I think it might be a virus or worm. (sorry kind of new to all this) After a reboot I had no desktop just a blank blue screen. I have to run programs through crtl, alt delete.
Also for the last week i got can’t find moniter.exe after a reboot.
can someone help me fix this.
Also after running a virus scan I had one in c:\windows\system32\coma.dll Is it safe to delete this or what?
Hi,
-
what did you delete/change/update/install/do before the problems appeared ?
Did avast find/repair/delete/move any stuff ? -
what virusname does avast give for “coma.dll” ?
what happens if you boot to SafeMode (F8-Boot)
Please read “VirusRemoval” below and if possible, post a log of Hijackthis
It seems like the entry
shell=explorer.exe
in your system.ini was damaged
actually this is only mirrored/mapped somehow into system.ini by e.g these registry entries:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
“Shell”=“Explorer.exe”
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\boot]
“Shell”=“SYS:Microsoft\Windows NT\CurrentVersion\Winlogon”
do you have those entries still ?
a repair of win with the XP-Setup-CD,
or recovering/going back to an earlier RESTORE-point might also be an option…
What windows version? (I guess XP, but home or pro)
Does it give a location for monitor.exe?
Is that file listed/mentioned in the registry?
Monitor.exe is known Malware(trojan.win32.startpage.in).
It uses the following entries to start itself:
F2 - REG:system.ini: Shell=Explorer.exe monitor.exe
O4 - HKCU..\Run: [monitor] monitor.exe
other Variants of that Monitor.exeHijacker uses more entries.
Not always malware, depending on where it’s found:
http://www.liutilities.com/products/wintaskspro/processlibrary/monitor/
but sounds like malware [b]here[/i];
maybe OP deleted the whole line in system.ini, thus killing the shell…?
But how ?
on W2k, this entry is only shown in startup-Analyzers, it’s not really existing within system.ini
Is this different in XP ?
???
monitor.exe is used by many things. It can be part of the NT system, a trojan, a virus, a worm, tvcard software etc etc. The location as well as any registry entry can tell a lot more about what we have here.