windows registry problem?

I can see the windows explorer file (explorer.exe) in my windows folder but it will not run. When I try to launch it I get an error that says windows cannot find file...... even though spelling and path are correct.

Is this a registry problem?

 

Can't "Click on Start->Run and type: Explorer and click ok. " My windows GUI is not running. No desktop, no task bar, no start button, no sys tray etc.... My wallpaper displays and nothing else.

I can launch some applications (word, excel, netscape etc...) by using the "new task (run)" under file menu in windows task manager, but certain files like explorer.exe and the like produce an error message telling me that windows can not find the file even though I can see the file when I "browse" from the "new task (run)" action.

Because the file is there..... and I get an error message that windows can't find it.... I was wondering if that is indicative of a registry type problem.

Thanks,
~Bob

 

This is what evokes the error message that says windows can not find explorer.exe.

History is actually spelled out pretty well in a seperate thread called "windows xp interface dead ".

Machine worked well for 3+ years. Dell with windows xp home pre-installed. No recent hardware/software changes. McAffee antivirus prompted the deletion of a bunch of files that were supposedly infected with a trojan. Deleted files, machine (windows) broke. I can still use the machine but the rest of the family is dead in the water unless I am there to start the applications for them.

No.

~Bob

 

How do you do a repair install?

I have a set of disks that came with my Dell. One of them is labeled Operating System. I poked around a little with that disk and found that I had two options.....

1) windows xp upgrade
2) windows xp full install

I tried the upgrade option but it would not run. Dialogue box told me that the version of windows on the disk was older than the version on my PC and did not offer me an option to continue. My guess is that the upgrade is intended to be used to upgrade from 95, 98 or nt and may not work from xp to xp.

I've shyed away from the full install, for now. I don't want to lose all of my files and settings (for 5 users) if it can be avoided.

I ran SFC the other day. It took a while to run (~5 to 10 minutes) and there was a progress bar displayed that showed it was running. I was never prompted to insert any source disks so I assumed that everything it needed was in the dllcache folder on my hardrive.

I don't know if it found any bad or missing files or if it replaced any. Someone said something about checking event logs but I don't know how to do that.

That (SFC) did not fix my problem. Symptoms remain unchanged.

~Bob

 

http://support.microsoft.com/default.aspx?scid=kb;en-us;315341

Also from MSFT:

At this point, it seems your only choices other than a format.

Good Luck

Martin

 

Windows GUI is dead.
Explorer and Iexplore are corrupt.

I am doing everything in dos mode from the cmd prompt..... or
launching applications manually using <ctrl><alt><del> to get to task manager and using the File menu Run cmd.

I want to run the AVERT Stinger to detect and clean any potential trojans that may have started this mess. I'm running Windows XP Home and I will need to disable the "Restore" feature of XP.

Can I disable Windows XP Restore using the recovery console?
Can I disable Windows XP Restore using a dos cmd at the cmd prompt?

~Bob

 

The only good reason to disable System Restore is to get windows to clear out or delete all files present in the C:\Recycler folder. This would make sure there is not a trojan or any other virus there that could be accidently 'restored'.

From martin121's post:
• Disable disables a Windows system service or driver. The variable service_or_driver is the name of the service or driver that you want to disable. When you use this command to disable a service, the command displays the service's original startup type before it changes the type to SERVICE_DISABLED. Note the original startup type so that you can use the enable command to restart the service.
However, I wouldn't do this, it would be a waste of time, your windows OS is not functioning.

See above.
Or • Rd (Rmdir) operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources. It removes a folder in other words, or these commands.
attrib -r -s -h c:\recycler
rmdir /s c:\recycler.
I have never used the commands myself, but should delete all your restore points, almost the same as disabling SR, and nothing should be there if successful. It is the subfolders attached to it that may give an error.
I believe your Explorer.Exe is corrupted, and this file is a big part of windows. You cannot find files on the drive with Explorer.Exe corrupted, as it does the finding. Something in the registry would not affect this, as an OS does not need to look in the registry, it would look at the File Allocation Table on the hard drive.
I would recommend doing a Full Install or better a clean install. The upgrade failed because you probably installed SP2, and your CD is SP1a or earlier.

 

Thanks for reply.

"Full" install -vs- "clean" install?

and yes, I did install sp2.....

 

Full install should do an overlay install, leaving your documents and installed programs on the drive, and anything else there.
Clean install you would format the drive, or wipe it clean first. There would nothing installed or present on the drive before windows is installed.

 

so far, the answer to every question I've asked about this problem has ended up at "Re-Install Windows ".

I am trying really hard to find a way to avoid that.

There are 5 family members who share this machine. Unfortunately, because I live at work, no one is playing system administrator. There are no backups. Everyone has used their own naming conventions and directory tree structure. Some have used "My Documents ", some have not. Finding everyone's data files would be hard enough if explorer was running, but it's not. Several of us will pay dearly in the form of irreplaceable data if I have to re-install windows, unless I spend many hours searching manually and moving files to CD.

While searching through some information at <http://vil.nai.com/vil/stinger/> it seemed there might be some value in running the stinger program to remove (detect/repair) trojans because I believe it was a trojan that originally caused this.

There is additional info at <http://vil.nai.com/vil/content/v_133002.htm> that describes the following with regard to the "BackDoor-cqy" virus....

The action above talks about manually restoring some registry keys back to the correct ImagePath for "svc host.exe ". This led me believe that explorer may not be corrupt but that the trojan may be acting as host and could be cleaned.

I have already updated my ScanEngine and DAT files for my AV (no effect).

I was thinking about trying to Run stinger and perform the manual registry edit described above.

In order to run stinger on XP, the site says you must disable "Restore ".

Given the information outlined above, is it worth a shot???

~Bob

 

From a PM:Didn't see your reply about the full install. I was busy trying to get my (lengthy) reply sent.

I went to the installation wizard on my XP disk and only saw two options.... What I believe to be what you called a clean install (wipes everything - data lost - bad - bad - bad) and the upgrade install which failed as you noted earlier because of sp2.

Is there another way to get to the "overlay install "?

MS designed the CD to work only that way, but I believe it only deletes the C:\Windows folder and subfolders, leaving other folders intact. The 'C:\Program Files' and 'C:\Documents and Settings' (where your My Documents are) are not attached to the Windows folder.
I believe someone else will chime in on this. I have the Upgrade installation CD of XP SP1a, and may not work like yours.

You can forget about editing the registry, as windows is not operating, and Regedit.Exe is not part of the Recovery Console. This is something that is built in NT based OS's, partly for security reasons.
If it was, it would involve exporting the Key to a REG file, editing the file, and then importing the file back into the registry. Then there is the cross referencing you have to do to be sure you have the correct Key. ControlSet001 may not be the one for you, and CurrentControlSet typically does not exist when windows is not operating.

 

rschm I thnk it would be a good idea for you to consider performing a "Parallel Install" wherein you install a second copy of XP into a different (named) folder on the same partition. That will allow you to gain access to Windows and either make repairs to the other system or perform a backup. All of your existing data will stay intact.

Frankly, I think you'll end up having to do a clean install but at least this parallel one will allow you to get the data backed up.

Full step by step instructions for a Parallel Install