explorer.exe crashes and restarts

OK here are the symptoms:
Explorer.exe keeps crapping out - simply disappearing and restarting. then after a number of tries, it simply doesn't retry anymore. Going into task manager and running explorer.exe works for ~15 seconds and then it craps out again and starts restarting and crapping out. Event Viewer > Application shows a number of the following entries:
EventID: 1002 Source: Winlogon - The shell stopped unexpectedly and Explorer.exe was restarted.
Very little info provided at the MS support site on this ErrorID.

I had been running Windows XP Pro SP2. So i fugured upgrading to SP3 would overwrite any corrupted system files. And lo and behold the explorer.exe file was in fact updated. But the problem persists. I have an old Win XP Pro SP2 hard drive installed on the machine and tried running that version of explorer and the same thing happens.

This behaviour is the same in safe mode.

So i am at the point where i have ruled out the fact that explorer.exe itself is corrupt, and instead, there is a corrupt registry entry, or some other file missing or corrupt that explorer depends on.

There is no crash information about exlorer cutting out - at least that i can find. are there any good places to look for dump files?

So - any advice or tools would be REALLY appreciated here. i am thinking of running regmon while explorer shuts down to see if i can find anything, but i have a feeling that the amount of information in there will be overwhelming. if anyone has any experience with debugging via regmon (or filemon for that matter), please let me know.

further, in the meantime are there any (free ) shells that i can use until i figure out how to get explorer back? i am desperately trying to avoid an OS reinstall.

thanks in advance,
graham

 

one more thing i should point out is that i created a new user on the system and logging in as them did not solve the problem.

 

ARIE: thanks for your quick reply.

For everyone else, it turned out to be (go figure) malicious code. I detest 3rd party scanners/cleaners and for good reason, this one was well hooked into my system.

Using the AWESOME tool ShellExView i was able to isolate the dlls that were hooked into my explorer. Was not able to delete them in normal windows, so i booted into safe mode, and still no luck. even in command prompt only mode. i also searched my registry for entries that referenced these files and deleted them. Upon reboot, i wasn't totally surprised to find that the entries had been rewritten.

So then i found this: NTFS4DOS Personal which will boot you into DOS with NTFS support - it found my system drive AND my RAIDed drives. from here i was able to successfully delete the dll files.

anyways, that was today's (4.5 hr) adventure. hopefully you all can benefit from this...

thanks, arie!

cheers, gw

UPDATE: note that NTFS4DOS requires a floppy drive (and disk naturally)

 

NTFS4DOS is a very handy tool and can also be burned to a bootable CD for use on systems that have no floppy drive.