[Nolanite]

Hola. Im new to the forums and im not positive if this is the area im suppose to post tech questions under but if its the wrong spot could an admin just move me to the appropriate spot. Thanks.

Ok, now my problem is that my explorer.exe is not loading at boot up. I have no desktop icons, no start bar, no way to view my computers files, other than Task Manager. ctrl alt dlt works fine and i can run Mozilla and most other programs. However i cant run the Ctrl Panel files or any other system programs. I tried deleteing explorer.exe but it replaced in a few seconds, though ive heard this is a windows function im kind of skeptic of a trojan. I tried running 'msconfig' and restarting with a diagnostic setup to see if it was a running program that was disabling explorer from starting but no luck. I tried safe mode but still no explorer/desktop. All i have is a background image. I ran Ewido, SpyBot, Registry Cleaner, Windows Defender, AVG, and AdAware all under safe mode twice and still nothing.

ANY help would be awesome. Ide really like to get this resolved within the week, without formatting and re loading windows. Oh and also the only forums i could find on anything similiar to this are old, like 05' and none of the solutions worked, so im assuming its a new build of an older virus? Anyways yea i gave as much info as possible on my situation. Any help is appreciated. Thanks

NolaN.

Note: Re installing windows is an option but i cant seem to figure out how, i cant access computer reboot files and the only CDs i can find that came with the comp are drivers not re boot discs. So, im not sure what to do.

 

[OldGrayGary]

Hi Nolanite


I can think of three things you can try (before the going the reinstall route) - 1) using System Restore from the Safe Mode command-prompt only mode
2) trying a Registry tweak
3) trying a run of Windows File Protection
__________
System Restore from the Safe Mode command prompt

Even though you can't reach the 'normal' graphically-rich version of Safe Mode, you might be able to load Safe Mode in the command-line only form.
1) Reboot your computer
2) Start tapping the F8 key as the system is restarting
3) Choose "Safe Mode with Command Prompt"
4) Logon as "Administator", and type the password (or logon as a user with full administrative rights & type that password)
5) From the command prompt, type:
C:> cd \Windows\system32\restore (where C: is the system drive)
6) From the command prompt, type
C:\Windows\system32\restore> rstrui.exe
7) Follow the prompts, choosing a restore point from before the disappearance of the desktop, et al.

__________

Registry Tweak

Another quick-fix attempt would be to try one of Kelley's Korner's Registry tweaks to restore the desktop. You can try the tweak in the right-hand column of row #195, entitled "Restore Desktop Icons & Taskbar". It runs as a script, so here's the instructions to note:
"To use the VBS Files: Download .vbs file and save it to your hard drive (you may want to right click and use Save Target As). Double
click the vbs file. You will be prompted when the script is done."
"NOTE: If your anti-virus software warns you of a 'malicious' script, this is normal if you have "Script Safe" or similar technology enabled. These scripts are not malicious, but they do make changes to the System Registry."

Here's the link to the tweaks page --- http://www.kellys-korner-xp.com/xp_tweaks.htm
__________

Windows File Protection

For this repair to have any chance, you need to have the Windows XP installation files on your hard drive, in a folder/directory where the Windows File Protection program can find them - or you can point to them. Or, you'd need a Windows XP installation Cd that matches your installed version exactly (preferably the disk -if any- that came with it).

From Task Manager, choose "New Task" and "Run" and type
sfc /scannow

If you don't have the file on hard disk, or have a suitable XP CD, don't try this one.
____________

If none of the above work, It's likely time to save your data & start over.

Best of luck!
. . . Gary

[P.S. ... and Welcome to the Tech Support Forums!]

 

[Nolanite]

My oldest system resotore point is 3 days after it started the bugged out stuff. The registry tweakk didnt work. And i dont have a WinXP disk. Any more thoughts?

 

[karanislove]

Try this...
Press Ctrl + Shift + Esc for Task Manager......Go to file > Run New Task > Type Explorer > Press Enter....

 

[Nolanite]

the start bar/desktop flash on for a second then poof again. either something running that ends explorer.exe when it runs or the file is corrupt and cant handle to run more than 1 second. I have went to msconfig and runa diagnostic startup so it only started with system files running but explorer still didnt work! not sure what he prob is lol, been goin for just over a month ive just learned to work with it, however it still is a hassle.

 

[OldGrayGary]

Hi again

Too bad the Registry Tweak didn't work - it usually has fairly decent success.

Go ahead and try Windows File Protection:
If your system has Service Pack 2 on it, it should have somewhat recent versions of system files in the dllcache, and also possibly in the hidden uninstall folder for SP2 --- \Windows\$NtServicePackUninstall$ --- so you can try running it - it shouldn't hurt. If it can't find suitable copies of system files anywhere, and you aren't able to point it to a location for them, you can simply end the process with Task Manager. If you run into this problem, let us know.

What system disks do you have? Restore/Recovery disks from your vendor? Is this a major brand? custom build? home build?
. . . Gary

P.S. .. just saw karan's post - might do = not sure if it would stick after a reboot.

P.S. #2 --- Just saw your latest reply -- check in EventViewer in Administrative Tools (in Control Panel) and see what errors occur in the logs when the desktop vanishes. If you overuse msconfig, you could have some necessary services unavailable. For an XP Services guide, the ElderGeek has one --- http://www.theeldergeek.com/services_guide.htm

 

[karanislove]

Can u privide the list of all the processes running in ur Taskbar??

 

[Nolanite]

No system restore disks, according to people on other forums my comp from Dell should have came with a WinXP disc but i cant seem to find it. I have all the device driver restore discs but no operating system disc. I cant access control panel but i will see if i can run the event viewer. I cant give a hijackthis log cause it downloads in a zipped folder an when i attempt to un zip it the start bar flashes on then off and no extracting happens. As far as when the start bar flashes on then off there are no running programs running on it. A list of all the .exe's running in taskmanager is:

aim6.exe
ALG.EXE
aolsoftware.exe
avgamsvr.exe
avgemc.exe
avgupsvc.exe
CSRSS.EXE
CTFMON.EXE
firefox.exe
iPodService.exe
iTunes.exe
LSASS.EXE
MsMpEng.exe
msnmsgr.exe
MsPMSPSv.exe
nvsvc32.exe
SERVICES.exe
SMSS.EXE
spoolsv.exe
SVCHOST.exe (x5)
System
System Idle Process
TASKMGR.EXE
wdfmgr.exe
WINLOGON.EXE

 

[karanislove]

End Processes
"nvsvc32.exe
MsPMSPSv.exe
msnmsgr.exe
MsMpEng.exe
iTunes.exe
iPodService.exe
avgupsvc.exe
aolsoftware.exe
avgamsvr.exe
avgemc.exe
aim6.exe"

Stop all these processes and add explore.exe after that .....see if that works!

 

[Aturaten]

Try pressing CTRL+ALT+Delete, go to new processes and run "explorer". If that works (probably won't) you may be in the clear.

However, this reminds me of a problem I once encountered before. Go into DOS/command prompt and "dir" your Windows folder. Enter this command "dir explorer.*" If anything other than explorer.exe comes up you may have a problem.

 

[Nolanite]

Karan nah that didnt work. Atu i dont know how to get into command prompt without restarting into safe mode wiht command prompt.

 

[Aturaten]

Ummm, then just try that? You just need to be able to access your drive.

 

[OldGrayGary]

Hi again

I'm still curious to see what EventViewer shows: try starting it from Task Manager. It's Eventvwr.msc --- there should be entries for each time explorer has disappeared = unless you have disabled Event logging. If you have disabled Event logging (the "Event Log Service"), re-enable it, and try the procedure below.

Also see what happens if you go into msconfig again (via Task Manager), and after checking on your Services, let Windows do a normal restart (unless an item is a known malware, leave the boxes checked).

Another thing to check in on: take a good look at exactly what Dell CDs you have - let us know their titles - WinXP might be included in a disk-image of the original factory-fresh drive.
. . . Gary

 

[Nolanite]

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 11/12/2006
Time: 11:18:47 PM
User: N/A
Computer: DREW
Description:
Faulting application EXPLORER.EXE, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x6d6e6666.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 45 58 50 ure EXP
0018: 4c 4f 52 45 52 2e 45 58 LORER.EX
0020: 45 20 36 2e 30 2e 32 39 E 6.0.29
0028: 30 30 2e 32 31 38 30 20 00.2180
0030: 69 6e 20 75 6e 6b 6e 6f in unkno
0038: 77 6e 20 30 2e 30 2e 30 wn 0.0.0
0040: 2e 30 20 61 74 20 6f 66 .0 at of
0048: 66 73 65 74 20 36 64 36 fset 6d6
0050: 65 36 36 36 36 e6666

I only found two errors that were explorer.exe and thats the first one, the second one is 2 days later. I couldnt find any more recent ones even when i try to run explore.exe.

Dell CDs:

Drivers and Utilities 1 of 1. Contents: Device drivers, Diagnostics and utilities, computer documentation.

Applications 1 of 3. Contents: Antivirus software, support software, multimedia software, internet software.

Applications 2 of 3. Contents: For re installing CyberLink PowerDVD 5.3 Software.

Applications 3 of 3. Contents: For re installing Sonic MyDVD 5.3 LE and RecordNow 7.3 LE Software.

Those are all the CDS i have

 

[Nolanite]

Also when it started this stuff i was disabling some stuff in MsConfig like the day before/earlier that day... maybe i didnt reboot right after i made the changes but when i restarted the changes took affect and messed something up. However i have restarted clicking all boxes and services aswell as a diagnostic startup and still no explorer.

On this restart i checked all the boxes. When i checked event viewer right after startup i found some stuff.

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 1/17/2007
Time: 12:24:47 PM
User: DREW\Drew Battaglia
Computer: DREW
Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.



For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 1/17/2007
Time: 12:25:51 PM
User: N/A
Computer: DREW
Description:
The DP1112 service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 1/17/2007
Time: 12:25:55 PM
User: N/A
Computer: DREW
Description:
The Computer Browser service entered the stopped state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


I thought the last one was odd cause it entered the stopped state at start up.
Not sure what it means but i figured ide let yuh know.

 

[OldGrayGary]

Hi again

You probably don't need to worry about the Computer Browser message, it just provided when the service stops (and it simply stops when you don't need it). It's a networking process that helps keep track of things.

The in-use message isn't likely to be a problem either, unless it persists.

That leaves us with the DP1112 service & the explorer errors.

Try searching your computer, searching in all files - including system and hidden files, for anything with *DP1112*.* I haven't seen anything yet that tells exactly where that comes from: and there are a disturbing amount of threads in which it has been found to be infected. The fact that the message you see says that it's missing - may indicate that your antivirus killed some of the pest, but it's left a mess behind. Here are examples of threads that mention an infected DP1112 file --- http://www.computing.net/security/wwwboard/forum/19487.html
http://www.lavasoftsupport.com/lofiversion/index.php/t2329.html
http://www.computing.net/security/wwwboard/forum/19078.html
http://forum.osnn.net/showthread.php?t=83957

As you can see, in some of these threads, either the online Panda scan or SpySweeper finds it either infected, or associated with a rootkit.

Just to rule the possibility of severe infection - try following the procedures & and try posting a HiJackThis log over in the Security forum --- http://www.techsupportforum.com/sec...lease-read-before-posting-hijackthis-log.html

If your system is still under warranty, Dell might send you another XP system disk at a nominal fee. If you are no longer under warranty, they can still send you another system disk at a modest cost (last time I heard it was only around $20 or so). If your system turns out to have a rootkit present, you might want to consider starting over with a clean install.
_______________

However, there might not be an infection present at all - just the mess left behind from one that was caught & (mostly) killed. The Security forum folks are pretty good at figuring if anything is still lying about.

An interesting number of post-infection threads that mention the Explorer.exe - unknown module error that you are seeing -- have been salvagable by creating a new user profile (their errors seem to be related to a corrupt user profile). The article in the following link discusses this --- http://www-new.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_21045337.html --- note that to see the solutions, you have to scroll down quite a ways.

The corrupt profile scenario is hopeful, since it might provide a repair (creating a new profile) that let's you avoid having to completely reinstall. [Of course, you want to make sure you are rootkit-clean first].

Best of luck
. . . Gary

 

[Nolanite]

how do i go about creating a new profile without control panel? when i try to open the control panel run file from windows directory it dosnt do anything.

 

[OldGrayGary]

Hi again

Were you able to boot into Safe Mode with Command Prompt? If so, while logged on as Administrator, from the command prompt type control userpasswords2 and see if the User Accounts dialog box opens. If so, try creating a new account by clicking on add. Then move data from your older username's Documents and Settings folders into the new username's Documents and Settings folders.

If the User applet won't run in that way, try entering that command from the run option in Task Manager in normal mode - assuming you are logged on as a user with administrative rights.

If none of these steps help, it's looking more and more like a reinstallation of some sort is going to be the repair.

Best of luck
. . . Gary

 

[Nolanite]

nah the new account didnt work... still trying to get hold of a winxp CD so i can re install but no luck so far