Windows Explorer crashes... cannot run PC [FIXED]

[Karlsweldt]

AVG has finally connected to the update server (after much fiddling with settings), and is updating, apparently for the first time in twelve months.

That is a bad omen. If AVG was the primary antivirus and firewall "patrol", then some virus or other malware could have gained access. Executable files are the primary targets of a virus.
From your description of how the Explorer is acting, it sounds like your version was hacked.. with an almost-identical looking one, but has a nasty trait where you cannot access desired files/folders or other features. Could also be a Registry error. Certain other files are associated with the Explorer feature for proper operation, from the dynamic link library.
There should be two identical copies of explorer.exe on your install. One in the parent folder for Windows, and another in the SP3 folder, i386. Trust more that the original in the i386 folder is authentic.. and copy it over the one in the main Windows folder (overwrite). Hope that is the fix.
There are several good Registry repair programs.. try one and do a scan first, post results here if not proficient with Registry editing. Improper editing of the Registry can hose the entire system!
Hijack This is a good program to bring out the good and bad of a system. But do only a scan first, and post results here. www.hijackthis.com

[Tommy in Scotland]

OK Karlsweldt, I'll need to copy the Explorer.exe file using the Hiren's Boot Disc Mini Windows XP. I'm also concerned about the viruses that AVG cannot remove. Apart from these ones called "IRP Hook" (affecting the disk.sys file), the system now seems to be clean of viruses.

EDIT: On browsing the I386 folder of Windows, I do not see a file named explorer.exe, but I do see a cab archive called explorer.ex_. I also notice that the explorer.exe file in Windows is still dated 13th June 2007, so it cannot be a replacement created by the virus, unless the date has been hacked.

Is it acceptable to copy the explorer.exe from the Windows folder of another XP system? That would be easily done through the network and I could use the Boot Disc Mini XP to copy it into Windows. Should I also replace disk.sys?

[Karlsweldt]

That exploer.ex_ file on the OS install disk is compressed. But SP3 created a sub-folder in the parent Windows folder, ServicePackFiles. The i386 sub-folder in it has the file as normal size. Its only attribute is 'archived', so should be found.
Whenever doing a sanitizing of an OS, best to first disable the 'restore' feature. Then restart in 'safe' mode, where most viral types are inactive or easily routed. Only after two or more 'normal' restarts, then reactivate the 'restore' feature. Otherwise, Windows will faithfully undo your efforts!
Microsoft does have a "malicious software removal tool" known as KB890830. Free download, run it in full- system scan.
Still available for Win XP for a few more months.
http://www.microsoft.com/en-us/download ... tails.aspx
The proper date of the SP3 updated file should be 04/13/2008. 1,033,718 bytes in size.
If another identical OS install is known-good, then it should pose no problem if copying certain files from one to another. But some files are created expressly for the installed system.
The proper disk.sys file can also be found in that SP3 sub-folder.
The reason certain suspect files cannot be removed or isolated is that they are in use, and in protected mode. The only way to replace certain files is by slaving the drive in another system.. and do the editing there. Would be a positive way to scan and cleanse the system!

[Tommy in Scotland]

NB I have edited this post due to ongoing experimentation.

OK I've disabled restore, copied the later versions of explorer.exe and disk.sys files using mini-XP, then booted back into Windows in safe mode. Windows Explorer still crashes with the same message.

I have returned from work and can spend some time working on this now. I have downloaded the Malicious software remover from Microsoft, which I dowloaded to the Desktop as that's the only place I can access on the computer. It is now doing a full scan of the system. A lot now depends on this scan, because replacing explorer.exe and the infected disk.sys did not solve the problem. I am wondering what may be the root cause.

Also, as the explorer file was dated 2007, it looks like the computer needs a big update session.

[Karlsweldt]

Is the system now stable enough to run command-prompt mode? If so, then do the system file check again.. but don't add the "exe" to the command line. sfc /scannow is the proper parsing (note space between sfc and /).
Here is a link on how to effectively use the command, and its arguments.. http://www.microsoft.com/resources/docu ... x?mfr=true

[Tommy in Scotland]

NB I have edited this post due to ongoing experimentation.

I left the KB malicious software remover overnight, and it found nothing.

I ran sfc /scannow in cmd. It loaded the sfc scan, the blue line crept to the end, and then the scan box vanished. No prompt to put the Windows CD in, no messages, no further results or developments. So sfc has failed to provide an answer.

The computer seems to operate OK in most ways, I just cannot access the file system with any file browser. Applications will run. AVG will run to a schedule and provide detailed results. Firefox will run and access the Internet. The computer looks OK and seems to be running OK. I just can't open any file browser, or I instantly get "Windows Explorer has experienced a problem and needs to close", then the desktop reloads. This error box never mentions the option of sending any error report.

I can't help feeling that the problem must be very small, I just haven't hit it yet. It's like a puzzle with a tiny piece missing. It's so frustrating. I wonder if it could be a registry error or a damaged or missing dll? If so, how would I find it?

Another small matter... when I got the computer, it had one user account (apart from Administrator), which was called simply "us". I renamed it "Tommy". However when I run cmd it comes up as "C:\Documents and Settings\us>". I'm now wondering, could there be a user account conflict? If so, could it cause the failure of Windows Explorer?

An AVG scan has flagged up an IRP hook virus in the file PCIIDEX.SYS (in the Windows\System32\Drivers directory). Is it OK to replace that file with one from another computer?

With that sorted, all malware and viruses will have been removed from the computer.

I have now had the error "Microsoft (R) HTML Application host has encountered a problem and needs to close". On the Microsoft site I found the ansswer "To resolve this problem, click Start, click Run, type regsvr32 mshtml.dll, and then click OK two times." I did that, but the error has persisted and I have a suspicion the two errors may be linked.

[Karlsweldt]

That PCIIDEX.SYS is a motherboard driver for the PCI bus feature. Might be the wrong one for the chipset controller.
Use the one provided from the original motherboard driver disk. The Microsoft site may have an updated version.
Use the Task Manager to check how many times that explorer.exe is active. Should be only one. If more, there still is a conflict with some program.. or a virus that is in stealth mode. If there is no desired explorer interaction, the OS may start another process but the previous one may not close completely.
Are the files and folders shared properly on this system? Check 'advanced' sharing properties.
As to viewing all files and folders on the setup, Windows is very restrictive unless you choose to "show all files", even system and hidden files.
But a program known as Total Commander from www.ghisler.com/ can be configured to show any and all files on a system, if proper sharing is in effect. Not expensive to purchase. Best file manager available!

[Tommy in Scotland]

NB I have edited this post due to ongoing experimentation.

If the motherboard driver CD was ever supplied with the computer it has been lost to the winds of time.

I looked at Task Manager, and Explorer.exe only exists once under Processes.

Unfortunately I can't check folder sharing as I can't browse folders.

Whil using the "users" section in Control Panel, I have now had the error "Microsoft (R) HTML Application host has encountered a problem and needs to close". On the Microsoft site I found the answer "To resolve this problem, click Start, click Run, type regsvr32 mshtml.dll, and then click OK two times." I did that, but the error has persisted. I have a suspicion the two errors may be linked.

[Tommy in Scotland]

OK since my above post I have installed Windows XP Service Pack 3, which installed without any issue. The system is now fully up to date. But... I still get that error on opening any file browser! I cannot browse any folders or drives (except by booting to the mini-XP on the boot DVD), and I still get the error "Microsoft (R) HTML Application host has encountered a problem and needs to close" when attempting to change my picture in the "users" part of Control Panel. "regsvr32 mshtml.dll" did not help. Could there be a lingering registry issue? Is it worth the risk of running a registry cleaner?

I am baffled by this problem. It seems such a small error yet I don't know where it is occurring so I don't know where and how to fix it.

[Tommy in Scotland]

Well, I hope I'm not being overly optimistic here, but it appears I've fixed it!

Yes! You read that correctly!

I was looking at a list of disc/file system testing software on the site "nonags.com", and my attention was drawn to the entry about "Aurionix FileUsage", which I had installed on the rogue computer (before it became a rogue computer). I suddenly thought... if Aurionix is meant to blend in with Windows Explorer (to give extra columns with extra file info) then I can easily see how it could cause a conflict. I know it shouldn't, but I thought, anything that attaches to Windows Explorer is a likely culprit if Windows Explorer fails.

So I have left my previous posts up, as an indicator of the trials and errors that can occur with computer repairs!

Thank you for all your helpful advice. None of it has been wasted. I have updated my AVG and all Windows system files and I feel that the computer has benefitted from our combined efforts.