Yesterday Kaspersky Internet Security detected a trojan mining virus soundmixer.exe and removed the threat. But next time I started the PC and logged in, there was only a terminal window opened, and no file explorer. After a lot of search, I found that most of the steps to eliminate the virus threat were taken, except one:
In the registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon , the value of Shell was not fixed - it was still %comspec% instead of explorer.exe . That solved the problem.
Hopefully that will be fixed soon.