Blackforce

Bit of a quirky virus related problem I experienced on a friends computer.

Basically windows will boot to the logon screen. Once you select a user no matter who you select it will say Loading Personal Settings and then the screen will just display the wallpaper. No icons. Nothing.

I could press CTRL + ALT + DELETE and load up task manager. So I then loaded up a command prompt from there.

When I then ran explorer.exe an error message came up saying :-

system cannot find the file explorer.exe

Checking the windows folder I could see the explorer.exe file.

To resolve the issue I took the following steps.

- Boot Windows into safe mode
- Login as administrator
- When blank screen press CTRL + ALT + DELETE
- Click on file, run
- regedit.exe
- Navigate to this key
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
- Delete this key

When I tried to delete this key I got an access denied error message. On closer inspection I found that the permissions on the key had been altered so noone had permission to delete it.

In order to delete it I had to do the process below :

- Navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
- Right click on the Image File Execution Options
- Click Permissions
- Click on advanced button
- Click on owner
- Tick the box “replace owner on subcontainers and objects”
- Click Ok
- Click Ok Again
- Repeat process Right click on the Image File Execution Options
- Click Permissions
- Click on advanced button
- Tick the box “replace permission entries on all child objects”
- Click ok
- Click ok

You should now be able to delete the key.

Also delete the key for iexplorer.exe if you have one

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplorer.exe

Now reboot and it should login as normal. You can now cleanse the machine. FUN!!!