Blank screen at logon. :confused:

[frugalcat]

Recently i my computer had caught a virus which was sucessfully removed using ca anti virus software. After I had cleaned the computer i noticed that all of my desktop icons were missing along with my taskbar. For some reason instead of restoring the system to a previous time prior to the outbreak of the virus I tried to re install windows xp. To this date windows will start up fine and when I try to log on to a user account it just loads a blank screen. Using control alt delete i am able to pull up the taks manager which shows no applications running. In the process area i have several processes that constantly change values varying from 0 to 100. The main two that contstantly changer are winlogon.exe and system idle. I was wondering if any one can help me rectify the problem..

 

[xcorch]

Hi Frugalcat

Did you choose to repair the current windows xp install when doing the reinstall? if you did then that would have set things straight leaving all previous settings intact.

Another alternative is to see if you can start up using safe mode(selection in a menu accessible by pressing F8 before you see the windows screen)

When in safe mode unload any other startup item other then your virus protection using the startup tab in the MSConfig utility. To get to the msconfig utility go to:
Start -> Run -> Type "MSConfig" without quotes

It will ask for a reboot, reboot and check again

hope this helps

Xcorch

 

[frugalcat]

thank you for the reply I tried what you sugested however it still is only giving me a blank desktop without a task bar

 

[CCT]

http://www.pcreview.co.uk/startup/winlogon.exe.php

pm howard_hopkinso or momok to swing this to security section and follow their advice:

 

[momok]

Hi frugalcat and welcome to techspot. =)

Actually I'm only the moderator for the Web and Security forum so I cannot move this thread. I'll PM Howard to do it though. Meanwhile, please do the following.

Important: Please read this thread HERE before you decide whether to clean or reformat your system.

Should you decide to clean your computer, please go ahead to Viruses/Spyware/Malware, preliminary removal instructions and follow the steps given. Do follow all the instructions exactly. They will provide logs for analysis of your system so I will know how to instruct you to proceed.

Thereafter, please post fresh HijackThis, AVG Antispyware and Combofix logs as attachments into this thread. Do not copy and paste your logs if not it will be ignored and/or removed.

Also, please let me know the results of the AVG Antirootkit scan


Regards,
Your friendly momok =)

This thread is for the use of frugalcat only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[frugalcat]

Results

I would like to thank you for all of the information. Here are the results from the scans and test. My antiroot came back as none found. My desktop and task bar are now back. Winlogon.exe is no longer using any cpu.

 

[momok]

Hi,

You may wish to copy and paste these instructions on notepad for easier reference later.

Download the attached "Combofix-Do.txt" (from my attachment) and save it to the same folder as Combofix.

Boot into safe mode under your normal user name. See how HERE

Next turn on "Show all files and folders, including hidden and system". See how HERE

Go to start > run and type services.msc. Press the enter key.
Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

OLE multi config
DirectX common

Go to start > Control Panel > Add and Remove Programs.
Remove anything related to the following:

IP Windows
IP-Hider
Wild Tangent
Fun Web Products
My Web Search etc (anything related to them)

After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://192.168.1.1/
O2 - BHO: (no name) - {2C99E216-F912-4C11-0CBB-5AA4ABBDC9DB} - (no file)
O2 - BHO: (no name) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - (no file)
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZSzim001YYUS
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O23 - Service: DirectX common - Unknown owner - C:\WINDOWS\system32\dxwizard.exe (file missing)
O23 - Service: OLE multi config - Unknown owner - C:\WINDOWS\system32\ole2.exe (file missing)

Close HJT.

Drag the Combofix-Do.txt that you downloaded earlier over on to Combofix.exe and release.

This will ask Combofix to execute the instructions within my file. Let Combofix run normally and do its job. Attach the resultant log in your reply.

Reboot into normal mode and rehide your protected OS files.

Thereafter, please post fresh HJT, ComboFix and AVG Antispyware logs from normal mode as attachments into this thread.


Regards,
Your friendly momok =)

This thread is for the use of frugalcat only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[frugalcat]

updated logs

Here are all of the updated logs that were run after completing the last steps requested.... Once again I would like to say thank you so very much...

 

[momok]

Hi,

Your logs look clean now.

Delete all files in AVG Antispyware Quarantine folder. (located in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Quarantine)

Turn off system restore (XP/ME only). Learn how to do that HERE.
This will remove all the remaining nasties from your old restore points.

After that turn system restore back on.
This would have created a new safe and clean restore point for your system.

Often times, an infection can occur again not due to the incompetence of programs, but because of user habits.
May I recommend you to read this article.
This can help to prevent future infections.

Should you have any further problems, please post in this thread.


Regards,
Your friendly momok =)

This thread is for the use of frugalcat only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.