Windows Explorer (explorer.exe)

[Guest]

Running XP SP2 on Dell 8400 - Pentium 4, 2gb RAM, 60gb HD memory avail.

Upon startup or reboot, 45 to 56 copies of Windows Explorer open with all
different folders. Programs in Startup do not load, such as Solitare, Zone
Alarm (free), etc.

2 1/2 hours with Dell at all levels resulted in "We give up"

I have searched for multiple copies of explorer.exe, searched msconfig,
loaded new version of BIOS, and used Registry Mechanic.

Help!?

 

[Newbie Coder]

Stuart,

Something has Hijacked your system startup. Does sound like malware as its
disabled Zone Alarm...

There is no easy way for you to repair but other users will say do a system
restore which I don't believe in

You can download this application totally FREE:

http://www.microsoft.com/technet/sysinternals/utilities/autoruns.mspx

Look at the logon tab & see if there is a link to Explorer in there. If so,
remove it. Do you see Zone Alarm listed but unticked? If so, tick it

Next, has explorer been added to Winlogon (see Winlogon tab)? Should be just
things like Crypto DLL's etc in there. If you see an explorer in there
untick it

Download & install totally FREE Spybot Search & Destroy from here:

http://www.spybot.info/en/mirrors/index.html

Install, update & scan. It won't be totally successful running on defaults,
but delete anything that shows up in red, as this will be found to be nasty.
Advanced mode is better & then you'll get rid of most bad items if you know
what you are looking for.

HijackThis is another FREE, useful but not perfect utility. It can be
downloaded from the developers site here:

http://www.spywareinfo.com/~merijn/programs.php

You have to know what you are looking for in order to use it though

Post back when you have finished the above & give some more info.

Please don't copy/paste the Spybot/HijackThis logs here as many people will
start throwing their toys around. If you use Outlook Express you can always
add it as an attachment to your reply or use free webspace & paste the
contents there & add the link to your reply.

 

[Malke]

Running XP SP2 on Dell 8400 - Pentium 4, 2gb RAM, 60gb HD memory avail.

Upon startup or reboot, 45 to 56 copies of Windows Explorer open with all
different folders. Programs in Startup do not load, such as Solitare, Zone
Alarm (free), etc.

2 1/2 hours with Dell at all levels resulted in "We give up"

I have searched for multiple copies of explorer.exe, searched msconfig,
loaded new version of BIOS, and used Registry Mechanic.

Help!?

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with either Sysclean or Multi_AV, plus AVG Anti-Spyware
(formerly Ewido - http://www.ewido.net/en/) and follow instructions to
do all scans in Safe Mode.

When all else fails, run HijackThis and post your log in one of the
specialty forums listed at the link above (not here, please).

Standard caveat: If the procedures look too complex - and there is no
shame in admitting this isn't your cup of tea - take the machine to a
professional computer repair shop (not your local version of
BigStoreUSA). Please be aware that not all local shops are skilled at
removing malware and even if they are, your computer may be so infested
that Windows will need to be clean-installed. Have all your data backed
up before you take the machine into a shop.


Malke

 

[Guest]

Thanks for your response.

As my wife uses this PC for school work, it takes awhile to get through all
the "testing"

Unfortunately, none of the suggestions have solved the problem.

I ran Autoruns, and HijackThis in both regular boot and Safe mode. There is
nothing in the Logon field in Autoruns and nothing in red for HijackThis. The
HijackThis log is lengthy so I did not include it here.

I ran AVG in both modes and nothing was found.

I use both Ad-Aware and Spybot regularly. I ran both last night in both boot
modes. Just the usual stuff was found.

By the way, I did try Sys Restore early on and it was, as you said, useless.

One clarification, I have several programs that load on Startup besides Zone
Alarm - answers.exe, AVG, solitaire - currently, none of those load.

After I clear out the multiple copies of Windows Explorer, all of those
programs can be loaded manually. In fact, everything works at that point.
However, when I load Outlook it comes up in a reduced size where previously
it came up full screen.

Also, in the past, I did a search for explorer.exe on the hard drive and
only found it in Windows along with "EXPLORER" (a shell?).

I searched the Registry and did not find multiple copies.

Is there is anyway this could be a Registry problem?

Again, thanks for your help,

 

[Malke]

Thanks for your response.

As my wife uses this PC for school work, it takes awhile to get through all
the "testing"

Unfortunately, none of the suggestions have solved the problem.

I ran Autoruns, and HijackThis in both regular boot and Safe mode. There is
nothing in the Logon field in Autoruns and nothing in red for HijackThis. The
HijackThis log is lengthy so I did not include it here.

I ran AVG in both modes and nothing was found.

I use both Ad-Aware and Spybot regularly. I ran both last night in both boot
modes. Just the usual stuff was found.

By the way, I did try Sys Restore early on and it was, as you said, useless.

One clarification, I have several programs that load on Startup besides Zone
Alarm - answers.exe, AVG, solitaire - currently, none of those load.

After I clear out the multiple copies of Windows Explorer, all of those
programs can be loaded manually. In fact, everything works at that point.
However, when I load Outlook it comes up in a reduced size where previously
it came up full screen.

Also, in the past, I did a search for explorer.exe on the hard drive and
only found it in Windows along with "EXPLORER" (a shell?).

I searched the Registry and did not find multiple copies.

Wow, this is a different one. At least you know the machine is clean. I
wonder if this is a similar situation to when My Documents or a Dell
folder opens on startup. I'll give you links to fixes for those things
and you can see if anything on your setup looks similar.

http://www.kellys-korner-xp.com/xp_tweaks.htm - My Documents Folder
Opens Upon Boot (for C:\) line:255;right

http://windowsxp.mvps.org/dellfolder.htm - from MVP Ramesh

I'm not saying the above will solve your issue, just that maybe you have
something similar going on although to have so many windows opening and
then to not have regular startup items working...

Here's another thought - create another user profile and see if the
behavior occurs there. If it doesn't, then migrate your wife's account
(or the account where you're having problems) to the new one.

HOW TO Create and Configure User Accounts in Windows XP -
http://support.microsoft.com/default.aspx?scid=kb;en-us;279783

What is the general history of this machine. Do we have an answer to The
First Question Of Troubleshooting: what changed between the time things
worked and the time they didn't?


Malke