Solved

Windows Explorer has stopped working errors

Posted on 2010-11-10
13
425 Views
Last Modified: 2012-05-10
Hello,

Recently in the last 1-2-3 months I'm getting more and more errors like "Windows Explorer has stopped working. Restart the program". After I click restart the program Kaspersky shows up and tells me "C:\WINDOWS\EXPLORER.EXE (PID: ****) Behavior similar to PDM.Keylogger detected. And then the display freezes a bit and all the Open folders are closed and taskbar restarts. I've attached an complete report on my computer and also some screenshots.

I don't want suggestions that involve reinstalling the OS or formatting the PC because thats not a solution, so I hope anyone has some ideas why this is happening.

These errors are occurring when an torent has finished the download, or when I perform the Everest Report that I've attached here, or after I connect through OpenVPN and many other situations when some windows systems files are being used I presume.

Thank you
0
Comment
Question by:itudor
  • 6
  • 6
13 Comments
 
LVL 13

Accepted Solution

by:
stergium earned 300 total points
ID: 34109503
hello. i think its a false positive.
you can try excluding explorer process from kaspersky.
a maybe riskier route to solve the problem is to insert your windows cd and start-> run sfc/scannow  (in order to restore any tampered exe system file)
hope that helps
0
 

Author Comment

by:itudor
ID: 34109535
stergium, I forgot to mention that I already uninstalled KS and got that error without it being installed. Also I made explorer.exe Trusted in KS and no joy either.

I don't think I have windows 7 original or the backup cd here with me.

Thank you for your response, let me know other ideas.
0
 
LVL 48

Expert Comment

by:dbrunton
ID: 34113295
You've got Daemon Tools on this machine.  According to your logs it is an incompatible version.  Try removing it and see what happens after it has gone.  It is also possible that Kapersky is detecting Daemon as being a keylogger although I would not swear on that.

I've also asked EE to remove your attachment as there is far too much personal information within that you don't need placed here.
0
 

Author Comment

by:itudor
ID: 34114681
Thank you dbrunton but I've only installed Daemon Tools few days, a week max ago and this problem was there before of that.
0
 
LVL 48

Expert Comment

by:dbrunton
ID: 34114791
Are you getting a runtime error message besides the messages above?
0
 

Author Comment

by:itudor
ID: 34115437
No the programs runs ok. Only that error message above displays then explorer.exe restarts if I click 'restart the program' and after starting Kaspersky identifies its behavior similar to PDM.Keylogger.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 48

Assisted Solution

by:dbrunton
dbrunton earned 200 total points
ID: 34115682
This could be just about anything.  I did note a Roxio installation that seemed to have problems.  If this started happening around the same time then uninstall Roxio.

The other possible is a virus infection of some type.

I asked about the runtime error because of this thread http://forums.majorgeeks.com/showthread.php?s=bc5f80d1e823d802783cfc77a2c1d0f8&t=152704

Similar but not necessarily the same.

They go through a long list of virus troubleshooting.  If you wish to go that way these are the ones that are usually recommended here

MalwareBytes:
http://www.malwarebytes.org/mbam-download.php

HitmanPro:
http://www.surfright.nl/en/hitmanpro

TDSSKiller:
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

0
 
LVL 48

Assisted Solution

by:dbrunton
dbrunton earned 200 total points
ID: 34115827
I can find this file is set to run on startup.

orsaxnwecm.exe        Registry\Common\Run        C:\Users\THEDOC~1\AppData\Local\Temp\orsaxnwecm.exe

I don't know what it does.  You may have installed some application to do this or not but if that file is still there treat it as suspcious.
0
 
LVL 48

Expert Comment

by:dbrunton
ID: 34115982
Your Explorer errors start around the 25-08-2010

There is some sort of failed Nero installation around the same time but I don't know if this is related or not.  Not Roxio as stated earlier.

0
 

Author Comment

by:itudor
ID: 34118483
I don't know if its relevant but Malwarebytes found a single Malware: C:\Users\The Doctor\Local Settings\Application Data\Windows Server\admin.txt
Inside that file its only: "ad"
But now I don't remember how but I've triggered something and Nero Installation showed up when I tried to access the folder directly or something. But after that it didn't render again I think now because I've opened the server.dat with notepad. See below:

C:\Users\The Doctor\Local Settings\Application Data\Windows Server>dir
 Volume in drive C has no label.
 Volume Serial Number is EC39-89E3

 Directory of C:\Users\The Doctor\Local Settings\Application Data\Windows Server

08/20/2010  18:23    <DIR>          .
08/20/2010  18:23    <DIR>          ..
07/14/2009  03:11                 2 admin.txt
08/20/2010  18:23            38,566 server.dat
               2 File(s)         38,568 bytes
               2 Dir(s)  96,699,301,888 bytes free

C:\Users\The Doctor\Local Settings\Application Data\Windows Server>cd ..

C:\Users\The Doctor\Local Settings\Application Data>cd ..

C:\Users\The Doctor\Local Settings>tree
Folder PATH listing
Volume serial number is EC39-89E3
C:.
No subfolders exist




Now I'm trying to delete this folder but:

C:\Users\The Doctor>rmdir Local Settings
The system cannot find the file specified.
The system cannot find the file specified.



I don't know if this is causing the problem or not but I want to remove the whole folder and it doesn't allow me.
0
 
LVL 48

Assisted Solution

by:dbrunton
dbrunton earned 200 total points
ID: 34119194
If you are trying to delete that folder then the syntax should be

rmdir "Local Settings"

But there should be no need to delete that folder.  It is part of your settings and contains other folders as well that may be important.
0
 

Author Comment

by:itudor
ID: 34119320
In windows 7 I think the local settings have moved to C:\Users\The Doctor\AppData\Local

C:\Users\The Doctor\Local Settings>tree
Folder PATH listing
Volume serial number is EC39-89E3
C:.
No subfolders exist
0
 

Author Comment

by:itudor
ID: 34123610
It turns out it was something related to the taskbar notifications area. Whenever a notification should have appear the explorer.exe was going rogue and it needed to restart. I don't know how I didn't noticed this earlier, but after I fixed the problem I saw that sometimes where I knew there should've been a crash, a notification gets displayed now.

So the solution I've followed is from here: http://support.microsoft.com/kb/929833. It involves what stergium suggested but I didn't need the windows cd like he said so I could've solved this yesterday but I thought I needed the cd. But I have to give him credit because he suggested that some system files are tampered and indeed I think that was the case.

I installed MalwareBytes and HitmanPro and no medium/major problems were found.
I also disabled orsaxnwecm.exe to run at startup and I actually deleted everything from C:\Users\THEDOC~1\AppData\Local\Temp. I also deleted rmdir "Local Settings" because local settings for windows 7 are actually located in AppData\Local as I previously said.

Thanks you both for your answers.

Best Regards,
Ionut
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Windows Explorer has stopped working 3 24
Copy dir and files with robocopy 2 34
Windows 7 Lock taskbar 8 22
M2 SSD questions 14 13
The Samsung SSD 840 EVO and 840 EVO mSATA have a well-known problem with a drop in read performance. I first learned about this in an interesting thread here at Experts Exchange: http://www.experts-exchange.com/Hardware/Storage/Hard_Drives/Q_2852…
On some Windows 7 (SP1) computers, Windows Update becomes super slow even the computer is reasonably fast.  There's one solution that seemed to have worked well for me (after trying a few other suggested solutions).
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
This Micro Tutorial will give you basic overview of the control panel section on Windows 7. It will depth in Network and Internet, Hardware and Sound, etc. This will be demonstrated using Windows 7 operating system.

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now