One of the common signs of virus interference is the missing desktop. Rather, he himself is, but you will not see either the taskbar with the Start button or the shortcuts that launch the applications - only the background image. In general, the desktop disappeared!
The easiest way to treat this malfunction is to roll back to the previous restore point. To do this, press Cltrl + Alt + Del. In the dispatcher that opens, select "New task" from the "File" menu. In the pop-up menu, type the path to the rstrui.exe file (recovery wizard) located in the system directory C: \ windows \ system32 \ restore \. Upon completion of this simple operation, click the "OK" button.
A system recovery wizard appears where you will need to select the desired recovery point (select the date when everything was in order). Reboot. If the virus program is classified as simple, then everything should work out. And at the next reboot, you will see the previous desktop. The virus has disappeared now, which cannot prevent the shell from loading.
But it happens that the malware blocked the launch of the task manager. This is not a problem either. Just when loading, after the POST testing procedure, you just need to press F8 and choose from the many options, among which you may get lost, "Safe Mode" (with default boot) instead of the shell command line. After that, type explorer. The shell should load. This is enough for now. After we go to the Run menu and drive the previous path to the system restore point wizard there.
After the above operations, you should clean the system with any common antivirus with the latest signature databases.
The above method is applicable for the optimal scenario when you have recovery points in your system. If the corresponding service was stopped immediately after installing the OS (as recommended in the articles on optimizing Windows), then none of the above methods are suitable for you. The “missing desktop” problem for you in the previous way is unsolvable. But there is a way out of this situation. Let's look at a more complex algorithm.
This method will perfectly help to cope with the “missing desktop” problem. Windows XP, Vista, 7 - operating systems for which this method of solving the problem is perfect. The regedit command starts the registry editor. We look at the presence of the useinit.exe, explorer.exe sections, as well as the vital winlogon.exe file located in the following registry hive - HKEY_LOCAL_MACHINE, SOFTWARE subkey, then select Microsoft \ Windows NT \ CurrentVersion, select the next level - Image File Execution Options. If sections are present, then boldly delete them. We do the same with explorer.exe if it is present along the registry path HKEY_CURRENT_USER \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Devices.
Then we check the values of the following parameters, the correct definitions are shown in brackets: Shell (explorer.exe), Userinit (logonui.exe), ULhost (C: \ WINDOWS \ system32 \ userinit.exe,) along this path - HKEY_LOCAL_MACHINE, subkey of the registry bush SOFTWARE . Then you should choose Microsoft. Go to the Windows NT subdirectory. Well, in the CurrentVersion subsection, look for Winlogon. We bring the keys to the correct state, and you can say goodbye to the “lost desktop” problem. Put a good antivirus. And for surfing the net, use a more reliable browser (Google Chrome or Mozilla Firefox).
If you often have to clean the system from the consequences of launching malicious software, then it is best to use the AVZ utility that allows you to clean the startup (select "Service", in the drop-down menu open "Startup Manager").
The fact that the unwanted program cannot interfere with the startup editing is guaranteed by the AVZGuard and AVZPM functions that block the launch of untrusted applications while AVZ is working with the registry.
After completion of the work, you can restore the registry keys modified by the virus using the standard procedure available in all operating systems starting with Windows XP - "System Restore" (located in the file menu, you can also get rid of the rest of the "missing desktop" problem).
You can also use the automated search and destruction of malware. Just put the checkbox "Perform treatment" (as the action, specify "Delete"). We select the system folders on the disk, the verification of which is critical (system Windows, directories where the malware can still be hidden - "Documents and Settings" and "Program Files").
On the "File Types" tab, you can also choose which ones to check (all or only potentially dangerous). In addition, you can set the heuristic level on the "Search Options" tab. After completing all the settings, click "Start." The duration of the scan depends on what level of heuristics was selected, as well as how many files were selected as objects for cleaning.