I have 3 computers in a little LAN and both of them - XP SP2 - started to have the same problem with explorer.exe.
First, the big one (an Opteron on a Tyan board) when I transfer files from/to the second one (an Athlon on an Asus board), then this one too, and in the same conditions, that is, when I go to My Network Places and open the folder shared from the other computer ; the problem is reciprocal now (but first it appeared on the first mentionned computer).
Thus the well known warning window appears with "Explorer.exe encountered an problem, etc." and all windows shut down.
I use now a piece of software called XnView that allows me to do the transfers but I also noticed that the problem occurs now on Athlon alone, when I transfer files to/from my swap disc that I have put in it: explorer.exe encounters the problem and shuts down all windows ...
I thought it was kind of a virus that infected my Linksys router but after I noticed this second problem - inside the second computer alone - I really wonder what could be ... maybe still a virus that affects the transfers between discs/devices, I don't know ...
I did a scan of the second computer (Athlon/Asus) with the last version of Hijackthis, I saved it as a log file but I dont know how to post/attach it; I'll try to copy its content here, maybe somebody could take a look at it:
Logfile of HijackThis v1.99.1
Scan saved at 15:48:07, on 2006-08-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\sstray.exe
F:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
F:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\QuickTime\qttask.exe
F:\WINDOWS\system32\dla\tfswctrl.exe
F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
F:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
F:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
F:\Program Files\Messenger\msmsgs.exe
F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
F:\Program Files\WinTV\Ir.exe
F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
F:\Program Files\Namo\WebBoard\Bin\APMTool.exe
F:\Program Files\Common Files\Sonic Shared\CineTray.exe
F:\Program Files\OpenOffice.org 2.0\program\soffice.exe
F:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
F:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
F:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
F:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
F:\WINDOWS\system32\CTsvcCDA.exe
F:\Program Files\ewido anti-malware\ewidoctrl.exe
F:\Program Files\Common Files\LightScribe\LSSrvc.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\WINDOWS\explorer.exe
F:\Program Files\Mozilla Firefox\firefox.exe
F:\Program Files\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://horoscope.sympatico.msn.ca/Quotidien/Taureau/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - F:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] F:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] F:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SpywareTerminator] "F:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [OrderReminder] F:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [dmwor.exe] F:\WINDOWS\system32\dmwor.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - Startup: OpenOffice.org 2.0.lnk = F:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = F:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = F:\Program Files\WinTV\Ir.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Office10\OSA.EXE
O4 - Global Startup: Namo APM Manager.lnk = F:\Program Files\Namo\WebBoard\Bin\APMTool.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = F:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\Office10\EXCEL.EXE/3000
O9 - Extra button: 50 FREE MP3s! - {686C970F-1D7D-4469-85D1-4B35763B56CC} - http://www.emusic.com?fref=149133 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - F:\Program Files\KillAndClean\KillAndClean.exe (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - F:\Program Files\KillAndClean\KillAndClean.exe (file missing) (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F0ABE07-76AF-43E6-852A-AA4AA669E88A}: NameServer = 85.255.116.166,85.255.112.151
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A5D2456-6243-4D5F-9F0B-C278E4643292}: NameServer = 85.255.116.166,85.255.112.151
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF07D80D-4492-4156-9A65-281C4D5E25CF}: NameServer = 85.255.116.166,85.255.112.151
O17 - HKLM\System\CCS\Services\Tcpip\..\{E8DE2E6E-C48B-45A5-8A6B-46AFAF7622BC}: NameServer = 85.255.116.166,85.255.112.151
O20 - Winlogon Notify: sertgs - sertgs.dll (file missing)
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - F:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - F:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - F:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - F:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - F:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
The third computer, an old Pentium 3 on a Pentium board has no problem, damn it, it has W2K Pro on it ... I use it of downloads, etc.
The second computer was very stable until now ...
The Opteron/Tyan was more sensitive in the past and had to reinstall the OS because of the same type of problem (explorer.exe) a year (or 2) ago ...
Thank you very much
First, the big one (an Opteron on a Tyan board) when I transfer files from/to the second one (an Athlon on an Asus board), then this one too, and in the same conditions, that is, when I go to My Network Places and open the folder shared from the other computer ; the problem is reciprocal now (but first it appeared on the first mentionned computer).
Thus the well known warning window appears with "Explorer.exe encountered an problem, etc." and all windows shut down.
I use now a piece of software called XnView that allows me to do the transfers but I also noticed that the problem occurs now on Athlon alone, when I transfer files to/from my swap disc that I have put in it: explorer.exe encounters the problem and shuts down all windows ...
I thought it was kind of a virus that infected my Linksys router but after I noticed this second problem - inside the second computer alone - I really wonder what could be ... maybe still a virus that affects the transfers between discs/devices, I don't know ...
I did a scan of the second computer (Athlon/Asus) with the last version of Hijackthis, I saved it as a log file but I dont know how to post/attach it; I'll try to copy its content here, maybe somebody could take a look at it:
Logfile of HijackThis v1.99.1
Scan saved at 15:48:07, on 2006-08-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\sstray.exe
F:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
F:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\QuickTime\qttask.exe
F:\WINDOWS\system32\dla\tfswctrl.exe
F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
F:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
F:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
F:\Program Files\Messenger\msmsgs.exe
F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
F:\Program Files\WinTV\Ir.exe
F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
F:\Program Files\Namo\WebBoard\Bin\APMTool.exe
F:\Program Files\Common Files\Sonic Shared\CineTray.exe
F:\Program Files\OpenOffice.org 2.0\program\soffice.exe
F:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
F:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
F:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
F:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
F:\WINDOWS\system32\CTsvcCDA.exe
F:\Program Files\ewido anti-malware\ewidoctrl.exe
F:\Program Files\Common Files\LightScribe\LSSrvc.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\WINDOWS\explorer.exe
F:\Program Files\Mozilla Firefox\firefox.exe
F:\Program Files\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://horoscope.sympatico.msn.ca/Quotidien/Taureau/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - F:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] F:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] F:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] F:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "F:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SpywareTerminator] "F:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [OrderReminder] F:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [dmwor.exe] F:\WINDOWS\system32\dmwor.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - Startup: OpenOffice.org 2.0.lnk = F:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = F:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoStart IR.lnk = F:\Program Files\WinTV\Ir.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Office10\OSA.EXE
O4 - Global Startup: Namo APM Manager.lnk = F:\Program Files\Namo\WebBoard\Bin\APMTool.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = F:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\Office10\EXCEL.EXE/3000
O9 - Extra button: 50 FREE MP3s! - {686C970F-1D7D-4469-85D1-4B35763B56CC} - http://www.emusic.com?fref=149133 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - F:\Program Files\KillAndClean\KillAndClean.exe (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - F:\Program Files\KillAndClean\KillAndClean.exe (file missing) (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F0ABE07-76AF-43E6-852A-AA4AA669E88A}: NameServer = 85.255.116.166,85.255.112.151
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A5D2456-6243-4D5F-9F0B-C278E4643292}: NameServer = 85.255.116.166,85.255.112.151
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF07D80D-4492-4156-9A65-281C4D5E25CF}: NameServer = 85.255.116.166,85.255.112.151
O17 - HKLM\System\CCS\Services\Tcpip\..\{E8DE2E6E-C48B-45A5-8A6B-46AFAF7622BC}: NameServer = 85.255.116.166,85.255.112.151
O20 - Winlogon Notify: sertgs - sertgs.dll (file missing)
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - F:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - F:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - F:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - F:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - F:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
The third computer, an old Pentium 3 on a Pentium board has no problem, damn it, it has W2K Pro on it ... I use it of downloads, etc.
The second computer was very stable until now ...
The Opteron/Tyan was more sensitive in the past and had to reinstall the OS because of the same type of problem (explorer.exe) a year (or 2) ago ...
Thank you very much
