My Computer and Show Desktop lost icons

[Sp0iLedBrAt]

Explorer.exe doesn't contain any icons, as demonstrated here

but when I click OK, shell32.dll appears and shows the needed icons

which can be applied. I applied the My Computer icon to nLite's shortcut and it's fine.

Cheers

Edit: Explorer.exe is version 6.0.2900.5512. When I went to C:\WINDOWS to check the version, I noticed it has lost its icon as well. Now I'm really confused

[myselfidem]

Hello Sp0iLedBrAt

I think you can just copy the original file "Explorer.exe" (SP3)[6.00.2900.5512 (xpsp.080413-2105)] inside "C:\WINDOWS"

Cheers

Edited September 25, 2010 by myselfidem

[Sp0iLedBrAt]

I extracted explorer.exe from the CD, made sure it was the same version and it contained the above mentioned icons. After replacing it, it's still the same result, so it must be something that is disturbing/blocking explorer.exe. I'll try GrofLuigi's recommendation and check out Process Monitor next.

Cheers

Edit: I'm attaching the log file for explorer.exe. Being involved in so much, it is quite the read. I'm hoping someone will know what to look for.

Logfile.7z

Edited September 25, 2010 by Sp0iLedBrAt

[GrofLuigi]

You could have also included other files, not only Explorer.exe, at least shell32.dll; especially because it's inprocserver of 20D04FE0-3AEA-1069-A2D8-08002B30309D and gets loaded (example: lines 1352/1353). But nevermind.

Intel display driver is very suspicious, yes. It does a lot of activity during the time the desktop is drawn, and especially after My Computer object - 20D04FE0-3AEA-1069-A2D8-08002B30309D (around line 4920).

Check if there's some desktop management going on by the driver. And regardless of that, check the content of: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex.

Intel (and Nvidia BTW) driver sticks in there for desktop right click menu (and sometimes there's annoying blink of the desktop). Best done with Autoruns (so you could revert later if necessary), eliminate everything except HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\new. Or post the content of HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory if you want.

Another thing: you have many <INVALID NAME> (INVALID HANDLE) events, it might not be too dangerous, but I haven't seen many of them on healthy machines. I suspect Avira (by definition, as an antivirus) . Maybe try installing User Profile Cleanup Service.

Инаку, не е толку лоша машината.

But I shudder when I see windows search (I think that's that - 11016101-E366-4D22-BC06-4ADA335C892B)

GL

[Sp0iLedBrAt]

Maybe try installing User Profile Cleanup Service

I actually did install it 2-3 days ago, just to see what it does :-)

I'll look into those registry points you highlighted and post them if necessary (probably in this same post). I'll also do another change of explorer.exe and shell32.dll this time. Shell32.dll is currently version 6.0.2900.6018, which means it's been updated post SP3. Maybe -X- could jump in and help me out with the exact update/hotfix.

Thanks

Edited September 25, 2010 by Sp0iLedBrAt

[GrofLuigi]

It's the latest for XPSP3. You have it, maybe reapply it if you feel like it.

GL

* Edit: the issue described there is not your issue, it's the .LNK handler vulnerability

Edited September 26, 2010 by GrofLuigi

[GrofLuigi]

I'm increasingly convinced it's the Intel driver, maybe hooking Windows functions to manage multiple desktops. Unfortunately, on my machine, which has Intel display, I haven't installed .Net 3.5 which they require for the GUI. If you can, check the advanced display properties and turn of any management functions of multiple displays.

Also, check your video drivers at HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO - you have 3, which is not suspicious, but there might be a leftover of older driver and/or mirror driver of some kind (from remote control software, for example. Just follow the GUIDs (search), don't delete anything. And updating the display driver would certainly be beneficial.

This is probably an overkill, but doesn't hurt to have a look.

GL

[Sp0iLedBrAt]

updating the display driver would certainly be beneficial

I wish! The latest driver is 6.14.10.4764 and was released in 2007 :sigh:

I will look into it and report back.

Cheers

[iamtheky]

http://winhlp.com/node/16#comment-2155

i believe that should link to the comments in regards to .6018 of shell32.dll

[Sp0iLedBrAt]

@iamtheky

I followed the instructions in your link (with 3-4 different free hex editors) and I didn't find the named values there, nor in shell.32.dll extracted from WindowsXP-KB2286198-x86-ENU.exe. I even tried this link http://winhlp.com/node/16#comment-1936 , 3 or 4 comments below the one you provided.

@GrofLuigi: I found 2 GUIDs:

1. {DEB039CC-B704-4F53-B43E-9DD4432FA2E9} in \Registry\Machine\System\CurrentControlSet\Control\Video\{DEB039CC-B704-4F53-B43E-9DD4432FA2E9}\0000, which should be normal; I even found it in one of the posts here http://www.msfn.org/...i-setup-solved/

2. {23A77BF7-ED96-40EC-AF06-9B1F4867732A} in \Registry\Machine\System\CurrentControlSet\Control\Video\{23A77BF7-ED96-40EC-AF06-9B1F4867732A}\0000 , which doesn't show up anywhere in the log file I attached.

I also have \REGISTRY\Machine\System\ControlSet001\Services\ialm\Device0 and \REGISTRY\Machine\System\ControlSet001\Services\ialm\Device1, which would explain why Google video chat reports I have PC Camera0 and PC Camera1.

This is the exported key + the one previously

key.reg

HKLM_SOFTWARE_Classes_Directory_Background_shellex.reg

Edited September 26, 2010 by Sp0iLedBrAt

[GrofLuigi]

Just as I thought.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\igfxcui]

(you lose Right click anywhere on desktop > intel graphic properties)

To restore, use your HKLM_SOFTWARE_Classes_Directory_Background_shellex.reg from above.

See here for latest driver. What is the exact name of the devices (they appear as two) in Device Manager?

The other one (key.reg) seems OK, only if you could verify what DEB039CC-B704-4F53-B43E-9DD4432FA2E9 is (it might be Terminal Services mirror display driver (another one besides TSDDD); I have nLited away mine ) For example, 23A77BF7-ED96-40EC-AF06-9B1F4867732A is well known VgaSave driver for safe mode and/or booting. When I said search, I meant search in your registry (or go directly to the key it points to - HLKM\System\CurrentControlSet\Control\Video\{DEB039CC- B704-4F53-B43E-9DD4432FA2E9}\0000). Most probably, this has nothing to do with your issue, but it wouldn't hurt to check if it's a leftover.

GL

Edited September 26, 2010 by GrofLuigi

[Sp0iLedBrAt]

This link http://forum.noteboo...tml#post3463520 probably verifies that it is related to graphics (other hits on google warn of a possible virus )

Anyway, the video card is Mobile Intel 915GM/GMS, 910 GML Express Chipset Family and it's no use looking for a newer driver; I've done it more than once (even with trial versions of device driver finders), and the earliest version on the link you suggested is 940GML. A daRn shame.

These entries are in the registry, found in ControlSet, ControlSet001 and ControlSet002 (no need to export them all)

HKLM_SYSTEM_ControlSet001_Control_Video_DEB039CC-B704-4F53-B43E-9DD4432FA2E9.reg

HKLM_SYSTEM_ControlSet001_Services_RDPCDD_Video.reg

[GrofLuigi]

OK, everything is well with RDPCDD, it's a built-in Windows component.

And unfortunately you're right about the driver...

I'm out of ideas (actually, I'm not, but I think they might have lesser chances of helping you with this issue). If you're not tired of this and want to proceed, let me know. (I'm not).

GL

[Sp0iLedBrAt]

Well, this spoiled brat IS feeling kinda spiteful and wants to see the end of this unpleasant issue for the sake of posterity, but has also begun preparations for a new nLited install (this time through USB), which is maybe even overdue.

It's just that I can't shake the felling that one of the possible reasons could also be KB2286198.exe...

Edited September 27, 2010 by Sp0iLedBrAt