Explorer.exe error log (Win 2K Prof)

Afternoon all

I have 5 children who all use "MY" computer but of course all of them are denying knowledge but..................... I am getting an error message for explorer.exe when I try and access the "Start" menu, "My Computer" and other Windows based programs from the desktop. I can't get 'into' Control Panel or Settings or access either of my hard drives or the 2 cd drives or floppy drive. The message reads.... "explorer.exe has generated errors and will be closed by Windows You will need to restart the program. An error log is being created ". When I hit ok the screen goes all blue (desktop icons disappear) and then comes back to normal. I am assuming (probably incorrectly) that files have been deleted from Windows by one of the little darlings. Can I do a repair reinstall from the Bios screen and if I do will I lose all the other programs that have been installed. I've tried to copy / move all major programs to the "D" drive but of course can't access any of the drives.

Many thanks

Gaynor

 

Gaynor

This could be many things.

Are you able to get on the internet from this computer or are you on another computer?

Here are a couple of steps that might help! These are cleanups so will help even if not fix.

Try to get to "safe mode ". Reboot hit F8 while the progress bar is going accross the bottom.

1. If you can get to safe mode see if everything system works here that don't work in full mode. Internet will not work here and the Video will be very basic. Refrain from trying to fix or reinstall things yet. If everything works from here we are halfway home.

2. Configure CleanMgr to max settings
Go to Start-Run and type

cleanmgr /sageset:1
The above need only be ran once (these settings will be remembered as the default until another sageset is ran).

It will present a menu select all except compress, then

Go to Start-Run and type

cleanmgr /sagerun:1
As long as /sageset above has been ran on this computer from now on the /sagerun is the only thing that needs to run.

3. Reboot

If you can get on internet now let me know I will direct you to some downloads that will help!

Mike

 

Mike

I can access the Internet (about the only thing I can do). I'm able to get very basic access to all the other drives and programs thru Microsoft Word by going to "open" and then "open with" (bit long winded but when you're desperate anything goes).

Should I still do what you suggested with the sagerun thing or do you want me to try the downloads?

Gaynor

 

Do the proceedures I directed and let me know if you have full access in safe mode.

And also if things are different when you boot back to full!

While you are doing this i will prepare the d/l list.

Mike

 

More than likely you have 2 possible problems.

So d/l and install and run the below.

1. Spyware and adware removal

SpyBot http://security.kolla.de/index.php?lang=en&page=download
Run this twice delete all it finds, "ALWAYS" run this before AdAware.
Leave all it wants to leave after the second run.

AdAware 6.0 http://www.lavasoft.com
Run only after SpyBot!
Make sure to configure to Max settings, all files and compressed files. Delete all it finds

BHO Demon http://www.definitivesolutions.com/bhodemon.htm
A BHO is like a autostart/startup that only runs when you run the Browser.
This program runs stand alone no install is required post me the items it finds other than the below. Normal entries here would be Acro….. (Acrobat Reader) or Nav…. (Norton Anti virus).

2. Registry and System cleaners

RegCleaner http://www.vtoy.fi/jv16/shtml/regcleaner.shtml
Look in first 2 cols for programs you thought you uninstalled or removed, these are the dregs left by the uninstaller. Also tag and remove any that you are POSITIVE are not supposed to be on your computer. If you are not sure about an item leave it. After removing these go to the top Tools-Registry Cleanup-Do them all. Delete all it finds.

RegScrubXP http://home.carolina.rr.com/lexunfreeware/RegScrubXP/RegScrubXP.htm
NOTE: W2K and XP only
Select RegScrub finds problems and remove all it finds.

2. Finally clean and control autostart/startup programs

3. Startup control
http://www.mlin.net/StartupCPL.shtml

This gives simple and full control of what starts at boot up. After install there will be a Startup icon in control panel. Why this over Msconfig? Msconfig only allows unchecking/disabling of items.

Startup Control panel allows deleting items or moving from startup to run as a service etc.

http://www.spywareinfo.com/~merijn/files/startuplist.zip

StartupList does nothing but grab all Autoload (startups) and puts them in a Wordpad file so that you can then copy it and paste it back to us in a message so that we can advise on a problem here.

Hope this is not too much print it so you can follow it. Some complain that I overwhelm (give to much info). I only see it as a few simple steps. And it saves both you and me time.

Mike

 

Mike

Booted into Safe mode. Same things not working that weren't working in Normal mode. Tried to do the Cleanmgr.sageset:1 but received an error message saying that the file couldn't be found so I've rebooted back to Normal mode and will now run thru your list of downloads. Fingers crossed............

Gaynor

 

Gaynor

The link for AdAware is bad use this instead.

http://www.majorgeeks.com/showfiles.php?cat=31

Mike

 

Mike

These are the results of the BHO Demon:

1. C:\Program Files\Yahoo!\Companion\ycomp5_0_2_6.dll
2. d:\Reader\ActiveX\AcroIEHelper.ocx
3. C:\Program Files\MediaLoads Enhanced\ME1.DLL

I've left them as enabled for now.

Gaynor

 

In BHODemon click details and disable:

C:\Program Files\Yahoo!\Companion\ycomp5_0_2_6.dll

C:\Program Files\MediaLoads Enhanced\ME1.DLL

For now, can be reenabled later.

Where are you in the steps now?

Any more results?

Mike

 

Mike

I'm just doing the RegScrub now. Got rid of 151 files in the Registry Cleanup part of RegCleaner.

121 files in regScrub being fixed then I'm onto the Startup Control part.

Gaynor

 

10-4 standing by!

Mike

 

Mike

Guess what. All done and we're back in action.

I've quickly gone thru and hidden all the vulnerable files that little fingers may delete by mistake (no more cries of "but mum it wasn't me ")

Thank you so much for your help and PATIENCE.

Now you can have a peaceful Sunday........

Thanks again.

Gaynor

 

Great!

Print this thread and at the first sign of trouble go thru this proceedure again.

You can reenable the stuff in BHODemon again if you want (you may not want or need these 2 items any way). If not delete them.

You will probably find that not only is the immediate problems fixed but that the computer is running better than before!

Mike

Wasn't to much info and was not hard was it?

Here is a few more things you can look at when you have the time.

Cleaning startups
http://www.pacs-portal.co.uk/startup_pages/startup_full.htm http://jeh.ne.client2.attbi.com/TechSupport/index.htm http://www.3feetunder.com/krick/startup/list.html http://www.answersthatwork.com/Tasklist_pages/tasklist.htm http://ww2.whidbey.net/djdenham/Uncheck.htm http://www.pcisys.net/~ravnos2/techinfo/MSConfig.htm http://www.forrestandassociates.co.uk/pcforrest/startups.html http://www.djbdesigns.com/wtvzone/startup.ht

Diagnostics

http://www.webattack.com/get/xpantispy.shtml
Select everything except these 4 items.
1. Don’t show balloon tips
2. Enable fast shutdown
3. Increase MaxConnectionsPerServer to 10
4. Disable Task Scheduler service
After the first reboot after you run XPAntiSpy go back to XpAntiSpy and uncheck the clear Pagefile at shutdown, as we only want to clear it once

 

Mike

I think I (well you actually) have located the problem. I downloaded the msconfig.exe file from techadvice.com (as Win2K doesn't have the msconfig file) and I've found four files in the startup menu with vbs extensions (is this the Love Letter worm?). They are as follows:-

1. LINUX32 - C:\WINNT\SYSTEM32\LINUX32.vbs
2. MSKERNEL32 - C:\WINNT\SYSTEM32\MSKernel32.vbs
3. reload - C:\WINNT\reload.vbs
4. Win32DLL - C:\WINNT\Win32DLL.vbs

Should I just disable them from starting up or do I need to get rid of them from the system somehow (I wasn't quite sure if the original files still existed and the vbs extensions are copies or whether they have been taken over by the vbs files) - sorry does that make sense?

Gaynor

 

Uh oh we have more work to do!

Download the following 2 files install but do not run them ( will be run from safe mode)

Special Virus cleaners

Stinger http://vil.nai.com/vil/stinger/
PQremove http://www.webmasterfree.com/software/2911.html

These are the Delta force for only the newest and most prolific viruses today.
Use these if it is possible that a virus may have disabled your regular scanner.
For a quick clean, and then if they find and clean anything do a full deep scan with a full-fledged scanner.
If you suspect a virus has disabled your regular scanner you should do 3 things

1. Download STINGER and PQREMOVE and run them. NOTE: always download them do not run an older one that you have had; these 2 are updated almost daily.

2. Do an online dedicated Trojan/worm scan and online regular virus scan.

3. If your virus scanner was up to date, and "IF" either 1 or 2 above finds a virus then it is possible that your virus scanner has been disabled. You should completely uninstall and reinstall your virus scanner update it and run it in full mode with max settings.

Reboot to safe mode

Disable thes files in Msconfig

Search for these files on HD and delete

MSKernel32.vbs
reload.vbs
Win32DLL

then run Stinger
then pqremove

reboot

Run 1 or both of the following

http://www.bitdefender.com/scan/licence.php

http://housecall.antivirus.com

Mike