0

I have a laptop that displays the login screen and then will sit at a blank screen. C+A+D still works, so I checked the running processes. I noticed that explorer was not running, so I attempted to start it manually, which resulted in a "you don't have permission" error. I pulled the HDD and checked it using an external enclosure and it turns out all the permissions for explorer.exe (just this file) have been removed by some virus.

Has anybody seen this before, I suspect its some form of Malware, I had seen something like this once before at work, however it allowed windows to load and then proceeded to show pop-ups all day. It would change the permissions of any executable file that ran. If you ran Word it would close it down after a few seconds and change the permissions, same for virus scanners.

5
  • Do you may have a Rogue security software virus or rogueware a shield is normally in the task-bar guiding to a site that tries to get you to pay to remove it. You may also see a process with nothing but numbers listed in the task manager processes session. Normally it would not allow you to access anything on the internet but the rogue hold up site.
    – N4TKD
    Sep 13, 2011 at 11:45
  • See this page to remove the nasty Boot Sector Virus...superuser.com/questions/100360/…
    – Moab
    Sep 13, 2011 at 14:10
  • More than likely explorer.exe has been patched/injected by the virus also, I would replace the file with a known clean copy of it.
    – Moab
    Sep 13, 2011 at 14:15
  • @Moab I'll try that, what I don't quite understand is that it lets the WinLogin process work, but not explorer.exe. It would seem to me, that a virus would want to go unnoticed, unless its intention was just force a re-install. I'll also look at that Boot Sector Virus answer too.
    – Timbermar
    Sep 15, 2011 at 16:40
  • If you find no infections, run SFC...support.microsoft.com/kb/929833
    – Moab
    Sep 15, 2011 at 18:13

0

You must log in to answer this question.

Browse other questions tagged .