Funny auto close and start of Explorer over and over

[Vigilante]

This is weird. So I'm cleaning up a PC and removing some nasties when suddenly Explorer starts this looping thing, in safe mode AND normal mode.

Basically explorer opens, stays on for a few seconds, then shuts down, then opens, then closes, then opens, then closes, then repeats.
So you sit here and watch as the icons and start bar disapear and reappear over and over non-stop.

If you have Task Manager open, you can see each time before explorer closes, dwwin and/or drwatson shows up, then explorer AND those close, then explorer comes back, followed by dwwin which literal turns into drwatson and then they both shut down, and repeats. When I say "turns into" you can see dwwin.exe, and then it just becomes drwatson in the same line.

I've closed every process I can, used autoruns to check startups and the usual set of malware tools. I managed to run a SFC on it as well, but no good. Explorer won't stay open, in normal or safe mode.

There is no error message or popup, so I can't tell what is crashing. No other processes appear but those.
And I can't check error logs, use control panel or add/rem programs or check files in my computer, all those open explorer, and then it starts again.

If I'm fast enough, and manage to shut down explorer BEFORE drwatson gets to it, then it'll stay closed, and I can run some apps and CMD etc.. but nothing that runs explorer. And again, this happens in safe mode, so it can't really be a normal startup or even a driver.

My issue is, what the heck!!? And how can I perhaps see what is crashing? Does drwatson do any good at all? Is there some log I can read from command prompt that will shed some light?

I got some tricky problems these days, lol

thx for any advice

 

[kirock]

Can you open regedit and delete Dr Watson there? Is the Doctor opening because of an Explorer error or is Dr Watson running a muck and killing Exlporer?

Might need to do Windows reinstall, that sounds like a pretty big problem.

 

[Vigilante]

Drwatson is the bug handling dude built into Windows. It is only supposed to run to analyze a crashing program, perhaps create the error report, or something to that effect. Explorer must be crashing first, and that's why drwatson opens to do the bug report.

However this did seem to happen after I found wininet.dll to be infected with Troj.WininetHook.A and oleext.dll infected with memscan.troj.small.ad. Since wininet.dll is a system file, I replaced it. But oleext.dll I don't think is one, so I just deleted it.
I'm going to try replacing those files again, to be sure. Cause explorer wasn't doing this before the virus scan, and there was only 7 infections, but only these seemed like system files. Hard to say.

 

[Vigilante]

This seemed to have fixed itself after SFC, some DLL re-registering, and a few reboots. Very odd indeed.

So this is done.

 

[kirock]

"and there was only 7 infections, but only these seemed like system files."

hmm, I take it this is not your personal PC? Only 7, you're lucky it wasn't 8 ! :haha: I just used SFC a few days ago and now it seems to take forever to shut down. Sometimes I wish I could install a few drivers which would overwrite the whole XP Pro OS system folder.

 

[Vigilante]

7 infections is very few from what I normally see, I think our record from housecall is some 25,000+ infections on one PC.
Record number of adware found by adaware is somewhere in the 15,000+ range.

I bet most people average 5 to 20 infections without even knowing, even WITH their AV installed.

And no it wasn't my PC, I keep my infections to a minimum