How to fix this error "The shell stopped unexpectedly and Explorer.exe was restarted"?

Immediately any user logs onto my PC (even new users) explorer starts to restart every 5 seconds with the error below:

Event Type:      Information
Event Source:      Winlogon
Event Category:      None
Event ID:      1002
Date:            26/04/2006
Time:            08:24:34
User:            N/A
Computer:      CLABERT2
Description:
The shell stopped unexpectedly and Explorer.exe was restarted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

I have checked the event logs and there were some errors relating to the IMAPI.exe service but with that disabled the error still occurs.  It seemed to occur on the odd occasion before yesterday but then in the afternoon (not following any particular install) it started failing continually.  The only minor change I can think of was removing internet explorer from the quick start area on the task bar.

I have searched for solutions on this site and across the web and I have tried the following:

1) Replace explorer.exe with a new copy from install CD (I replaced the dllcache copy as well to prevent the original coming back)
2) Replace explorer.exe with a working copy from another PC
3) Uninstall any recently installed software
4) Virus scan entire machine
5) Spyware scan entire machine (used Steganos anti-spyware 2006 and AdAware)

If anyone has any suggestions that result in a fix I would be grateful as I really don't want to rebuild from scratch.

Thanks!
tudorrAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

venom96737Commented:
imapi.exe is a part of the Microsoft Windows operating system, more specifically the Image Mastering Applications Programming Interface, which is used for CD recording. This program is important for the stable and secure running of your computer and should not be terminated.
probably in your burning program you have installed or the burner drivers.
JonveeCommented:
> The shell stopped unexpectedly and Explorer.exe was restarted <

If you take a look at this forum and study the last commenty by FKlassen 2005-06-28, 9:14 pm, you'll see reference to "most likely a new Bagle variant"!
http://www.mcse.ms/archive71-2005-6-1700676.html

If it's "Trojan.Tooso.J"as suggested, see this link for help:
http://www.symantec.com/avcenter/venc/data/trojan.tooso.j.html
JonveeCommented:
Have put some 'highlights' in the previous url to assist you:
http://66.249.93.104/search?q=cache:b9nL9H6xC3AJ:www.mcse.ms/archive71-2005-6-1700676.html+The+shell+stopped+unexpectedly+and+Explorer.exe+was+restarted+windows+xp&hl=en&gl=uk&ct=clnk&cd=5

You may initially like to try this online Trojan scanner "a-squared Free", which is specialized in Trojans & Dialers removal:
http://www.emsisoft.com/en/software/free/
Active Protection takes the fight to cryptojacking

While there were several headline-grabbing ransomware attacks during in 2017, another big threat started appearing at the same time that didn’t get the same coverage – illicit cryptomining.

tudorrAuthor Commented:
Thanks for the comments - it appears that the problem was related to ISS BlackIce PC protection (my firewall and intrusion detection software).  I used MSCONFIG to stop various things loading and was able to remove / reproduce the error by adding / removing the services.  The strange thing is that I simply emptied the firewall logs and restarted and now all is fine - bizare!
JonveeCommented:
Thanks for the update, it could help others.    
As you appear to have answered the question yourself you may wish to retrieve your points. Check this link under the heading "Closing Questions":
http://www.experts-exchange.com/help.jsp#hi70

Then ask for a refund with reference to thread Q_21827735  posting a 0 points question here >
http://www.experts-exchange.com/Community_Support/                Thanks.
JonveeCommented:
GranMod,
No objections, PAQ-ing the question and refunding 500 points is fine.
GranModCommented:
Closed, 500 points refunded.
GranMod
The Experts Exchange
Community Support Moderator of all Ages

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
tudorrAuthor Commented:
Thanks.

I should add that further investigation revealed that the Application Protection component of the software had decided that explorer.exe was a problem as below:

04/27/2006 09:41:24.296 [ 1792]: Notification: explorer.exe (C:\WINDOWS\explorer.exe) has been terminated because it is a privacy violation

It was simply closing down what it thought was a problem application.  That information was contained in RAPPAPP.LOG but as there are so many log files I didn't manage to check it earlier!

Hopefully if someone else experiences this they can check the log first.....

In order to fix, I had to re-baseline the system as follows:

Right click the shield in the System Tray and select Stop BlackICE Application Protection. A red slash may appear over the shield. Now, find the Actlcl (may or may not exist) and Checksum .txt files in the BlackICE folder which are within the ISS folder. Delete them and then baseline.

Cheers.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.