Explorer service not running in win2k after the IE6 reinstall

  • Thread starter Thread starter Ewa Wdzieczak-Smering
  • Start date Start date
E

Ewa Wdzieczak-Smering

I was having problems with a win2k workstation full of spyware/adware. I
have installed Spybot which cleaned many entries but not all of them, so
I took it off and put Adaware which did a much better job but when the
user clicked on the "search" button on the toolbar he still had a
third-party search engine there. I have decided to reinstall his IE6
which worked fine - took care of the problem - but now when he reboots
the system and tried to log onto the network his password/username is
taken but the desktop is totally blank until one goes to the "new task"
button on the "applications" tab in the task manager and manually types
the "explorer" after which the PC boots properly. This happens to all
the accounts on this workstation so I don't think it's anything related
to his local ntuser.dat file...

Can someone please help me here?

Thanks!


Ewa
 
Reinstalling IE when it's Windows that's infected with malware is useless
and often only complicates matters (which is where you are now).

Dealing with Trojans & Hijackware

A. Removing Trojans and Trojanware with Sysclean

Create a new folder named Sysclean (e.g., C:\Program files\Sysclean or just
a desktop folder). Download 'Sysclean.com' from
http://www.trendmicro.com/download/dcs.asp to this folder. Download the
latest 'Trend Pattern File' zip (e.g., lpt123.zip) from
http://www.trendmicro.com/download/pattern.asp and extract its contents to
the same folder; see the Readme text file for instructions.

Delete Temporary Internet Files (IE Tools>Internet Options>General)
accepting the option to delete all offline content. Reboot and delete
contents of TEMP folders and Recycle Bin.

Close all running programs including your anti-virus application, go
offline, and run Sysclean. For best results, do nothing with the machine
until the scan completes.

WinXP only: If the scan shows any infections in System Restore files:

(1) create a new Restore Point (Start>Programs>Accessories>System
Tools>System Restore), then

(2) delete all but the most recent Restore Point
(Start>Programs>Accessories>System Tools>Disk Cleanup>More options [tab]).

Afterwards, update your own anti-virus application and perform another full
system scan.

B. Hijackware

Help with Hijackware (all are MS MVP sites)
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

Run the following tools in this order with nothing else running in
background:

1. CWShredder v2.0 (no updates available currently; choose Fix, not Scan)

2. Ad-Aware SE (Reconfigure per http://aumha.org/forum/viewtopic.php?t=5877;
Fix all found)

3. Spybot (RTFM; Immunize first and then scan; Generally, fix everything in
red)

Important: You must seek updates for Ad-Aware, Spybot, etc., before each and
every use, even "right out of the box". But even they can't catch
everything, 24/7.

When all else fails, HijackThis
(http://forum.aumha.org/downloads/hijackthis.zip) is the preferred tool to
use. It will help you to both identify and remove any hijackware/spyware.
**Post your files to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

Posting and You
http://www.trials-shack.co.uk/posting.html
 
Back
Top