explorer.exe flashes will not stay running

Okay.. I am at a complete loss.   I have been searching for a complete answer for weeks and have tried just about everything out there.  My computer boots up to a blank screen with no taskbar or icons.  I can get to task manager and run some programs through there.  I cannot access my internet on this computer either.   The cable connection is fine since I am running a laptop of it.  I have booted into safe mode...but have no taskbar/start menu there either.  I have run explorer.exe from command prompt... it flashes for a second then goes away.  I have run spyware checks, virus scans....nothing.   I do not have any system restore points to fall back on.  I tried a windows xp repair install from my orginal upgrade disk... but it did not work.   I have SP2 on my computer.. not sure if trying to repair from the original disk may have caused further problems.  I have tried Kelly's Korner fixes by downloading them to a thumbdrive and installing them on the broken computer... they ran... but did not fix the problem.   Another interesting note... IE will not open at all... Firefox will open but obviously with no internet connection it is not usable.

Before the problems began I had been tweaking my computer to try to get it to boot up quicker.   Not sure if I may have screwed up something in the registry.  Stupidly I did it without making a boot disk.

Any help would be greatly appreciated.  I don't want to spend a fortune to get this old computer repaired.  I am looking to get a new computer with a faster processor in the next few months but would like to be able to use this one for the time being.  At the very least I want to get all my personal information (pictures, emails) off and loaded to the new one... but that is difficult without windows.
Who is Participating?
rpggamergirlConnect With a Mentor Commented:
>>I already looked for spyware but here is the log in case I am missing something.<<

A clean log is not helping me suggest anything, :).
If you did Fix any bad entries in hijackthis log, can you tell us what they are? just curious. You can find the entries you removed from the backup that hijackthis created.
You've also unchecked some startup entries, can you please tell us what they are?

Can you navigate to this key and tell us what you find listed under "Image File Execution Options" key?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

just wondering if "explorer.exe" and "iexplore.exe" is listed there.

This is a shot in the dark, just in case it is caused by "wininet.dll"
Smitrem will look for your wininet.dll and replaces it if it is corrupted or missing.
Download SmitRem.exe and save the file to the Desktop.
Double click on the file to extract it to it's own folder on the Desktop.

Now, reboot to Safe Mode:

Next, open the SmitRem folder
-Double click the "RunThis.bat" file to start the tool.
-Follow the prompts on screen.
The Desktop and icons disappear and then reappear again --- this is normal.
Wait for the tool to complete and Disk Cleanup to finish --- this may take a while.
When done, the log created by the smitRem tool is located at C:\smitfiles.txt

Restart your computer.

Post the log from the smitRem tool, located at C:\smitfiles.txt.

Well, it appears you have another computer available, since you are using the internet to ask the question.

>At the very least I want to get all my personal information (pictures, emails) off and loaded to the new one... but that is difficult without windows.

Does the computer you're using have a CD burner available?  If so, you could try burning and using a bootable CD with a version of Linux called Knoppix on it:


What is KNOPPIX®?
KNOPPIX is a bootable Live system on CD or DVD, consisting of a representative collection of GNU/Linux software, automatic hardware detection, and support for many graphics cards, sound cards, SCSI and USB devices and other peripherals. KNOPPIX can be used as a productive Linux system for the desktop, educational CD, rescue system, or adapted and used as a platform for commercial software product demos. It is not necessary to install anything on a hard disk. Due to on-the-fly decompression, the CD can have up to 2 GB of executable software installed on it (over 8GB on the DVD "Maxi" edition).

This site has an excellent tutorial on how to recover files using Knoppix:

Computer First Aid Using Knoppix

Have you tried Winsockfix to see if it will restore your internet connection?

Cloud Class® Course: Microsoft Office 2010

This course will introduce you to the interfaces and features of Microsoft Office 2010 Word, Excel, PowerPoint, Outlook, and Access. You will learn about the features that are shared between all products in the Office suite, as well as the new features that are product specific.

Mohammed HamadaSenior IT ConsultantCommented:
First you must delete the XP background to make sure that it has no bad effect on the file explorer.exe

Then you must extract a new copy of explorer.exe to windows\directory.

After doing the above, Use the SFC command to repair any bad system files.
Goto taskmanager --> file --> new task(run) Type sfc /scannow and enter, see the link below for more information.


If you couldn't locate the background your desktop, you can use the registry hack to change it at least to a different one..

1. Goto Tasmanager--> run ->  type regedit > and click OK.
2. Navigate to the following registry key: HKEY_USERS\DEFAULT\Control Panel\Desktop
3. In the details pane (right-side), double-click the Wallpaper string value item.
4. In Value data , type the path and name of the picture or background, and then click OK
IMPORTANT: Make sure that you specify the path correctly to the Background.

Restart now.. and check

the next restart goto msconfig, --> services tab and make sure that most of the windows services are running and not stoped, if they are disabled then try enabling all of them. and restart again.

hope this helps.
Mohammed HamadaSenior IT ConsultantCommented:
Mohammed HamadaSenior IT ConsultantCommented:
I would suggest:

(1) Follow LeeTutor's suggestion for backing up your data.

(2) Reinstall XP on your damaged system by installing into a new folder (e.g. c:\win rather than c:\windows). This should get your system working again, plus give you access to your files, but you will have to reinstall all applications.

In any case try to backup your files first to guard against losing anything important. Another possible boot CD for this purpose: http://www.ubcd4win.com/
photogmattAuthor Commented:
thanks for the help so far.  I did a winsock fix... internet worked for a minute or so.  Then got real slow... before finally quitting again.  I downloaded ubcd4win.... I see it will take me several hours to decipher the instructions on creating a cd.  I am thinking about just seeing if I can save the pictures and music and emails to a thumbdrive and just putting them on my laptop for now.  I am not sure I want to transfer any of this operating system mess to another hard drive.  I am worried about doing a reinstall under another folder... my c drive is not real big...4gb  I have a 40gd F drive... but it is not set as a boot drive.  I was looking at the plugins in the program and was trying to determine if any could diagnose the issue.  I am really hoping to find a fix for the system before resorting to trashing the whole thing.

I know the background image is not the issue... because the problem exists on any profile within XP and in safe mode.   Tried the scannow.... it ran but did not do anything.  I did run hijack this.  I already looked for spyware but here is the log in case I am missing something.

Logfile of HijackThis v1.99.0
Scan saved at 2:03:58 PM, on 6/3/2006
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
F:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
F:\Program Files\Norton AntiVirus\navapsvc.exe
F:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - F:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - F:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SysAgent] C:\SysAgent\SysAgent.exe
O4 - HKLM\..\Run: [SmcService] F:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WinFoxV2] C:\WINDOWS\system32\WF2K.EXE Initial
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [SRFirstRun] rundll32 srclient.dll,CreateFirstRunRp
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /firstlogon
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136133724656
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0727.dll
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - F:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service - Symantec Corporation - F:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rio MSC Manager - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
O23 - Service: Symantec AVScan - Symantec Corporation - F:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Sygate Personal Firewall - Sygate Technologies, Inc. - F:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thanks again for the help so far

I posted your HJT log at http://www.hijackthis.de/ and the saved analysis is here:

At first glance it shows nothing bad.

If you have less than 500 MB free space on the C: drive then you should not install XP in a new folder.
Mohammed HamadaSenior IT ConsultantCommented:
I'm also suspecting a free space issue here as r-k has commented, You might want to free up to 1 giga at least, try to uninstall programs from C drive and reinstall them to F drive..
photogmattAuthor Commented:
THANK YOU, THANK YOU, THANK YOU rpgamergirl.  I guess it should have been an obvious solution to go back and check the hijackthis backups.  In searching I found a second hijackthis program on my harddrive that I must have used the last time I ran it.

I found that I deleted "Norton Antivirus Shell Extension Module" by Symantec.  Definately should not have been deleted.... could have been an accident.  I restored that... and bingo the desktop returned on next bootup.

I ran the smitfiles program before that... but I have a feeling the problem was that Norton file... since it was deleted at the time this all started.

Thanks to everyone for the help.. but I have to give the points to rpggamergirl.

It's amazing how just by fixing a legit hijackthis entry can mess up a system, especially with Norton that is.

Glad to hear your problem is solved, You did a great job running hijackthis from it's own folder and backup were still intact.
Some people run hijackthis from the temp folder(where backups are not safe) or worse running it from a .zip or .rar(where no backups are created)

Thank you very much for your generousity of giving me the points, :)

Best wishes!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.