Windows Explorer has encountered a problem

[JohnrfNZ]

I have a "Windows Explorer has encountered a problem & needs to close" issue that is similar to that covered in the Post by "pvo01 10/10/2008 Windows Explorer Crashed" on my PC. This PC system was newly built & purchased in August this year with XP Home Version 2002 Service Pack 2. It is lightly used mainly for Internet email (Yahoo) & browsing, plus minimal Word/Excel (2007) use. It connects to the same Router used for my Notebook Internet connection. It also has the Hard Disk from a 'prior' system installed as Drive F (ie additional to the main Drive C) - for access to historical data only. I installed AVG 8.0 three weeks ago (run daily), and the Windows XP Firewall is switched on. Don't think any OS updates have been run either.

The main characteristics of this problem are:
- Boots ok, then immediately (without any mouse/keyboard activity) displays the Win Explorer message (AppName: Explorer.exe, ModName: msi.dll).
- Providing I do not click the Send/Don't Send buttons on the message box, the desktop functions normally except: i) Start Menu/All Programs freezes the system, ii) as does using the 'New' option on the context-menu (anywhere it appears),
iii) trying to start Word or Excel (2007) gives an "Explorer.exe Application error" with the notation "Memory ..... could not be read", iv) the Control Panel/Add or Remove Programs option gives a "Run DLL as an App. has encountered...."
message (AppName:Rundll32.exe, ModName:msi.dll).

If I do click the Send/Don't Send buttons, the desktop refreshes, (incl. the Win Explorer message) then freezes, with the Task Bar showing only the Start button, and the Time. The cursor changes to the hour-glass anytime it is placed over the taskbar.

I've followed the 8-Step plan - very helpful thankyou - except for the following:

Step 2. - Only Win XP Firewall in use
Step 5. - SuperAntiSpyware not able to be installed. Gives a "MSIEXEC.exe has encountered a problem ...." message (AppName:msiexec.exe, ModName:msi.dll).
Step 6. - Java not installed on this system.

Nothing was picked up by AVG or Malwarebytes, (nor Hijackthis as best I could see). Note that I have subsequently uninstalled AVG, as the 'Scan file' option in the context-menu was not running a file or folder scan as it should. I had also noticed that spurious (ie non-scheduled) 'AVG Updates' were being run, followed by a "AVG Update requires a Restart" message - which made me somewhat more suspicious about AVG. The only 'non-standard' entry on the context-menu is now the 'Scan Malwarebytes'.

I would very much appreciate your help & advice on where to go from here. I'm wondering if there may be a corruption in the OS somewhere. I haven't run a Windows Repair as yet - still looking for the CD's! Is faulty RAM also a possiblity?

I have not attached the log files as yet, as I figured you would prefer to see these run as a complete set after the SuperAntiSpyware problem is fixed (hopefully).

Thankyou in advance.

 

[JohnrfNZ]

Clarifacation & further information

Correction to end of 1st paragraph. Windows Updates is turned on, with the "Download but don't install" option specified. Despite this, I see from Event Viewer that at 3.00am on Dec 12, 5 x Updates (KB954600/956802/955839/952069
958215) were installed (previously downloaded at 5.18pm Dec 11) & the system restarted. Note that I definitely was not up at that time of the morning to start this install, so am not sure how this occurred. A further set of Updates (same as above plus KB890830) was downloaded at 6.30am on Dec 15, & again at 7.29pm (this time including IE7 for Win/XP) - neither of these updates have been installed.

Event Viewer also shows that at 3.07am (following the update/restart), an Error was recorded "Source: Service Control Manager. Desc: The following boot-start or system-start driver(s) failed to load: AvgLdx86". An Application Error is also shown at 3.07am "Faulting App: Explorer.exe V6.0.2900.2180. Faulting module: msi.dll
V3.0.3790.2180". Note that it was the next morning that the "Windows Explorer has encountered ..." message & associated problems first appeared. The system was working perfectly the previous evening at 9.30pm. The same pair of Errors were recorded each subsequent time the system was rebooted. It appears that the
"AvgLdx86" error ceased about the time I uninstalled AVG, but the "Explorer.exe" Error has continued (with matching Desktop error box) each time the system is restarted.

Is it too much of a coincidence that my problem started immediately after the Windows Update I wonder?

 

[Bobbye]

I'll give you a tip which puts Errors in the event Viewer in a format that is easier to read and work with:

Start> Run> cmd> type in eventvwr

Do this on each the System and the Applications logs:
1. Click to open the log>
2. Look for the Error>
3 .Right click on the Error> Properties>
4. Click on Copy button, top right, below the down arrow
5. Paste here (Ctrl V)

Errors have three parts: The Event ID#, the Source and the description. Taken together, this makes identification and resolution easier: For instance:

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: (1000) May be different
Date: 12/17/2008
Time: 6:05:17 PM
User: You
Computer: Yours
Description: Faulting App: Explorer.exe V6.0.2900.2180. Faulting module: msi.dll
V3.0.3790.2180"

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: (7036) may be different
Date: 12/17/2008
Time: 6:07:54 PM
User: You
Computer: Yours
Description: The following boot-start or system-start driver(s) failed to load: AvgLdx86".

"MSIEXEC.exe has encountered a problem ...." message (AppName:msiexec.exe, ModName:msi.dll).

Msiexec.exe is the Windows Installer Service. It's normally started when you install a new program, and can often be left running afterwards. It may start automatically on reboot in some cases where the installation process has indicated that a reboot was required, or the installation failed to complete successfully.

Complete the information for the Errors above and find the Error that corresponds to these:
(AppName: Explorer.exe, ModName: msi.dll).
"Explorer.exe Application error" with the notation "Memory ..... could not be read", iv)
"Run DLL as an App. has encountered...."
(AppName:Rundll32.exe, ModName:msi.dll).

Copy them as instructed please. Ignore Warnings. You do not need to include the lines of code-if any-in the box below the Description.

Remember the Event Viewer Error has three important parts: The Event ID#, the Source and the Description. Taken together we can look for the resolutions. You have a problem with the Windows Installer- we need to find out what it is.

While we're working on this, please do not install, uninstall, restore or update-with the exception of updates for AVG. And speaking of AVG, since v8 is out, there have been numerous reported problems. Maybe when we work through the Errors, you might think about changing to Avast or Avira- Not now though.

One setting I want you to check is viewing hidden files and folders. If that is checked, it is known to cause unexplained windows Explorer crashes:
Control Panel> Folder Options> View tab> CHECK 'do NOT show hidden files and folders'> Apply> OK.

Also, is this yours on Bleeping computer??

littiot
Dec 16 2008, 03:59 PM
I was referred from the general "Am I Infected?" board, and am trying to remove Vundo. DSS logs:

Some of the Errors are similar.

 

[JohnrfNZ]

Error data as requested.

Thanks for the response & the tip. Details as follows.

1. Event Viewer details.

i) These three Errors were recorded immediately after the 'suspect' Windows Update completed in the early hours of Dec 12.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 12/12/2008
Time: 3:07:07 AM
User: N/A
Computer: USER-3D262E75CB
Description:
Faulting application explorer.exe, version 6.0.2900.2180, faulting module msi.dll, version 3.0.3790.2180, fault address 0x0000373c.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 12/12/2008
Time: 3:07:07 AM
User: N/A
Computer: USER-3D262E75CB
Description:
The following boot-start or system-start driver(s) failed to load:
AvgLdx86.


Event Type: Error
Event Source: ESENT
Event Category: Database Page Cache
Event ID: 474
Date: 12/12/2008
Time: 3:08:04 AM
User: N/A
Computer: USER-3D262E75CB
Description:
wuauclt (1604) The database page read from the file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb" at offset 3637248 (0x0000000000378000) for 4096 (0x00001000) bytes failed verification due to a page checksum mismatch. The expected checksum was 2909278989 (0xad68130d) and the actual checksum was 2909278985 (0xad681309). The read operation will fail with error -1018 (0xfffffc06). If this condition persists then please restore the database from a previous backup.


ii) Desktop 'Windows has encountered a problem ...." message displays after each reboot/restart & when the 'Don't Send/Send' button is clicked.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 12/17/2008
Time: 6:53:15 PM
User: N/A
Computer: USER-3D262E75CB
Description:
Faulting application explorer.exe, version 6.0.2900.3156, faulting module msi.dll, version 3.0.3790.2180, fault address 0x0000373c.

iii) MSIEXEC Error when the SuperAntiSpyware Installer is run. Note that it did not appear until I first attempted to run this on Dec 17.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 12/17/2008
Time: 6:52:33 PM
User: N/A
Computer: USER-3D262E75CB
Description:
Faulting application msiexec.exe, version 3.0.3790.2180, faulting module msi.dll, version 3.0.3790.2180, fault address 0x0000373c.

iv) RUNDLL as an App Error when Control Panel/Add Remove Program option is selected.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 12/16/2008
Time: 12:53:39 PM
User: N/A
Computer: USER-3D262E75CB
Description:
Faulting application rundll32.exe, version 5.1.2600.2180, faulting module msi.dll, version 3.0.3790.2180, fault address 0x0000373c.

v) Errors recorded when opening a Word/Excel file.

Event Type: Error
Event Source: Microsoft Office 12
Event Category: None
Event ID: 1000
Date: 12/14/2008
Time: 3:38:30 PM
User: N/A
Computer: USER-3D262E75CB
Description:
Faulting application excel.exe, version 12.0.4518.1014, stamp 45428263, faulting module msi.dll, version 3.0.3790.2180, stamp 41109722, debug? 0, fault address 0x0000373c.

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 12/21/2008
Time: 11:39:35 AM
User: N/A
Computer: USER-3D262E75CB
Description:
Application popup: explorer.exe - Application Error : The instruction at "0x7d1e373c" referenced memory at "0x00000001". The memory could not be "read".

2. AVG Error recorded each reboot/restart.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 12/16/2008
Time: 12:38:51 PM
User: N/A
Computer: USER-3D262E75CB
Description:
The following boot-start or system-start driver(s) failed to load:
AvgLdx86.

Note that this was the last of these Errors. They ceased after I uninstalled AVG8.
I have not re-installed it as yet, and do not have the PC connected to the Internet.

Q. Should I leave this as is in the meantime or re-install AVG8 (or 7.5 which I previously had running until Nov 17 without any problems)?

3. The Folder Options/View option you mentioned has been 'checked' since I first discovered the problem on Dec 12.

4. Not my post on Bleeping Computer.

I await your further assessment.

Thanks again.

 

[JohnrfNZ]

Hi there & a Happy New Year.

Just wondering if you have had a chance to check my response to your request for Event Mgr details, sent 1 week ago. Thks JohnrfNZ.
----------- Original Post -----------------
Windows Explorer has encountered a problem
I have a "Windows Explorer has encountered a problem & needs to close" issue that is similar to that covered in the Post by "pvo01 10/10/2008 Windows Explorer Crashed" on my PC.

 

[Bobbye]

Sorry John. I didn't get the notice of your reply- happens sometimes.

Q. Should I leave this as is in the meantime or re-install AVG8 (or 7.5 which I previously had running until Nov 17 without any problems)?

No, I would recommend either of the following instead:
Recommended Free Anti Virus:
Avast Free:http://www.avast.com/eng/download-avast-home.html
Avira Free:http://www.free-av.com/en/products/1/avira_antivir_personal__free_antivirus.html

Event Type: Information> ignore these. The system is just logging what was done.

Most of the Errors are related to the msi.dll which is the Windows Installer. It is either corrupt or missing. It is likely that updates, programs and apps aren't installing correctly because of that. Start the resolution by doing this:
1-Download the msi.dll file (711 kb) from the below URL
http://www.dll-files.com/dllindex/dll-files.shtml?msi
2-Save it inside C:\New
3-Restart Computer in Safe mode or Safe mode command prompt
4-Type the following line in the command prompt window
Copy C:\Windows\System32\msi.dll
5-Rename the copied file from "msi.dll" to "msi.bak"
6-Type the following line in the command prompt window
Copy C:\New\msi.dll C:\Windows\System32\
7-Restart the system.

Event Type: Error, Event Source: Microsoft Office 12, Event ID: 1000:
As a precaution, you may (re)install the latest service pack for Microsoft Office but sometimes this type of error may indicate a conflict with another application. If may be that Excel didn't install correctly or it can be an issue with an Office Office plug-in.

See if handling the installer resolves the problem. Do that first, then download and install Avast or Avira. Save it to your desktop.

Boot into Safe Mode. Click on File> Work Offline:
1. Use msconfig to take all AVG processes off of the Startup menu
2. Use Add/Remove Programs to uninstall AVG..Double click on the new AV programs you have saved to the desktop and install (run).

Reboot into Normal Mode. Close nag message and check 'don't show again'> Go back Online and update the new AV.

Let me know your progress when this is completed. You will probably have Windows Update to reinstall after the new installer is onboard.

From a newsgroup post: "Your problem may be a conflict with the Norton Office Plug-in.

 

[JohnrfNZ]

All sorted.

Thanks a million. All seems to be back to 'normal'. Big relief not seeing the Windows Explorer message in my face any longer. Initial problem still with the SAS setup (MSIEXEC.exe - Ordinal not found), but this too disappeared after I ran the Windows Installer 3.1 update. Out of interest, I had considered replacing the msi.dll file myself earlier on, but thought better of it when I noticed the 'new' copy I downloaded was 2.086mb & dated 08/28/2002 cf the existing one of 2.804mb dated 02/28/2006. I'm guessing that was an indication of the file corruption.

Am now running the 8-step Removal Instructions. Are you interested in seeing the 'requested logs' from me?

Still somewhat nervous about installing Service Pack 3 due to reported problems being caused by this. Any thoughts?

Have also installed avast! AVG as suggested. Ran ok without picking up anything untoward. Seems to be a bit light on features (especially lack of Scheduled Updates) & general look & feel compared with AVG 8.0 (Free) which I'd been running previously on this PC - and still do on my Notebook without any problems at all. Any comments?

Thanks again.

 

[Bobbye]

Nice job, John. Go ahead and attach the logs since you're running the programs. I'll check them out to make sure you don't have any 'extras' you didn't ask for!

About AVG: I have seen so many posts about ongoing update problems with AVG that I no longer recommend it. The v8 is nowhere near as smooth as the earlier version.

 

[JohnrfNZ]

Log files as requested

As per my "2 weeks Ago 6.21pm" Post:

Windows (Automatic) Update is turned on, with the "Download but don't install" option specified. Despite this, I see from Event Viewer that at 3.00am on Dec 12, 5 x Updates (KB954600/956802/955839/952069/958215) were installed (previously downloaded at 5.18pm Dec 11) & the system restarted. Note that I definitely was not up at that time of the morning to start this install, so am not sure how this occurred

.
Do you think my reinstall of Windows Update will be enough to prevent a repeat of this 'unauthorised' update installation process being repeated or is there something else I should be checking. I remain highly suspicious that this was the cause of my corrupted msi.dll.

Also ref. my previous post question regarding Service Pack 3.

Thanks.

 

[Bobbye]

John, you have the leanest, cleanest logs I've seen in a month!

You do have a process loading that you might want to disable:
C:\WINDOWS\system32\wuauclt.exe

This is a process managing automatic updates for Microsoft Windows. As far as I know it is controlled by this Service:
Start> Run> services.msc> right click on wuauserv> Properties> Change the startup type to Disabled> Stop the Service.

This information is because you specifically want to turn off the automatic updates.

Go ahead and manually download and install the earlier update that failed: NOTE: Set a System Restore point first. If the update causes a problem, restore just back to that restore point.

 

[JohnrfNZ]

Disabling wuauclt.exe

This is a process managing automatic updates for Microsoft Windows. As far as I know it is controlled by this Service:
Start> Run> services.msc> right click on wuauserv> Properties> Change the startup type to Disabled> Stop the Service.

Not sure if I'm missing something, but I can't see a "wuauserv" entry in the Services (Local) list. The Names are all 'full descriptions' not abbreviations.

Am I in the wrong place?

 

[Bobbye]

John, look for the Automatic Updates Service. Screen shot here:
http://www.mvps.org/marksxp/WindowsXP/wuauto.php

This won't make sense, but when I disable this Service, somehow (impossible, I know) the name changed to 'wuausrv'. I also change the Security Center to Manual and it's name appears as 'wscsrv'.

And to further 'make no sense', I have found a log where the updates are attempted anyway- in the log, all failed!. So maybe it's build in to the OS.
When this happens, I found a corresponding Error in the Event Viewer:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 1/2/2009
Time: 8:54:44 AM
User: NT AUTHORITY\SYSTEM
Computer: LAPTOP2
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service wuauserv with arguments "" in order to run the server:
{E60687F7-01A1-40AA-86AC-DB1CBF673334}

And here is a description of that:
http://support.microsoft.com/kb/896224
This problem occurs if the Automatic Updates service is disabled for the current hardware profile.

The point of all this is that my system isn't looking for updates, MS is accessing my system although I have everything disabled!

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.