start up problem

[ritish]

friends,
whenever my windows starts after booting i see my documents folder rather than the desktop. please suggest some ways to fix that

[Tech Geek]

might be accidently placed in stratup
go to Run>msconfig>startup>disable all
then restart
i think that should do it

[ritish]

hey buddy that didn't work
suggest some other way

[khattam_]

RontokGen virus suspected in your computer... Scan with a good antivirus software... Have a look at the tutorial section titled "Rontok Removal" by me....

Scan your computer with a Gud updated antivirus...

Download HijackThis from http://www.majorgeeks.com/download3155.html and Run it and "Do a System Scan and save a log file" and post the logfile here for further assistance.....

[Kiran.dks]

Start>Run>regedit

Propagate to HKEY_CURRENT_USER \ Software \ Microsoft\Windows NT\ CurrentVersion \ Windows

In the right pane, check settings under "Load". There should be no value. If you find any value in load, delete it.

If there is no value, then your system is infected with DlDer Trojan.

Download & install freeware "Spybot"-Search & Destroy and scan entire system in "safe mode".

[ritish]

please can anyone provide me a link for the patch to the virus

[phreak0ut]

@khattam, its Rontokbro and ritish refer the link to remove it http://www.xblock.com/product_show.php?id=2845

[Kiran.dks]

It is a Advertising Spyware named DLDER. This spyware trojan consists of two executable files, dlder.exe and C:\Windows\explorer\Explorer.exe. The dlder.exe file then places a Run key in the Registry so that the new Explorer.exe trojan runs at startup.

Here is the removal tool: DLDER Remove

More Info about the Trojan

[ritish]

that does not solve the problem friends

[Kiran.dks]

That's strange. Did u check the registry values as I said above?
OR
The best thing would be to install freeware spybot-Search & destroy and scan entire system. Did u do that?

[anandk]

try this :

Run regedit and navigate to:

HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon

In there there should be a value (on right hand side of screen) called Userinit.

The data for this value is probably something similar to:

C:\windows\system32\userinit.exe,C:\windows\system 32\userinit.exe,

If you do see a duplicated string in there similar to the above - simply double click on the Userinit value and edit the data so as to delete everything to the right of the first comma (,). In the case above you would leave only:

C:\windows\system32\userinit.exe,

Exit registry edit and reboot.

http://www.techspot.com/vb/all/windo...winxp-sp2.html