save it on your desktop, or anywhere on the computer.

    5. After it runs, reboot your computer.

    OR

    See if Win2000 has a i386 file. Maybe try looking under c:/winnt/servicePackFiles/i386/ and look for a Browseui.dll and Shdocvw.dll file. If you find them copy and paste them into c:/winnt/system32/ folder and reboot.

    OR

    Right click on Desktop, Properties, Desktop page, click Customize and on
    the Web page make sure 'Lock Desktop' is not checked.
    Right click again, Arrange Icons, make sure 'Show Desktop Icons' is checked.

    OR

    From the task manager > file new task (run) run command > type

    %systemroot%\system32\restore\rstrui.exe

    then you could restore the computer to one day or few days before this started..........if available with Win2000. :confused:

    Steve
     
  27. craigharrison

    craigharrison Private First Class

    Sorry Steve,

    Was not at his office until today to try the suggestions and they didn't work. It seems that none found or any of the four that you mentioned. Maybe it was relates only to XP and not to 2000 Pro?

    Is there anything else I could try to get his desktop up? Running explorer.exe gets the desktop up fine but loses it upon reboot.

    Thanks for taking the time.
    Craig
     
  28. craigharrison

    craigharrison Private First Class

    That is running explorer.exe through Task Manager.
     
  29. Matacumbie

    Matacumbie Rocky Top

    Were they getting any error messages?

    Just to check another possibilty, see if this entry is present in the registry.

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RPCKDM

    Steve
     
  30. craigharrison

    craigharrison Private First Class

    Ran regedit and went through the root you described but could not find the RPCKDM. Got to RemoteRegistry and then RpcLocator. Is that a bad sign?
     
  31. Matacumbie

    Matacumbie Rocky Top

  32. craigharrison

    craigharrison Private First Class

    Tried it but there was no mIRC in the add/remove listing.
     
  33. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Have we tried this:
    To find the required Registry key, navigate to HKEY_CURRENT_USER\Software\Microsoft\
    Windows\CurrentVersion\Explorer\StuckRects
    Right-click on the yellow folder named StuckRects (StuckRects2 in later Windows) > Delete. When you restart Windows, the deleted key will be regenerated and, with luck, will bring back a healthy Taskbar with it.
     
  34. craigharrison

    craigharrison Private First Class

    Well went to the client's office and before I could run through your last suggestion, I found another problem. Seems he ran a Windows Repair and now when I try to login and hit enter I get the login screen back. I tried using all of the choices in safe start and am getting the same repetitive login. I checked and rechecked that the login was correct but now im in this loop. This is just an avalanche of one thing after another. What else can I do? I backed up everything but his .pst file which is 1GB in size which is sorely needed for his business. Anyone have any thoughts on what I can do for him?
     
  35. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

  36. craigharrison

    craigharrison Private First Class

    Thanks again Tim. They have Win 2000Pro though. The link didn't work anyway. Is there one for Win2000 Pro? This scratching my head over this is really thinning my hair.
     
  37. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

  38. craigharrison

    craigharrison Private First Class

    Went through the complete repair but still having the same problem. Is there something in the console that I could go through?
     
  39. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You did the repair install and are still in a login loop?

    Login logout loop
    Enter the Recovery Console

    Boot the system using the Windows XP CD-ROM. In the first screen when the Setup begins, read the instructions press "R" (in the first screen) enter the Recovery Console. Type-in the built-in Administrator password to enter the Console. You'll see the prompt reading C:\Windows (Or any other drive-letter where you've installed XP)

    Type the following command and press Enter.

    CD SYSTEM32
    (If that does not work, try CHDIR SYSTEM32)

    COPY USERINIT.EXE WSAUPDATER.EXE

    Quit Recovery Console by typing EXIT and restart Windows.

    You'll be able to login successfully as you've created the wsaupdater.exe file (now, a copy of userinit.exe)

    Now, change the USERINIT value in the registry (see Phase II in this page) and change it accordingly.

    Click Start, Run and type REGEDIT. Navigate to:

    HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ WindowsNT \ CurrentVersion \ Winlogon

    In the right-pane, change the value of Userinit to "C:\WINDOWS\system32\userinit.exe,"

    Type the above value exactly as given, including the comma - exclude the quotes. Also, change the path to userinit.exe appropriately if Windows is installed in a different drive.

    Close Registry Editor and restart Windows. The Quick Launch settings should be retained now.

    Same for w2k.
     
  40. craigharrison

    craigharrison Private First Class

    I change the directory which read c:\winnt\system32 but when I tried to copy userinit.exe wsaupdater.exe it said "the systme cannot find the file specified".
     
  41. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Well, this is no fun....try this:
    Boot computer from W2K CD.
    > 2. Go into Repair mode, and go to Recovery Console
    > 3. Login with admin password, and type FIXMBR from command line
    > 4. Remove W2K CD.
    > 5. reboot.
     
  42. craigharrison

    craigharrison Private First Class

    Your tell me this is no fun. Just to be sure. When I typed this command it read

    "This computer apprears to have a non-standard or invalid master boot record.

    FIXMBR may damage your partition tables if you proceed.

    This could cause all the partitions on the current hard drive to become inaccessible.

    If you are not having problems accessing you drive do not continue.

    Are you sure you want to write a new MBR?"

    Is this message what you expected Tim and should I proceed with this command?
     
  43. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Ignore the message .....
     
  44. craigharrison

    craigharrison Private First Class

    I proceeded and rebooted and am still in the loop from hell. lol
     
  45. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I'm starting to suspect a hardware issue .....can you remove a stick of ram and start a trial and error test?

    You've done repair installs and fixmbr ....yet it won't finish a boot ..all of which should have gotten you up and running.

    The link to the repair in 8 steps is back up, if you want to try that first.
     
  46. craigharrison

    craigharrison Private First Class

    The eight steps is back up? My brain must be melting, lol. What do you mean Tim?
     
  47. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

  48. craigharrison

    craigharrison Private First Class

    Went through the steps but after del boot.ini which worked, I then tried to do the BOOTCFG /REBUILD I got the "The command is not recognized. Type help for a list of supported command". I did and "REBUILD" is not listed. What to do?
     
  49. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

  50. craigharrison

    craigharrison Private First Class

    That didn't work either. Remember Tim, this is a Windows 2000Pro?
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds