XP Windows Explorer corrupt after auto update?

[jstluise]

DELL E1505 Notebook-
I don't know what is going on here, hopefully someone has an answer (and solution).

So I just had an automatic update which required me to restart my system (dialog box came up saying it was going to restart...with the countdown). I let the system restart and apply the updates. When the system restarted everything seemed normal (startup sounds, background loaded) but then Windows explorer didn't come up...So I just have a screen with my background and that is it. Checked the task manager (ctrl+alt+del) and all my other startup processes are running.

I tried starting a new task and running C:\WINDOWS\explorer.exe, but it comes up and says that Windows cannot find the file!

So right now I had to go in manually and start my wireless card program, connect to the internet, and then start Internet Explorer to get on the forum for some help. Any ideas?! I thought I would try my XP disc to try and repair windows.

------A side note
This happened to me before! About a month ago this exact same thing happened. I ran tests on my HDD (Samsung HM120JI) and found it to be faulty (which I suspected because it was making noises). So I figured it was my hard drive causing the problem. I don't remember if there was an update when this problem happened last time...

I replaced the HDD (with a Hitachi 7K320). This current problem came up and it has only been a month since the replacement. Up until now everything has been smooth and no signs of problems whatsoever.

Help Please! Very frustrating

 

[kimsland]

Download and run this tool: http://www.dougknox.com/xp/utils/XP_FixLogon.zip
This utility checks for the correct GINA value in the Registry and will allow you to restore it, if its incorrect.
If it makes any changes, just restart normally.

It sounds more like Virus\Malware issue. Have a look at:
UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions

 

[jstluise]

Thanks for the response. I ran the program and all it said was "Default Gina in use. DLL in use: MSGINA.DLL (standard)" The only option was to push Exit, couldn't push repair. So...I guess that checks out?

I am very careful with Virus and spyware protection. I am running Bitdefender 2008 but I'm not going to say this makes me invincible...I know there is always a chance. But I'm extra careful and don't download stuff that I don't know about. I went over a year off my last format without any problems until this problem occurred on my last harddrive...suspecting it was the HDD I replaced it, but now it seems it wasn't the HDD (even though it was bad). But for this to happen again within a month on a completely different setup had me confused.

Any other ideas?

I tried running my XP disc and hitting R to repair. The screen comes up and asks what I want to repair "1. C:\Windows"....I type 1 and hit enter. Type in my password, enter. Then it just comes up with the command prompt "C:\Windows\". What do I do from there? Shouldn't it repair it automatically? I've never had to to it before.

I'll try the link for virus/malware that you suggested.

 

[kimsland]

This is how to Repair Windows XP:

Microsoft's Windows XP Professional Repair Install step by step
http://www.windowsxpprofessional.windowsreinstall.com/installxpcdrepair/part3.htm

Microsoft's Windows XP Home Repair Install step by step
http://www.windowsxphome.windowsreinstall.com/installxpcdrepair/part3.htm

 

[jstluise]

Well, figured out how to perform the repair...went through everything an didn't help. Still boots up to the background w/o windows explorer.

Oh, I did receive a couple errors during the repair:
"ngen.exe - Entry Point Not Found: procedure entry point GetRequestedRuntimeVersion could not be located in the dynamic link library mscoree.dll"

-and-

".NET framework initialization error: C:\windows\microsoft.net\framework\v.2.0.50727\mscorwks.dll could not be found"

I don't know if they mean anything...


I still have the 8 steps to do for the virus/malware, but I'm not feeling too hopeful.

I can reformat the system and start from scratch...I won't be loosing anything, well except time. What a pain to get everything back on and the way I like it. If I can't get anything to work I may resort to that pretty quick...I have a lot of work to do (ah what is a college kid to do without a computer?!). Technically I can still use the computer from the task manager but it kind of slows productivity down...

But then I still wonder...if it happened to me twice already, will this problem occur again? It would be nice to know what caused it.

Thanks kimsland for all the help...I really appreciate it

 

[mflynn]

I think you may be surprised so...
Do the TechSpot 8 steps: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

In the SAS part do this before the actual scan.
Update then run SuperAntiSpyware

Then Click Preferences
then click Repairs

Then counting down from top do the following entries

Numbers 6, 8, 11, 12, 13, 15,18, 19, 20, 21, 22, 24, 25, 26 and 27!

From here finish the 8 steps.

Mike

 

[jstluise]

Thanks Mike, I'll give it a go

 

[jstluise]

Yahtzee! It worked! Forgive me for having doubts

I ran the CCleaner followed by MBAM...MBAM found the problem. I attached the log. Looks like a hijacking.

I'm still going to run the rest of the tests, but at least I have my computer back!

There is probably no way of knowing of how it happened (is there?) but is Bitdefender a good program for defending this? Is there anything else I should think about getting?

Thank all!

Finished the SAS and Hijackthis steps.

Just a note: the link to download Hijackthis doesn't seem to work. It leads you to the download of a files "downloadget.php"...which I couldn't do anything with. I found the current version of Hijackthis off a web search.

Thanks again for all the help...all seems to be working fine now.

 

[kimsland]

From Post #2

It sounds more like Virus\Malware issue. Have a look at:
UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions

Scan with Malwarebytes found:
Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Explorer.exe (Security.Hijack) -> Quarantined and deleted successfully.

:grinthumb

 

[mflynn]

OK I like to actually see clean logs.

There may be more to clean so..

UPDATE both MBAM and SAS and scan again Quick Scans don't forget to select the Tracking cookies in SAS!

Then do the below...

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.
=========================================
Download ComboFix

NOTE: If you have had ComboFix more than a few days old delete and re-download.

Get it here: https://www.techspot.com/downloads/5587-combofix.html
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

Install Recovery Console if connected to the Internet!

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.

Mike