Today my morning started with present of notebook booting to empty screen and typical explanation “it worked and then stopped”.
However case turned out to be slightly untypical and worth sharing.
Problem
- notebook booted to empty screen with wallpaper;
- it remained responsive (mouse cursor moving, etc) so that eliminated hardware.
Tracing
Empty screen is typical if explorer.exe (Windows shell that handles most of interface including desktop and sidebar) cannot start. Very typical for virus hijack of explorer executable.
- Ctrl+Shift+Esc gave me access to task manager;
- File > Run from there and I can launch anything from my flash drive;
- Autoruns to check for hijack – negative;
- CureIt to be sure there is no malware involved – negative;
- trying to launch explorer.exe – file not found, here is my reason.
Fixing
It is quite weird to have explorer nuked without malware involved. Not something sane software would do, right?
- run file manager from flash drive and searched for explorer.exe;
- found it in bunch of usual places Windows uses to hide files and in unfamiliar VSP folder;
- copied explorer.exe to c:\Windows\ and rebooted to normal environment.
Or not so normal. Apparently VSP is short for Vista Skin Pack – one of those crappy lame packs that try to combine bunch of utilities and hack Windows XP to have Vista-like looks. They are usually messing system files pretty good while at it.
- thorough uninstall of everything VSP-related alternating between Revo Uninstaller and CCleaner runs;
- manual deletion of numerous leftovers in Program Files and CCleaner again.
Second stage problem with icons
Now notebook was running smoothly… except that drive icons in explorer where completely broken. Quick check for presence of:
- autorun.inf (I had covered how it can be used to change drive icons) – negative;
- desktop.ini which can be used in similar way (I have no clue how) – negative.
Clearly I was missing something and googling it was. Luckily one of top results was post on fixing corrupt drive icons.
Run > regedit
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\DriveIcons
After erasing DriveIcons folder icons went back to normal.
Lessons learned
Smile charmingly and promise user that next time he would try to prettify Windows you will break his arm. Or leg.
Salwa #
Nick Staroba #
Rarst #
Len #
Rarst #