Help Needed - Xp Does Not Load Properly

[webfact]

My Win XP SP2 installation gives me some headache.

Since this morning it starts as usual - I log-on and voila here comes the desktop

without anything but the wallpaper (my dtop is set not to show icons).

It shows no task bar and nothing will load UNTIL I open the task manager (ctrl-alt-del) and start

manually "explore.exe" and thereafter all is back to normal.

Of course theres something evil in my machine which stops explorer.exe from proper loading.

Online Armor Firewall (explore.exe is set to trusted)

Avast 4.8 professional

Ayrecovery as restore point software

Thanks for your advise.

[Insight]

What's your HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon pointing to?

(got the info here)

[MKAsok]

You've gone through all the obvious steps right? Tried a restore point, checked what happens in safe mode, tried a different user profile, checked all start-up items with MSConfig etc? Doesn't sound like a corrupt explorer.exe file, since you can start it. Sounds more like something else that's loading at start-up is blocking it, or maybe registry corruption. If it's a virus you can't locate, I think your best bet is to generate a HJT log and post it to a hardcore nerd forum.

[webfact]

What's your HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon pointing to?

(got the info here)

shell key is correct - explorer.exe

Few minutes ago I did a restore with Ayrecovery and after that XP started as usual.

But I ain't know what actually has caused this behavior.

I suspect maybe firewall or anti virus but they are set to exclude each other.

Not to know the actual cause of that issue isn't that good. It might happen again.

my problem - I image my entire computer with Shadowprotect. So, the culprit is imaged as well.

Any suggestion?

Edited June 24, 2009 by webfact

[AjarnChan]

What's your HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon pointing to?

(got the info here)

shell key is correct - explorer.exe

Few minutes ago I did a restore with Ayrecovery and after that XP started as usual.

But I ain't know what actually has caused this behavior.

I suspect maybe firewall or anti virus but they are set to exclude each other.

Not to know the actual cause of that issue isn't that good. It might happen again.

my problem - I image my entire computer with Shadowprotect. So, the culprit is imaged as well.

Any suggestion?

It is not unusual for Explorer.exe to be replaced by a Virus. Some insert their own version, which links forward to the real program. You could try checking the filesize, though that is not foolproof.

Sadly no matter what Anti-Virus and other measure we take these things sometimes slip through. I had a similar problem early this year and traced it to a Memory Stick infection. Now I use 'Ninja Pendisk' to protect that avenue [it creates a Folder named 'autorun', thus blocking autorun viruses], but their are doubtless others which will be exploited sooner or later.

Good Luck