Windows Explorer Error

[James]

I keep getting a "Windows Explorer has encountered a problem and needs to
close" error. After pressing send or don't send it just comes back up. Here
is the info---- Appname:explorer.exe AppVer:6.0.2900.5512
ModName:user32.dll ModVer: 5.1.2600.5512 Offset:00009de9

I have tried- CCleaner, Spybot, Norton 2008,

 

[Allan]

I keep getting a "Windows Explorer has encountered a problem and needs to
close" error. After pressing send or don't send it just comes back up.
Here
is the info---- Appname:explorer.exe AppVer:6.0.2900.5512
ModName:user32.dll ModVer: 5.1.2600.5512 Offset:00009de9

I have tried- CCleaner, Spybot, Norton 2008,

Would you consider upgrading to IE7? It is a free download after all. You
can disable the error reporting in Control Panel "System" applet just for
iexplore.exe if you find the notification annoying.

 

[Ken Blake, MVP]

Would you consider upgrading to IE7? It is a free download after all. You
can disable the error reporting in Control Panel "System" applet just for
iexplore.exe if you find the notification annoying.

Please note that his problem is with Windows explorer, not Internet
Explorer. They are two different things.

 

[James]

Ken is correct. This is Windows Explorer and not internet explorer-I have
ie7 anyways

 

[Ms. L MS MVP]

Try my Explorer Shell Fix tool. Download it here
http://pcbutts1.com/downloads/tools/tools.htm

 

[Gerry]

James

It would be helpful if you posted the complete Event Viewer Error
report.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

The error? What brings it on? Are you using left or right click of the
mouse?

Does it occur when you are using particularly functions in Windows
Explorer e.g. copy / paste or whatever? Alternatively does it occur when
you try to open a particular type of file?

The error is caused by something using explorer.exe to access
user32.dll. Unfortunately try to pick up on what is using explorer.exe
can be challenging. You can use Process Monitor (not to be confused with
Process Explorer) but you do get bombarded with so much information it
can be difficult to see the wood for the trees.. You can filter out data
not relevant to your search but it is not an easy task despite what is
said in the links below..

http://technet.microsoft.com/en-gb/sysinternals/bb896645.aspx

http://technet.microsoft.com/en-gb/sysinternals/bb896642.aspx

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[James]

The error comes up everytime at startup. It leaves the bar at the bottom of
the screen frozen.----Here is event Viewer info

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 7/5/2008
Time: 11:23:58 AM
User: N/A
Computer: BUTLER
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module
user32.dll, version 5.1.2600.5512, fault address 0x00009de9.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 35 35 31 32 20 00.5512
0030: 69 6e 20 75 73 65 72 33 in user3
0038: 32 2e 64 6c 6c 20 35 2e 2.dll 5.
0040: 31 2e 32 36 30 30 2e 35 1.2600.5
0048: 35 31 32 20 61 74 20 6f 512 at o
0050: 66 66 73 65 74 20 30 30 ffset 00
0058: 30 30 39 64 65 39 0d 0a 009de9..

 

[Gerry]

James

I see from the Report that you have installed the Windows XP SP3 update.
Did the error first before installing SP3, immediately after installing
SP3 or sometime after installing SP3?

Given that it is occuring on Start Up then you need to look at what
starts when you boot. Try this approach?
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353/en-us

The underling principle on which this method is founded is that you
restrict what loads when you restart your computer adding back one item
at a time until the error occurs. The last item you add back is the
application causing the problem. This approach may not reveal the cause
of the problem as not all start up items are revealed by msconfig. If
this arises there is a further programme which can be used but let's see
if clean booting identifies the problem application.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

The error comes up everytime at startup. It leaves the bar at the
bottom of the screen frozen.----Here is event Viewer info

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 7/5/2008
Time: 11:23:58 AM
User: N/A
Computer: BUTLER
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting
module user32.dll, version 5.1.2600.5512, fault address 0x00009de9.

Snipped - you did not need to post this part of the Event Viewer Report.
I did say complete as otherwise many users do not post the important
part.

 

[James]

The error occured sometime after installing sp3. I downloaded SP3 when it
came out may6??? The error started july4. I will try clean boot to determine
the problem application.

 

[James]

I ran clean boot and the error still occured upon startup. It didn't however
refresh and come back again like it did before after pressing don't send. It
just freeze the freeze screen and I had to restart using the task manager. I
might just go back and undue what i did in clean boot since it didn't work.

 

[Gerry]

James

That is exactly what you should do. Itls the last paragraph in the link
posted earlier, namely:
How to configure Windows XP to start in a "clean boot" state
http://support.microsoft.com/kb/310353/en-us

Does the error occur if you boot to Safe Mode?

The next thing to try is Autoruns: Autoruns lists additional start-up
items to those you have seen in msconfig.

http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

With Autoruns you can uncheck an item, which disables it from starting,
or you can can right click an item and then delete it. If you uncheck
you can recheck to re-enable the item. It is a much safer approach than
editing the Registry. Another useful feature of the programme is that
you can right click an item and select Search Online to get information
about the item selected.

Use Autoruns to disable an item and then reboot the computer to see if
the error occurs. If not renable the item and move to the next item.
I would ignore those items in the Services and Drivers tabs as you
should have covered those using msconfig. Start with those items on the
Logon tab.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Allan]

Please note that his problem is with Windows explorer, not Internet
Explorer. They are two different things.

I know; I was not paying attention to his question. Thanks for the reminder
anyway.

 

[James]

I might try what you said but after running onecare it said I had
virus:Win32/parite.B Could this be what is messing up Explorer? There were
others like W97m/Thus.G but onecare scanner didn't remove them. If so, how
should I remove them?

 

[Laura MS MVP]

Yes it can, that's a PE executable. There are removal instructions here
http://www.sophos.com/support/disinfection/pedis.html#q3 also check for the
presence of this registry key and delete it if found
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PINF]


--
Stalking is a Crime
Stalking charges are serious and
almost every state now has a strict stalking law.

 

[Gerry]

James

Onecare is not a strong player in the anti-malware market. You said you
had Spybot and Norton 2008 earlier. Have you turned these off?

Norton should have handled Win32/parite.B. Here are the removal
instructions
http://www.symantec.com/security_response/writeup.jsp?docid=2003-011708-2030-99&tabid=3
Technical details
http://www.symantec.com/security_response/writeup.jsp?docid=2003-011708-2030-99&tabid=2

Norton should have handled W97m/Thus.G. Here are the removal
instructions
http://www.symantec.com/security_response/writeup.jsp?docid=2001-050111-1930-99&tabid=3
Technical details
http://www.symantec.com/security_response/writeup.jsp?docid=2001-050111-1930-99&tabid=2

You should update definitions for Norton and Spybot and run full scans.
If two have got in others can follow. It may be that Norton has placed
the infected files in the virus vault so look there and remove them. It
could be that Onecare has detected them there.
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Please note that Laura is thought by other Microsoft MS-MVPs not to be
an MS MVP.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
..

 

[James]

Norton and spybot are on. I ran Drweb-cureit and it didn't find parite.b but
other trojandownloaders that I have removed. I'll try safe mode but i don't
think those virus are on my computer anymore. I think it's something else, I
might be wrong.

 

[Allan]

Ken is correct. This is Windows Explorer and not internet explorer-I have
ie7 anyways

I apologize for my unmindfull reply and for not reading your post carefully.
You may have to try a repair install. Either order the Windows XP CD/DVDs
from the manufacturer or restore from the hidden partition if present on
your system.