Explorer gets removed from WINNT logon reg entry. Here's a nice copy and paste from Experts Exchange:
A quick way to solve this problem is here :-
When you log on to ur system the one of two shells are started from the following registry location. One is CMD.EXE and other one is Explorer.exe. So Windows is designed using the small set of programs. So explorer.exe is a small set of program and present you with the GUI edition of Windows (means Desktop). So you should remove any unwanted entries from the following Registry locations :-
Look in the following locations for startup programs that may be suspect:
and then on the Right Pane find Entries called
"Shell" must contain this value "Explorer.exe" without quots
"Userinit" must contain this value "E:\WINNT\system32\userinit.exe," without quots
If you see anything different then please replace it with ur current version of exploerer.exe and userinit.exe.
after replacing the Registry entries from the above method replace the following files :-
NOTE : Any malware process may delete original files (exploerer.exe and userinit.exe) and then put itself to the above
regitry location to lunch at startup and then their programming instructions contains not to run anything on startup
or not to sho Desktop :-)
You can get above two files from Windows CD.
1. Insert Windows CD
2. Goto I386 directory of CD.
3. create a folder on ur Desktop or Startup Drive name it "Original"
4. copy the following files to ur "Original" directory.
5. and then goto command prompt, goto the "Original" directory.
6. finally issue the following command :-
Expand explorer.ex_ X:\Original\explorer.exe
Expand userinit.ex_ X:\Original\userinit.exe
7. and then replace the above files using the "Recovery Console". You need to copy these two files in \WINNT\System32 directory.