You could try having a look at the registry keys that run programs on start-up.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Have a look on the right side and delete anything that looks suspicious.
I have only one entry there, for the sidebar gadgets.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
I have only one entry there, for Windows Defender.

I do not have this key in my registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell
so I don't know what to suggest about that.

[*HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell*]

My guess (because I can't see the machine) is that your computer is severely
infected which is why the shell setting changes upon reboot. Since you
haven't told us anything about your computer and its recent history (except
that you've had this problem for 5 days) or your security/antivirus
protection, that's about as specific as I can guess.

You could try booting with a Bart's PE with an antivirus plugin and scanning
from there. Or you could pull the drive and attach it to a working computer
running XP or Vista and use the installed av to scan it from there.

Standard disclaimer: I can't see and test your computer myself, so these are
just suggestions based on many years of being a professional computer tech;
suggestions based on what you've written. You should not take my
suggestions as a definitive diagnosis. If you can't do the work yourself
(and there is no shame in admitting this isn't your cup of tea), take the
machine to a professional computer repair shop (not your local equivalent
of BigComputerStore/GeekSquad). If possible, have all your data backed up
before you take the machine into a shop.

Malke

Hi,

For starters, that should be the HKLM branch, not the HKCU branch, and your
key is entirely the wrong path. It should be:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Note that this is the "Windows NT" key, not just "Windows", and not the
"Explorer" key but the "Winlogon" key.

Try changing it there. As Malke has pointed out, you most likely have a
serious infection which is best attacked from outside of Windows.