Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a laptop that displays the login screen and then will sit at a blank screen. C+A+D still works, so I checked the running processes. I noticed that explorer was not running, so I attempted to start it manually, which resulted in a "you don't have permission" error. I pulled the HDD and checked it using an external enclosure and it turns out all the permissions for explorer.exe (just this file) have been removed by some virus.

Has anybody seen this before, I suspect its some form of Malware, I had seen something like this once before at work, however it allowed windows to load and then proceeded to show pop-ups all day. It would change the permissions of any executable file that ran. If you ran Word it would close it down after a few seconds and change the permissions, same for virus scanners.

share|improve this question
    
Do you may have a Rogue security software virus or rogueware a shield is normally in the task-bar guiding to a site that tries to get you to pay to remove it. You may also see a process with nothing but numbers listed in the task manager processes session. Normally it would not allow you to access anything on the internet but the rogue hold up site. –  N4TKD Sep 13 '11 at 11:45
    
See this page to remove the nasty Boot Sector Virus...superuser.com/questions/100360/… –  Moab Sep 13 '11 at 14:10
    
More than likely explorer.exe has been patched/injected by the virus also, I would replace the file with a known clean copy of it. –  Moab Sep 13 '11 at 14:15
    
@Moab I'll try that, what I don't quite understand is that it lets the WinLogin process work, but not explorer.exe. It would seem to me, that a virus would want to go unnoticed, unless its intention was just force a re-install. I'll also look at that Boot Sector Virus answer too. –  Timbermar Sep 15 '11 at 16:40
    
If you find no infections, run SFC...support.microsoft.com/kb/929833 –  Moab Sep 15 '11 at 18:13
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.