Serious problem with Explorer.exe

Please Help!

from WinCustomize Forums
I have got a serious problem with explorer...

Suddenly after restarting my computer (Win XP Pro) taskbar, icons and start menu stopped appearing. Instead appears a explorer window titled "My Documents".

It looks as if explorer is running as a seperate process because "folder" and "drives" icons are not getting skinned even though other icons are. In the task manager runs a single explorer.exe process which corresponds to this "My Document" window. Also if I End Task and restart this explorer.exe the same "My Documents" window appears.

I have not seen any error messages till now. Please help...
6,497 views 12 replies
Reply #1 from WinCustomize Forums Top
Try either safe mode boot, or clean boot Link to see if you have a process (or possible virus) running which is creating the issue - or whether you are looking at something in the OS.

Perhaps post anything that you did prior to the issue, to obtain better help.
Reply #2 from WinCustomize Forums Top

If you had Litestep Installed it'd be a simple solution [at least I know this one]....there's a 'set explorer as shell' shortcut that'd restore it just fine.

Explorer.exe is both the start bar/desktop/etc and the file manager and all you have is the latter....ergo you have no 'shell'.

Try killing the process in Task manager...and restarting it.

Or...

Kill it and reboot...

Offworld Trading Company
Reply #3 from WinCustomize Forums Top
Thanks for the responses

Seting windows in safe mode does not solve the problem. I scanned the system with ZA Antivirus and found one infected file -

Win32.Wintrim.BH - \system32\EGDAACCESS_1058.dll


I do have litestep. Setting shell using setshell.exe does not work. I get the following error in setshell.log -

windows platform: NT
user has administrator priveleges, continuing
SetShell running from: [E:\Utilities\LiteStep\utilities\SetShell.exe]
parameter to SetShell: []
EXPLORER: will attempt to restore default shell (explorer), allowing per-user shell setting (on NT)
ERROR: reading HKLM\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\boot 'shell', exiting
shell settings were not changed


Now, what does that mean?

Also HKCU\Software\Microsoft\Windows NT\Current Version\WinLogon 'shell' gives the value 'explorer.exe'.


I was installing this shell called Calmira XP. When it rebooted, there was no shell on startup. But using setshell.exe worked and brought back explorer. Now just before the last reboot I uninstalled Calmira XP and this problem started
Reply #4 from WinCustomize Forums Top
That's a trojan (and a downloader/installer to boot)...I'd be real surprised if ZA got rid of it. See if you have a sub-folder "wintrim" under the main Windows folder
Reply #5 from WinCustomize Forums Top
ZA did remove that trojan. There is no subfolder named wintrim in windows directory
Reply #6 from WinCustomize Forums Top
I'm a little skeptical of an AV that gets rid of something, yet let it into your system to begin with. You need to find out what it left behind. Why don't you try this trial version http://www.misec.net/trojanhunter/ and see if it comes up with anything. You don't have IconPackager installed, do you?
Reply #7 from WinCustomize Forums Top
I'm a little skeptical of an AV that gets rid of something,


I also am.

I do have IconPackager Demo.
Reply #8 from WinCustomize Forums Top
If the spyware and trojan proggies came up with nothing and you are using IconPackager version 3.xx, then try this and see if unregistering the iprepair.dll fixes it:

Start> Run> type in: regsvr32.exe /u "c:\program files\stardock\object desktop\iconpackager\iprepair.dll"
Reply #9 from WinCustomize Forums Top
Well Yrag thanks for all your replies. I have solved this problem

If you look at comment#3 there is a error -

ERROR: reading HKLM\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\boot 'shell'

Using google I found that there should be a key at that address having value "USR:Software\Microsoft\Windows NT\CurrentVersion\Winlogon". When I corrected that and used setshell.exe to set explorer as shell, problem solved!

So that nasty problem was caused by installing this Calmira XP. Also leave that IP alone
It has endured enough criticism
Reply #10 from WinCustomize Forums Top
Well done...


...ya gotta love that google
Reply #11 from WinCustomize Forums Top
Calmira?...not the Calmira for Win 3x ....?