Sp0iLedBrAt

My Computer and Show Desktop lost icons

29 posts in this topic

Explorer.exe doesn't contain any icons, as demonstrated here

post-236786-061850300 1285422460_thumb.j

but when I click OK, shell32.dll appears and shows the needed icons

post-236786-036411100 1285422505_thumb.j

which can be applied. I applied the My Computer icon to nLite's shortcut and it's fine.

Cheers

Edit: Explorer.exe is version 6.0.2900.5512. When I went to C:\WINDOWS to check the version, I noticed it has lost its icon as well. Now I'm really confused

0

Share this post


Link to post
Share on other sites

Hello Sp0iLedBrAt

I think you can just copy the original file "Explorer.exe" (SP3)[6.00.2900.5512 (xpsp.080413-2105)] inside "C:\WINDOWS"

Cheers

Edited by myselfidem
0

Share this post


Link to post
Share on other sites

I extracted explorer.exe from the CD, made sure it was the same version and it contained the above mentioned icons. After replacing it, it's still the same result, so it must be something that is disturbing/blocking explorer.exe. I'll try GrofLuigi's recommendation and check out Process Monitor next.

Cheers

Edit: I'm attaching the log file for explorer.exe. Being involved in so much, it is quite the read. I'm hoping someone will know what to look for.

Logfile.7z

Edited by Sp0iLedBrAt
0

Share this post


Link to post
Share on other sites

You could have also included other files, not only Explorer.exe, at least shell32.dll; especially because it's inprocserver of 20D04FE0-3AEA-1069-A2D8-08002B30309D and gets loaded (example: lines 1352/1353). But nevermind.

Intel display driver is very suspicious, yes. It does a lot of activity during the time the desktop is drawn, and especially after My Computer object - 20D04FE0-3AEA-1069-A2D8-08002B30309D (around line 4920).

Check if there's some desktop management going on by the driver. And regardless of that, check the content of: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex.

Intel (and Nvidia BTW) driver sticks in there for desktop right click menu (and sometimes there's annoying blink of the desktop). Best done with Autoruns (so you could revert later if necessary), eliminate everything except HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\new. Or post the content of HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory if you want.

Another thing: you have many <INVALID NAME> (INVALID HANDLE) events, it might not be too dangerous, but I haven't seen many of them on healthy machines. I suspect Avira (by definition, as an antivirus) :). Maybe try installing User Profile Cleanup Service.

Инаку, не е толку лоша машината. ;)

But I shudder when I see windows search (I think that's that - 11016101-E366-4D22-BC06-4ADA335C892B)

GL

0

Share this post


Link to post
Share on other sites
Maybe try installing User Profile Cleanup Service
I actually did install it 2-3 days ago, just to see what it does :-)

I'll look into those registry points you highlighted and post them if necessary (probably in this same post). I'll also do another change of explorer.exe and shell32.dll this time. Shell32.dll is currently version 6.0.2900.6018, which means it's been updated post SP3. Maybe -X- could jump in and help me out with the exact update/hotfix.

Thanks

Edited by Sp0iLedBrAt
0

Share this post


Link to post
Share on other sites

It's the latest for XPSP3. You have it, maybe reapply it if you feel like it.

GL

* Edit: the issue described there is not your issue, it's the .LNK handler vulnerability

Edited by GrofLuigi
0

Share this post


Link to post
Share on other sites

I'm increasingly convinced it's the Intel driver, maybe hooking Windows functions to manage multiple desktops. Unfortunately, on my machine, which has Intel display, I haven't installed .Net 3.5 which they require for the GUI. If you can, check the advanced display properties and turn of any management functions of multiple displays.

Also, check your video drivers at HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO - you have 3, which is not suspicious, but there might be a leftover of older driver and/or mirror driver of some kind (from remote control software, for example. Just follow the GUIDs (search), don't delete anything. And updating the display driver would certainly be beneficial.

This is probably an overkill, but doesn't hurt to have a look.

GL

0

Share this post


Link to post
Share on other sites
updating the display driver would certainly be beneficial

I wish! The latest driver is 6.14.10.4764 and was released in 2007 :sigh:

I will look into it and report back.

Cheers

0

Share this post


Link to post
Share on other sites

@iamtheky

I followed the instructions in your link (with 3-4 different free hex editors) and I didn't find the named values there, nor in shell.32.dll extracted from WindowsXP-KB2286198-x86-ENU.exe. I even tried this link http://winhlp.com/node/16#comment-1936 , 3 or 4 comments below the one you provided.

@GrofLuigi: I found 2 GUIDs:

1. {DEB039CC-B704-4F53-B43E-9DD4432FA2E9} in \Registry\Machine\System\CurrentControlSet\Control\Video\{DEB039CC-B704-4F53-B43E-9DD4432FA2E9}\0000, which should be normal; I even found it in one of the posts here http://www.msfn.org/...i-setup-solved/

2. {23A77BF7-ED96-40EC-AF06-9B1F4867732A} in \Registry\Machine\System\CurrentControlSet\Control\Video\{23A77BF7-ED96-40EC-AF06-9B1F4867732A}\0000 , which doesn't show up anywhere in the log file I attached.

I also have \REGISTRY\Machine\System\ControlSet001\Services\ialm\Device0 and \REGISTRY\Machine\System\ControlSet001\Services\ialm\Device1, which would explain why Google video chat reports I have PC Camera0 and PC Camera1.

This is the exported key + the one previously

key.reg

HKLM_SOFTWARE_Classes_Directory_Background_shellex.reg

Edited by Sp0iLedBrAt
0

Share this post


Link to post
Share on other sites

Just as I thought.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\igfxcui]

(you lose Right click anywhere on desktop > intel graphic properties)

To restore, use your HKLM_SOFTWARE_Classes_Directory_Background_shellex.reg from above.

See here for latest driver. What is the exact name of the devices (they appear as two) in Device Manager?

The other one (key.reg) seems OK, only if you could verify what DEB039CC-B704-4F53-B43E-9DD4432FA2E9 is (it might be Terminal Services mirror display driver (another one besides TSDDD); I have nLited away mine :D) For example, 23A77BF7-ED96-40EC-AF06-9B1F4867732A is well known VgaSave driver for safe mode and/or booting. When I said search, I meant search in your registry (or go directly to the key it points to - HLKM\System\CurrentControlSet\Control\Video\{DEB039CC- B704-4F53-B43E-9DD4432FA2E9}\0000). Most probably, this has nothing to do with your issue, but it wouldn't hurt to check if it's a leftover.

GL

Edited by GrofLuigi
0

Share this post


Link to post
Share on other sites

This link http://forum.noteboo...tml#post3463520 probably verifies that it is related to graphics (other hits on google warn of a possible virus :whistle:)

Anyway, the video card is Mobile Intel 915GM/GMS, 910 GML Express Chipset Family and it's no use looking for a newer driver; I've done it more than once (even with trial versions of device driver finders), and the earliest version on the link you suggested is 940GML. A daRn shame.

These entries are in the registry, found in ControlSet, ControlSet001 and ControlSet002 (no need to export them all)

HKLM_SYSTEM_ControlSet001_Control_Video_DEB039CC-B704-4F53-B43E-9DD4432FA2E9.reg

HKLM_SYSTEM_ControlSet001_Services_RDPCDD_Video.reg

0

Share this post


Link to post
Share on other sites

OK, everything is well with RDPCDD, it's a built-in Windows component.

And unfortunately you're right about the driver...

I'm out of ideas (actually, I'm not, but I think they might have lesser chances of helping you with this issue). If you're not tired of this and want to proceed, let me know. :) (I'm not).

GL

0

Share this post


Link to post
Share on other sites

Well, this spoiled brat IS feeling kinda spiteful and wants to see the end of this unpleasant issue for the sake of posterity, but has also begun preparations for a new nLited install (this time through USB), which is maybe even overdue.

It's just that I can't shake the felling that one of the possible reasons could also be KB2286198.exe...

Edited by Sp0iLedBrAt
0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.