Exploere.exe restarts

Have you checked your memory?  Try this freebie from Microsoft:

Windows Memory Diagnostic
http://oca.microsoft.com/en/windiag.asp

The Windows Memory Diagnostic tests the Random Access Memory (RAM) on your computer for errors. The diagnostic includes a comprehensive set of memory tests. If you are experiencing problems while running Windows, you can use the diagnostic to determine whether the problems are caused by failing hardware, such as RAM or the memory system of your motherboard. Windows Memory Diagnostic is designed to be easy and fast. On most configurations, you can download the diagnostic, read the documentation, run the test and complete the first test pass in less than 30 minutes.

Yes. I failed to mention that I have checked memory with this exact utility, and the disk drives from the manufacturers cd.

Thanks

UPDATE
---------------------------------------------
I just went to go into My Documents on the desktop and the Visual C++ error is up, and here is what it said.

Microsoft Visual C++ Runtime Library
Runtime Error!
Program: C:\Windows\Explorer.EXE

This application has requested the runtime to terminate it in an unusual way.
Please contact the application's support team for more information.

----------------------------------------------

mld4165

I found this site, which seems to say it is a problem with McAfee:

http://www.programwitch.com/main.asp?xP=BlogLink&xM=1&xY=1584

Do you use McAfee Security Center or SpamKiller?

If not, as a general diagnostic step, check whether it happens in safe mode also.  If not, it is probably a device driver or a startup program.  You can then disable these with MSCONFIG:  click on the Start button, choose Run, type in MSCONFIG (doesn't need to be all capitals), click OK.  Choose the Startup tab, deselect programs to run at startup by removing the check mark.   In Windows XP, just click on the button for Disable All. Reboot and see if the problem goes away.  If it does then re-enable the startup programs one (or a few) at a time, reboot, and when the problem occurs again, there is your culprit.

In Windows XP: If the problem continues to come up with all startup programs disabled, then it is probably a driver or service.  You can click on the Services tab in MSCONFIG, click on the button for Hide All Microsoft Services, leaving only third-party services displayed, then try turning them off in the same way you did for startup programs.  Finally, if third-party services are eliminated from being the cause of the problem, you could try narrowing down on Microsoft services in the same way.

>>Do you use McAfee Security Center or SpamKiller?

I do not use either. I will check in Safe Mode.

thanks
mld4165

1. Could not get it to do it in safe mode.

2. Turned off all start up items, and after a few minutes it bombed out.

3. Turned off third party services and it worked for a few minutes and then bombed out.

4. Using another computer here that is the same as this one, I verified the drives appear to be the same.

unless you have something else i'm now i'm backing up the data and writing down all configurations to reload the computer?

mld4165

Hmmm.  It doesn't bomb in safe mode.  Maybe try comparing what MS services are running between safe mode and normal mode, then in normal mode turn off those services which don't run in safe mode.

it just happened again, but it put three items in the event viewer.

please look and see if any of these help:

from Event viewer:
------------------------------------------------------
System:
Type: Information
Source: Application popup
Category: None
Event: 26
User N/A
Computer: Mine

Application popup: explorer.exe - Application Error : The instruction at "0x76eb1d8f" referenced memory at "0x00000000". The memory could not be "written".

---------------------------------------------------------
Application:
Type: Erorr
Source: Application Error
Category: (100)
Event: 1000
User: N/A
Computer: Mine

Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.
--------------------------------------------------------------
Application:
Type: Information
Source: Winlogon
Category: None
Event: 1002
User: N/A
Computer: Mine

The shell stopped unexpectedly and Explorer.exe was restarted.
------------------------------------------------------

Not much there, but maybe somene may see something I don't?

thanks
mld4165

Try re-registering the shell.dll

Goto Start --> Run --> type regsvr32 /u shell.dll
Then again type regsvr32 shell.dll

Check this thread also, you could have the same problem which is turned to be some local setting corrupted files..

https://www.experts-exchange.com/questions/21860198/My-Computer-My-Docs-causes-explorer-exe-100-cpu-usage.html

moh10ly

when I try your suggestion I get the following:

RegSvr32
"shell.dll" is not an executable file and no registration helper is registered for this file type.

am I missing something?

thanks
mld4164

Sorry Mld4165, My fault..

The file name should be shell32.dll not shell.dll ..

If the above didn't do it, the Goto www.hijackthis.de and download it to your C:\ drive then extract the files to c:\HJT

Run hijackthis, click on scan then copy the log and post it the the box in the website above, click Analyze and then post the saved link of the analyze here, You can remove the nasty entries or fix them..  Then restart and check again..

Goto Start --> Run --> type sfc /scannow and enter, Insert your windows XP CD and wait till the box disappears, restart your computer and check if the problem persists..

Uninstall all toolbars, (ie, google, yahoo ..etc) they also might affect explorer.exe

Download and run MS VB 6.0 from the below link..
http://support.microsoft.com/kb/q192461/

Restart again and check..

moh10ly

here is the link to the log:
*** link removed by LeeTutor, Page Editor, at the request of the questioner ***

i have checked it thoroughly and all flagged items are actually OK.

mld4165

You have those 2 files at startup ? can you check and fix them ??

O4 - Startup: pingall1.vbs       
O4 - Startup: pingall_lex_ap.vbs

Also goto Start --> Run --> type Msconfig and enter
goto Startup items and disable all, then restart your computer and check..!

good luck

these monitor my servers, other network items, and sends me a text message when a problem occurs.

pc is getting better.

mld4165

Can you move them to another location or directory ?? from where they are..

Also did you run the VB 6.0 from the posted link above..!?

>>Can you move them to another location or directory ?? from where they are..

done and disabled.

Also did you run the VB 6.0 from the posted link above..!?

done and rebooted.

i also logged on with the admin account and renamed my desktop directory, rebooted and let windows recreate the desktop for the user matt.

mld4165

Check this,,,,, Could be related..
https://www.experts-exchange.com/questions/21419300/Microsoft-Visual-C-Runtime-Library-explorer-exe-error.html

Check these links also...

http://www.colba.net/~hlebo49/errexplo.htm
http://www.colba.net/~hlebo49/messages.htm
http://www.generation.net/~hleboeuf/homhenri.htm

ok as of today 6-12-06 I have not had a problem, but I have quite a bit of services and software turned off.
-------------------------
>>Goto Start --> Run --> type sfc /scannow and enter, Insert your windows XP CD

Done. No problems found.
--------------------------

I will bring them back slowly and will keep the thread updated.

things I restarted:
Symantec Antivirus and updater
My vbscripts, but they launch from Scheduled tasks

mld4165

Will Be waiting :)

Hello mld4165, I just got into an answear which might work this time... hope so

The problem in registry where Start Menu usually points to the below path by default..!
"HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Explorer/User Shell Folders\%USERPROFILE%\Start Menu"

Check this also, it has a different suggestions.
http://eventid.net/display.asp?eventid=1002&eventno=826&source=Winlogon&phase=1

Update on the first crash of the week

I went to search for a file on the computer.

Start -> Search -> For Files and Folders

entered a search term and wham.

---------------------------------------------
Microsoft Visual C++ Runtime Library
Runtime Error!
Program: C:\Windows\Explorer.EXE

This application has requested the runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
---------------------------------------------

I click ok and explorer restarts and from the event viewer we get:

---------------------------------------------
Application:
Type: Information
Source: Winlogon
Category: None
Event: 1002
User: N/A
Computer: Mine

The shell stopped unexpectedly and Explorer.exe was restarted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
---------------------------------------------

mld4165

moh10ly

=============================================
The problem in registry where Start Menu usually points to the below path by default..!
"HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Explorer/User Shell Folders\%USERPROFILE%\Start Menu"
=============================================

Do I need to change this?

=============================================
Check this also, it has a different suggestions.
http://eventid.net/display.asp?eventid=1002&eventno=826&source=Winlogon&phase=1
=============================================

I went here but not sure about anything... Links require payment.... Am I missing soemthing?

thanks
mld4165

You don't need to change it, just make sure the path is exactly on all of the following reg names

Navigate to following Reg key
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

On the right pane, Check the value data of each reg name as follows..

Value Name
AppData

Value Data:
%USERPROFILE%\Application Data

Value Name
Cache

Value Data:
%USERPROFILE%\Local Settings\Temporary Internet Files


Value Name
Cookies

Value Data:
%USERPROFILE%\Cookies

Value Name
Desktop

Value Data:
%USERPROFILE%\Desktop

Value Name:
Favorites

Value Data:
%USERPROFILE%\Favorites

Value Name
History

Value Data:
%USERPROFILE%\Local Settings\History

Value Name
Local AppData

Value Data:
%USERPROFILE%\Local Settings\Application Data

Value Name
Local Settings

Value Data:
%USERPROFILE%\Local Settings

Value Name
My Pictures

Value Data:
%USERPROFILE%\My Documents\My Pictures

Value Name:
NetHood

Value Data:
%USERPROFILE%\NetHood

Value Name:
Personal

Value Data:
%USERPROFILE%\My Documents

Value Name:
PrintHood

Value Data:
%USERPROFILE%\PrintHood

Value Name:
Programs

Value Data:
%USERPROFILE%\Start Menu\Programs

Value Name:
SendTo

Value Data:
%USERPROFILE%\SendTo

Value Name:
Start Menu

Value Data:
%USERPROFILE%\Start Menu

Value Name:
Startup

Value Data:
%USERPROFILE%\Start Menu\Programs\Startup

Value Name:
Templates

Value Data:
%USERPROFILE%\Templates
------------------------------------------------------------------

I hope i didn't miss a thing, After you make sure all the values are existed and not changed. close the Registry editor..
Now check if the explorer will work?

If not then give me the list of the programs you have on your Add/remove utility, or you can copy the content of the program files directory if you can't write them here one by one..

Use the following command to do so.

Goto Start --> run --> type cmd and enter

type cd\ and enter
cd program files and enter
dir /a >c:\dir.txt
Type exit and enter

Goto Start again --> run --> type notepad c:\dir.txt and post your Directory here.

BTW: You might have the same issue as the following..
https://www.experts-exchange.com/questions/21873481/explorer-exe-flashes-will-not-stay-running.html

>>You don't need to change it, just make sure the path is exactly on all of the following reg names

they match

===============================================

Volume in drive C is Local Disk
Volume Serial Number is 441B-5AE6

Directory of C:\Program Files

06/13/2006  11:02 AM    <DIR>          .
06/13/2006  11:02 AM    <DIR>          ..
06/07/2006  01:54 PM    <DIR>          3Com Access Point Manager
12/23/2005  10:40 AM    <DIR>          Adobe
12/22/2005  06:10 PM    <DIR>          Ahead
06/07/2006  08:59 AM    <DIR>          Common Files
12/22/2005  05:48 PM    <DIR>          ComPlus Applications
05/16/2006  08:13 AM    <DIR>          Copernic Desktop Search
12/23/2005  09:25 AM    <DIR>          Creative
06/06/2006  11:12 AM    <DIR>          Crimson Editor
05/31/2006  11:24 AM    <DIR>          Funk Software
12/22/2005  06:06 PM    <DIR>          Gateway
12/29/2005  04:43 PM    <DIR>          GIMP-2.0
12/23/2005  09:48 AM    <DIR>          HighMAT CD Writing Wizard
04/27/2006  04:33 PM    <DIR>          Inkscape
03/29/2006  06:14 PM    <DIR>          InstallShield Installation Information
12/22/2005  06:06 PM    <DIR>          Intel
03/28/2006  05:14 PM    <DIR>          Internet Access Monitor
04/28/2006  03:37 PM    <DIR>          Internet Explorer
03/23/2006  11:02 AM    <DIR>          Java
03/23/2006  11:02 AM    <DIR>          Java Web Start
04/28/2006  03:35 PM    <DIR>          Messenger
02/14/2006  05:04 PM    <DIR>          Microsoft AntiSpyware
02/08/2006  06:27 PM    <DIR>          microsoft frontpage
05/11/2006  05:05 PM    <DIR>          Microsoft Office
03/21/2006  05:00 PM    <DIR>          Microsoft Visual Studio
12/22/2005  05:49 PM    <DIR>          Movie Maker
06/13/2006  02:41 PM    <DIR>          Mozilla Firefox
02/08/2006  11:27 AM    <DIR>          mozilla.org
12/22/2005  05:48 PM    <DIR>          MSN
12/22/2005  05:48 PM    <DIR>          MSN Gaming Zone
12/22/2005  05:49 PM    <DIR>          NetMeeting
04/27/2006  04:16 PM    <DIR>          Nvu
12/22/2005  05:48 PM    <DIR>          Online Services
03/17/2006  09:32 AM    <DIR>          OpenOffice.org 2.0
04/28/2006  03:37 PM    <DIR>          Outlook Express
01/05/2006  03:04 PM    <DIR>          Putty
03/30/2006  11:16 AM    <DIR>          QuickTime
04/26/2006  02:34 PM    <DIR>          RegistryFix
06/09/2006  11:40 AM    <DIR>          ShellExView
04/02/2006  08:00 PM    <DIR>          Spybot - Search & Destroy
06/09/2006  03:11 PM    <DIR>          SpywareBlaster
06/05/2006  09:05 AM    <DIR>          Symantec
06/13/2006  02:13 PM    <DIR>          Symantec AntiVirus
01/24/2006  12:42 PM    <DIR>          TightVNC
01/24/2006  12:02 PM    <DIR>          Trend Micro
12/23/2005  04:00 PM    <DIR>          TUGZip
12/22/2005  05:54 PM    <DIR>          Uninstall Information
06/07/2006  08:59 AM    <DIR>          VMware
12/23/2005  09:49 AM    <DIR>          Windows Media Connect 2
05/17/2006  01:18 PM    <DIR>          Windows Media Player
12/22/2005  05:48 PM    <DIR>          Windows NT
01/04/2006  10:08 AM    <DIR>          Windows Resource Kits
12/22/2005  05:50 PM    <DIR>          WindowsUpdate
12/23/2005  01:14 PM    <DIR>          WinSCP3
03/22/2006  02:00 PM    <DIR>          WinTask
03/06/2006  09:56 AM    <DIR>          WordPerfect Office X3
12/22/2005  05:51 PM    <DIR>          xerox
05/11/2006  10:41 AM    <DIR>          Yahoo!
               0 File(s)              0 bytes
              60 Dir(s)  130,296,668,160 bytes free

================================
later
mld4165

HMMM, Seems like you have symantec and Trend micro installed on the computer ???

You should remove one of them to avoid any conflicts..!

BTW, did you check the link above your last comment? it's exactly the same issue.

>>HMMM, Seems like you have symantec and Trend micro installed on the computer ???

Trend Micro has long been removed. Looks like the folder was left behind.

>>BTW, did you check the link above your last comment? it's exactly the same issue.

I will follow up in the morning.

thanks for the follow up.
mld4165

went to delete a file out of My documents this morning and I get the following:

Application popup: Explorer.EXE - Application Error : The instruction at "0x021238ae" referenced memory at "0x0221c574". The memory could not be "read".

I click ok and get:

Runtime error 216 at 021238AE

I click OK and get

Application popup: Explorer.EXE - Application Error : The instruction at "0x02125f62" referenced memory at "0x022008a4". The memory could not be "read".

I click ok and get:

Runtime error 216 at 021238AE

I click cancel and get

Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

It takes a while and I get:
Fault bucket 00733296.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

great now the fault bucket is back.

Explore.exe restarts.

mld4165

This looks like a service that's corrupted or having a missing file regarding the explorer.exe..

Goto Start --> run --> type Msconfig and enter

Goto Startup tab and disable all the items there, Goto Service tab and click hide microsoft services, then click disable all.
Click apply -> ok then restart

Try to see if any crashes happens now ?

If it crashes then Download hijackthis from www.hijackthis.de and then run it, click scan and post your log to www.hijackthis.de and click analyaze then send the saved link here for us to see..

Then Download and run the following..

SpywareBlaster: (http://www.javacoolsoftware.com/spywareblaster.html)
Other crapware reference sites such as:
 
doxdesk.com: (http://www.doxdesk.com/parasite/)
CounterExploitation: (http://cexx.org/adware.htm)
Kephyr.com: (http://www.kephyr.com/)
PestPatrol: (http://www.pestpatrol.com/)
SpywareGuide.com: (http://www.spywareguide.com/)
Webhelper:(http://www.webhelper4u.com/)

Download Hoster 3.1, it's a very useful tool that helps you to fix your Hoster file.
Download Link: http://www.majorgeeks.com/Hoster_d4626.html
Extract it then run and click on restore MS's original Host file..

When downloading the above checking tools, Goto Start --> run --> type Iexplore.exe /rereg and enter

Restart the computer then, and goto the following link:
http://www.theeldergeek.com/services_guide.htm

the link provides you the services in the service console and shows you the services which must be running and which should not be, follow these services one by one and make sure they are all working on default.

I will be waiting for the Hijackthis log..

Good luck

moh10ly

>>Goto Startup tab and disable all the items there, Goto Service tab and click hide microsoft services, then click disable all.
>>Click apply -> ok then restart
Done in post #6, but I will redo as I had restarted a few items. see post #20

>>If it crashes then Download hijackthis from www.hijackthis.de and then run it, click scan and post your log to www.hijackthis.de and >>click analyaze then send the saved link here for us to see..
http://www.hijackthis.de/logfiles/aa9085d24931f6ad896fd809ef0d8da2.html

>>SpywareBlaster:
Original post shows all that I have ran

>>When downloading the above checking tools, Goto Start --> run --> type Iexplore.exe /rereg and enter
nothing happens?

mld4165

I thought I had something in the my documents folder as it seemed to be the only place that this was happening.

1. So I rebooted into safe mode as administrator and backed up matt's documents and then deleted matt's documents

2. rebooted the pc and a new folder was created

A little later I went to delete something on c: like I normally would and it happened again.

When I delete something it is always right click and delete, and now it seems to be the culprit as I can reproduce it over and over.

Any ideas why or what is causing this problem?

thanks
mld4165

>>OH, so it only happens when you just want to delete ?

not sure that is completely true, but yes I can reproduce the problem.

I am 99% sure it also happens while searching for a file but I cannot remember if I right clicked the results, and then it happened.

I can also say that I think it happened earlier just going into My Documents which happened to have 12 GB of stuff and is why I removed and recreated the folder just in case of file coruption.

mld4165

You have to fix some entries in the HJT Log.. If the "removed to protect my self" doesn't mean anything to you, then you should fix it on all of the entries when you run hijackthis again. but it indicates that's a proxy server name or something like that?

These are of them, and check the other nasties in the log you have posted.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = removed to protect myself
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = removed to protect myself
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = removed to protect myself

Change the windows theme to classic and do the search to see weather it will crash or not.
right-click  the task bar ---> properties -- > Start menu Tab, change to Classic Start menu. Now check if its working normally?

If not then Open Explorer and go to the Windows\Inf folder. Locate the srchasst.inf file. Right click it and select Install. You'll need your XP CD or the files from the I386 folder. (This fix will require you to have your Win XP CD).

The Windows\Inf folder is a hidden folder. You can adjust your Explorer Folder Options (View tab) to Show hidden files and folders. You can also click Start, Run and enter %SystemRoot%\Inf to open directly to the Inf folder.

Hope this will fix it..

moh10ly

======================================
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = removed to protect myself
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = removed to protect myself
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = removed to protect myself
=======================================

protecting my lan / wan. i cannot give out that info.

========================================
Change the windows theme to classic and do the search to see weather it will crash or not.
right-click  the task bar ---> properties -- > Start menu Tab, change to Classic Start menu. Now check if its working normally?
========================================

been in classic the whole time. did you see something in the log?

==========================================
If not then Open Explorer and go to the Windows\Inf folder. Locate the srchasst.inf file. Right click it and select Install. You'll need your XP CD or the files from the I386 folder. (This fix will require you to have your Win XP CD).
==========================================

Since you suggested... can you tell me what this will do?

thanks
mld4165

LeeTutor

thanks for the link, that is a good article. i disabled all context menu handlers that were in pink, and I am investigating the rest.

mld4165

When you have your search windows corrupted or when it gives you an error message, you will have to reinstall the search companion files, Check the following KB.

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q319949

If this didn't work then you may have to try and reinstall SP2.

Since my post on 06/15/2006 09:20AM EDT the machine has run fine.

I want to keep the question open for a few more days, while I bring more services back online.

thanks
mld4165

Good, hope it still working good.

still rollin along error free.......

knockin on wood!

mld4165

Not sure what else to do, you may be try repair installation as last resort.
by doing a repair, you won't lose your files or applications, only Windows updates.

not sure why i want to run a repair? it is running great with no problems today.

if it does not have any problems between today and 6-24-06 I will close this and award points.

later
mld4165

Good luck then ;-)

thanks for all of the help. the pc runs great.

definitly a bad Context Menu handler. using shellexview i have turned them all off, and have left them off as I do not use any.

mld4165