Explorer.exe gets killed instantly, so no shell

[Roeland]

Dear MVP's

Let me tell you what I've done and discovered till now (FYI, I'm a
professional IT-er with 15 year experience, but I'm really baffled by
this one)

Explorer process gets killed a few miliseconds after it has been
initiated, without a message.
As a result explorer as shell doesn't show up, hence only your
wallpaper to show up after a normal logon (No taskbar, no startmenu, no
desktop icons, no systray, nothing but a wallpaper)
Not one program in the startup folder, nor HKlocalmachine/run nor
HKCurrentUser/run entries gets called.Services run fine.
Eventlog (application/system/security) has no disturbing items in it
The shell entry in the registry is OK
Booting in safe mode gives no changes
Creating a new account gives no changes
Taskmanager works (thanks heaven for that)
Nearly all programs can be started without a problem using the
taskmanager, with the very specific exception of IExplore (internet
explorer)
However an alternative browser Netcaptor (based on IExplore) works
fine. Through this browser I can browse the computer (and the internet,
network connection is OK)
Control Panel Items can't be opened (*.cpl). I guess they depend on
explorer, however, microsoft management console works (for example for
computer or disk management).
Checked all processes running (including services), all were to be
trusted (mostly OS-related). At a certain moment I've killed all non
OS-vital processes, still no change.
All nessecary Dll's are present and registered.
Multiple antivirus and antispyware runs (all trusted ones, don't worry,
eg Windows Defender, Adaware, Giant antiSpyware (purchased), Norton AV,
Trend Micro online scan ) give no result.
Autoexec.bat, config.sys, win.ini and other 'startup'-files are
completely checked and verified
One thing I still have to do (but can't right now because of a broken
Windows XP CD) is a System File Check (SFC /scannow).
My best guess (since all other options I can think of are not valid) is
that some file (like a dll) that's being used by explorer.exe is
corrupted. (hence I wanna run SFC)

If anyone has the same experiences (read 'troubles') and found the
solution, PLEASE LET ME KNOW. I'm sure some superior being will reward
you for this !
PS. Clean Reinstalling my system is not really a solution, in my humble
opinion. Asking for Hijackthis-roll-outs neither.

Kind regards,

Roeland

 

[Jon]

Dear MVP's

Let me tell you what I've done and discovered till now (FYI, I'm a
professional IT-er with 15 year experience, but I'm really baffled by
this one)

Explorer process gets killed a few miliseconds after it has been
initiated, without a message.
As a result explorer as shell doesn't show up, hence only your
wallpaper to show up after a normal logon (No taskbar, no startmenu, no
desktop icons, no systray, nothing but a wallpaper)
Not one program in the startup folder, nor HKlocalmachine/run nor
HKCurrentUser/run entries gets called.Services run fine.
Eventlog (application/system/security) has no disturbing items in it
The shell entry in the registry is OK
Booting in safe mode gives no changes
Creating a new account gives no changes
Taskmanager works (thanks heaven for that)
Nearly all programs can be started without a problem using the
taskmanager, with the very specific exception of IExplore (internet
explorer)
However an alternative browser Netcaptor (based on IExplore) works
fine. Through this browser I can browse the computer (and the internet,
network connection is OK)
Control Panel Items can't be opened (*.cpl). I guess they depend on
explorer, however, microsoft management console works (for example for
computer or disk management).
Checked all processes running (including services), all were to be
trusted (mostly OS-related). At a certain moment I've killed all non
OS-vital processes, still no change.
All nessecary Dll's are present and registered.
Multiple antivirus and antispyware runs (all trusted ones, don't worry,
eg Windows Defender, Adaware, Giant antiSpyware (purchased), Norton AV,
Trend Micro online scan ) give no result.
Autoexec.bat, config.sys, win.ini and other 'startup'-files are
completely checked and verified
One thing I still have to do (but can't right now because of a broken
Windows XP CD) is a System File Check (SFC /scannow).
My best guess (since all other options I can think of are not valid) is
that some file (like a dll) that's being used by explorer.exe is
corrupted. (hence I wanna run SFC)

If anyone has the same experiences (read 'troubles') and found the
solution, PLEASE LET ME KNOW. I'm sure some superior being will reward
you for this !
PS. Clean Reinstalling my system is not really a solution, in my humble
opinion. Asking for Hijackthis-roll-outs neither.

Kind regards,

Roeland

You could try running the "sfc /scannow" command that you mentioned - not
with a view to having it fix things in itself, but as a way of flagging up
any problematic files that you could then deal with via other means.

Jon

 

[Roeland]

Thanks Jon,

It's indeed my intention (from the moment I can lay my hands on a
working CD offcourse) to pinpoint the problem rather than solving it.
Once I know the source of this strange behaviour I can deal with it,
but for now I haven't got a clue where to look.

Thanks anyway for supporting this possibility, I've been looking in
your responses to other problems and you seem a guy with some nice
experience.

If I ever find a solution I'll let you know.

Greetz.

Roeland

 

[George Hester]

In my humble opinion reinstalling the op sys is a solution. Try this and
see what you have starting up then the next link.

http://www.diamondcs.com.au/index.php?page=asviewer

then this.

http://www.sysinternals.com/utilities/rootkitrevealer.html

 

[Roeland]

Thanks George !

however, I already analysed every startup item through autoruns (also
from sysinternals) and they al were valid.
The rootkitrevealer was something completely new to me ! I hadn't
thought about that option until now. Too bad (or should I say luckily
?) The program gave no results.

Anyway, thank you very much for your help !!!

kind regards,

Roeland.

 

[Plato]

Explorer process gets killed a few miliseconds after it has been
initiated, without a message.

Often as a result of bad ram, virus, or spyware.