Unable to locate Shell Process

[Guest]

I really don't know how to start this so I will give you some of the symptoms

1. When I run Panda online scan it hangs on file 319 and will not go any
further
2. When I run Spybot at the end I get "Error during check! Xuron55 (Datei
C:\Windows\win.ini kann nicht geoffnet werden. The process cannot access the
file because it is being used by another process.
3. When I search for a file in Regedit it searches forever
4. In one of my log files (C:\Windows\System32\WBEM\Logs) it says "Shell
name Explorer.exe in registry not found in process list Unable to locate
Shell process. Impersonation failed.
5. In my event viewer I am getting alot of "The Shell stopped unexpectedly
and Explorer.exe was restarted

I am running XP Home Edition and this has been going on for a couple of
weeks. I run Panda Online Scan, Adaware, and Spybot weekly and because I
have had a couple of viruses in the past I run Stinger pretty often also.
Adaware and Stinger say my system is clean. When Panda hangs it is in the
registry. Any suggestions on how to locate the problem?

 

[Ron Martell]

I really don't know how to start this so I will give you some of the symptoms

1. When I run Panda online scan it hangs on file 319 and will not go any
further
2. When I run Spybot at the end I get "Error during check! Xuron55 (Datei
C:\Windows\win.ini kann nicht geoffnet werden. The process cannot access the
file because it is being used by another process.
3. When I search for a file in Regedit it searches forever
4. In one of my log files (C:\Windows\System32\WBEM\Logs) it says "Shell
name Explorer.exe in registry not found in process list Unable to locate
Shell process. Impersonation failed.
5. In my event viewer I am getting alot of "The Shell stopped unexpectedly
and Explorer.exe was restarted

I am running XP Home Edition and this has been going on for a couple of
weeks. I run Panda Online Scan, Adaware, and Spybot weekly and because I
have had a couple of viruses in the past I run Stinger pretty often also.
Adaware and Stinger say my system is clean. When Panda hangs it is in the
registry. Any suggestions on how to locate the problem?

It sounds like some sort of nasty or other has gotten past your
security programs.

Try a different online virus scanner such as Trend Micro's at
http://housecall.trendmicro.com

Also try downloading and installing the free Beta version of Microsoft
Antispyware from http://download.microsoft.com

Warning: Microsoft has "downgraded" the default actions for certain
known malware items such as Claria. It will still detect and report
these items but the recommended action shows as "ignore" which you
probably would want to change.

Another option would be to run HiJackThis from
http://www.aumha.org/downloads/hijackthis.exe
Create a log file, save it and post it as a new topic to
http://forum.aumha.org/viewforum.php?f=30 or another forum dedicated
to discussing HiJackThis log files.

Good luck


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

In memory of a dear friend Alex Nichol MVP
http://aumha.org/alex.htm

 

[Guest]

I should have told you I have Microsoft Antispyware and Hijack This already
installed. I tried the Trend Micro and I got this " House Call detects a
corrupt pattern/engine file (VSAPI32.dll) Please remove the corresponding
file and restart House Call again.

 

[Ron Martell]

I should have told you I have Microsoft Antispyware and Hijack This already
installed. I tried the Trend Micro and I got this " House Call detects a
corrupt pattern/engine file (VSAPI32.dll) Please remove the corresponding
file and restart House Call again.

From Trend Micro's Knowledge Base:

"Get error message 102 when trying to access HouseCall

Product: HouseCall

Version: any

Solution ID: 3119

Created: 11/9/1999 2:32:50 PM

Problem: If the scan engine is unable to read the pattern file
during a scanning process, an error message will be returned.

Solution: To correct the problem, delete the present pattern file
(which could be the cause of the error message) and force HouseCall to
get a new one.

Delete vptnfile.xxx (xxx is a 3-digit pattern number)

Delete vsapi32.dll

Note: By deafult, these files (the pattern and scan engine files) are
located in the \Windows directory. However, it may be in a different
directory if some other directory was specified at the time the
program was installed.

Otherwise, uninstall all components of Housecall and try to access it
again. Click this link: www.antivirus.com "

Hope this is of some assistance.

Good luck


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

In memory of a dear friend Alex Nichol MVP
http://aumha.org/alex.htm