Windows 7 Home Prem x64 Will not load Explorer.exe on startup

TekSupportLTD · 26 Jun 2013

Hi,
Ive got a laptop here that encountered the PCEU virus. I removed the HDD and placed into another machine as a slave drive to run Malwarebytes. Successfully removed 14 threats and placed back into the laptop. The PCEU virus has gone but I get a CMD box on startup trying to open a random .EXE and explorer doesnt load takes you to a c:\windows\system32 cursor. Typing explorer.exe here then loads and the OS is fully usable. How do I remove that from a startup and push explorer.exe back into a startup position??

Here is what appears in the CMD Box on start. I have obviously typed the explorer.exe to get the OS to load.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
'"C:\Users\Laptop\AppData\Local\Temp\yqsdjqgjncprwkove.exe"' is not recognized a
s an internal or external command,
operable program or batch file.
C:\windows\system32>explorer.exe
C:\windows\system32>

UsernameIssues · 26 Jun 2013

Welcome to the Seven Forums.

After you backup the registry...
Registry - Backup and Restore
...you can check to see that explorer is listed here:

Windows 7 Home Prem x64 Will not load Explorer.exe on startup-shell-explorer.png

And while you are in the registry, check these two places:

Windows 7 Home Prem x64 Will not load Explorer.exe on startup-cu-run.png

Windows 7 Home Prem x64 Will not load Explorer.exe on startup-lm-run.png

If you have any doubts about what you find, please post a screenshot before removing an entry.
Screenshots and Files - Upload and Post in Seven Forums

That said, wiping the drive and making a clean install of W7 is the safest thing to do:
Clean Install Windows 7

cottonball · 26 Jun 2013

TekSupportLTD,

Please do the following...

Download the Farbar Recovery Scan Tool
Select the 64-bit version.
Save to the Desktop.

Double-click the downloaded file to run it.
When the tool opens click Yes to disclaimer.
Press the Scan button.
FRST64 makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

Please provide the FRST.txt in your reply. <<---

The first time the tool is run, it also makes another log: Addition.txt
Also post the Addition.txt in your reply. <<---

To save you searching thru the Registry for the info requested by UsernameIssues,
also download SystemLook:
64-bit:
http://jpshortstuff.247fixes.com/SystemLook_x64.exe
Save to your Desktop.

Right-click on SystemLook.exe, and select: Run As Administrator

Copy the content of the following box into the main textfield:

Code:

 :reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

Click the Look button to start the scan.

When finished, a notepad window opens with the results of the scan.
Please post the SystemLook.txt (found on the Desktop) in your reply.