Blank Desktop 1

[Mattb7]

Ok I have a problem with a windows 2000 pro computer. A client restarted the computer the other day and after logging in windows started with a blank desktop. No icons or taskbar. I am able to ctrl+alt+del to get to task manager. From there i can run a new task. I have looked on microsoft and they explained the exact problem, but their solution did not work. Has anyone experienced this?? Please help. I do not want to reformat this computer. Thanks,
Matt

 

[pbxman]

"Klez is not a very harmful virus....I have had it going around for a while now...but it doesnt do anything destructive"...
Put that on your PDC and post back. You'll be asking for your mommy because you wont get any sleep..wherever you found that information from - i'd lose that source of info. You wouldn't be posting here if you didn't have Klez all over. If you think you can leave that virus propogate and operate a normal network, then we can't help you.

You need to eliminate Klez and all of it's sources before even posting a thing about weird occurrences. Fact is - Klez gotcha, and there's your blank desktop. You need to respect/acknowledge that a virus can bring your ENTIRE network down...especially Klez... pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[Mattb7]

I still say that it doesnt have anything to do with klez. Microsoft talks about the problem with windows 2000 on their website, it is a known bug. I am not trying to underestimate the virus, and i know i have to get rid of it, but i am just saying there are a lot more damaging viruses then klez. Here is what symantec has to say about klez:

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.a@mm.html

It is an e-mail worm that supposedly can do some damage on the 13th of January. Since we have not yet reached the 13th i do not believe that Klez was my problem.

 

[hxm13]

Had the same problem as you, only one user created on system and no desktop (icons / taskbar) when restarted. Recreating user didn't help, reapplying Service Pack 3 didn't do anything either, already had NAV2003 fully updated and doing full system scans for viruses every 12 hours since 2 months ago, and reinstalling win2k wasn't an option.

Microsoft's article at:-

http://support.microsoft.com/default.aspx?scid=kb;en-us;256194

... suggested renaming shdocvw.dll file in c:\winnt\system32 to any other (like shdocvw.old) but didn't work. Same article also mentioned other windows protected fles that might cause problem. So decided to rename those as well and created a batch file which contained the following:-

ren shdocvw.dll shdocvw.old
ren browseui.dll browseui.old
ren comctl32.dll comctl32.old
ren comdlg32.dll comdlg32.old
ren mlang.dll mlang.old
ren ole32.dll ole32.old
ren oleaut32.dll oleaut32.old
ren shell32.dll shell32.old
ren shlwapi.dll shlwapi.old
ren urlmon.dll urlmon.old
ren wininet.dll wininet.old
ren setupapi.dll setupapi.old

Placed the batch file in the c:\winnt\system32 directory and launched it. Then restarted windows - and desktop was recovered.

All renamed files were protected so win2k recovered them from original setup automatically during system restart. One of those must have had a problem, don't know which and don't really intend to get the same problem again to find out.

Note : all actions taken above was done using task manager (cos no icons or taskbar to click on). Type Ctrl+Alt+Del to open Task manager and use the 'New Process' button to launch notepad (to write and save batch file) and 'cmd' to launch batch file from prompt.

I think the problem happened after I uninstalled a software and decided to remove the shared files suggested during uninstall. I'd advise not to remove shared files in c:\winnt\system32 even though you don't know what it does. That might have been the cause although not 100 percent sure. Everything looks okay (so far). Thanks a lot all for suggesting ideas to fix this problem.

- hxm13

 

[Mattb7]

I was reading another post about a week ago and they had the same problem. One thing i didnt mention with mine is that right when the desktops should have been loading there was a small square in the upper left corner of the screen. I didnt mention it because i didnt think it meant anything. However when this other guy mentioned it I realized that there was some importance to it. He ended up finding out that it was a virus that wasnt being picked up by a fully updated NAV. What the virus was doing was creating a new Explorer.exe file in winnt/system32. All you need to do is delete that file and you are all set.

 

[pbxman]

I thought it wasnt a virus tho?
Deleting explorer.exe won't work because thats your desktop! You need to scan & remove any viruses first before doing anything. If none are found, great. Explorer.exe can be renamed and a new one can be copied from a known good system.

Rename the bad explorer.exe to explorer.old and copy the new one in the original path from the good computer. On the bad one, either reboot, or go to task manager, click the currently running explorer.exe, and End Task it. Then go to File/New Task/and type explorer.exe and it will load. *Note* this is often a shortcut to rebooting. Try it before rebooting next time a program asks you to or registry changes need to take effect on some higher-level keys.

Whether or not you *thought* it was a virus, you need to eliminate it as a possibility or else any changes you make or fixes will be temporary, and the virus will take over again. Once it's clean, then make the necessary adjustments. If the suggestions posted here didn't work, you were better off reinstalling anyway. :\ pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[Mattb7]

no, explorer.exe is the virus. It is not supposed to be in the winnt/system32 folder. This is another copy of explorer.exe that you can safely delete. The origional (the one that actually has your desktop) is saved in the winnt folder.

 

[pbxman]

I realize that, but the virus itself was not explorer.exe, it just propagates and infects that file. Nobody downloaded an explorer.exe file and put it in their \system32 dir, the virus wrote the file there, and since it's in your path it executes. It was probably a trojan in a word document or something, and would have redone it's actions after deleting it. Thats why the system must be deinfected before dumping files. More likely, you would not have been able to delete it because it would have said it was in use, and even so it obviously changed your explorer.exe execution path in the registry from \winnt to \system32 and if you deleted it without cleaning the system, no desktop would load, etc. There is another explorer.exe in \system32\dllcache, but that is not a part of your path so it does not run that one. (Go to a cmd prompt and type: path , and you'll see what your working path is). Let a removal tool delete files in \system32 - you shouldn't manually delete anything stored in there because of the registry changes that go with those files.
pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[Mattb7]

I am not arguing with you. I probably wouldnt want to delete the explorer.exe file either, but the guy in this post said it worked. Also he said that Norton did not pick up this virus. Check out his post: thread616-441801

 

[pbxman]

I'd be willing to bet there are additional files on his pc left over from the trojan, and norton cleaned the file already eliminating further infection. Maybe he just didn't catch it or notice it pick it up, but Norton wouldn't let a trojan go through with the newest defs.
If it worked deleting it than great, but it still was a virus. pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[XCNTRYMtnBiker]

I had the same problem occur on one of my NT 4.0 machines after Norton quarantined a trojan horse. I was able to revive my desktop by renaming the Explorer.exe in the System32 folder and rebooting. I would like to make sure I have removed all traces of this virus, but Norton doesn't seem to catch it until it has already made the change. I had updated my definitions on Friday, and this occurred on Sunday!! Any Ideas?

 

[SockMonkey]

I have just reviewed all the tips here for addressing the blank desktop problem because of the failure of Explorer.exe to load when the system starts.

I have gone through and tried each of these options
1. copying a different explorer.exe from a good system
2. complete virus check
3. the renaming of the suggested protected files in the winnt\system32 directory and allowing windows to restore them on reboot.

No effect.

Is anyone familar with the wmrundll.exe file and its functions?
I have encountered occasional messages regarding problems loading this file and that preceeds the blank desktop at boot up.

Simply Baffled

Rob

 

[pbxman]

Sockmonkey,

Do you have Novell Workstation Manager installed? Are you using IPX/SPX?

Remove the service and try again. If that fails, remove the program and try again. pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[MontrealSoft]

I had this problem once, and I could temporary override it by opening the taskman (ctrl-alt-del), then File-Run-EXPLORER.

Everything loaded normally. I can't remember how I fixed it permanently though....

Luc

 

[SockMonkey]

Yes I have Novell Workstation Manager Installed and I am running both IPX/SPX & IP. IP is the default protocol.

I have uninstalled the Novell Workstation Manager feature and the problem still persists.

I uninstalled the entire Novell CLient, and the problem persists but I believe I have gotten to the root of the problem as this error message now appears:

Userinit.exe - Entry Point Not Found
"The Procedure entry point Sy could not be located in the dynamic link library user32.dll"

I have searched the Microsoft (no)KnowledgeBase and of course there was nothing helpful pertaining to this issue.

Any additional suggestions are welcomed.

Thanks

Robert

 

[pbxman]

So the IPX protocol is now removed from your machine?
What version of Novell client did you have?
1) Reinstall Win2K SP3.
2) I would reinstall Novell, then remove it again. It sounds like registry entries are still left behind. Can't hurt at this point.
3) Try the Novell forums - prolly more experts at it in there than here.
4) Backup your stuff & reinstall the OS. Somehow Novell hosed it based on your previous errors. I wouldn't spend more than a couple hours on this since it only takes an hour to reload Win2K with a bunch of goodies on it.

Sorry I can't be more detailed than that, but I'm not a Novell pro. Definitely looks like Novell is the cause, so good luck! pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.

 

[SockMonkey]

I have the Solution:
I uninstalled Microsoft Windows 2000 SP3 and the problem was resolved. I ran a few tests and discovered that it seems to be a problem with SP3 userinit.exe and the interaction with the dll's. I had all the correct dll's for sp3 installed so as I changed each dll to the prior version and rebooted the previous entry point message would no longer appear but a new would show up in its place.

I reinstalled Novell Client with workstation manager and no problems. Lesson learned, SP3 still has some bugs.

Thanks to all for your suggestions

Robert

 

[Greatgazzoo]

Just a thought but always recomend to the user(s) to create a general user account to use instead of the administrator account.

If for no reason than to prevent these type of issues being such a large issue.

Just my two cents.