?
Solved

Windows Explorer has stopped working errors

Posted on 2010-11-10
13
Medium Priority
?
431 Views
Last Modified: 2012-05-10
Hello,

Recently in the last 1-2-3 months I'm getting more and more errors like "Windows Explorer has stopped working. Restart the program". After I click restart the program Kaspersky shows up and tells me "C:\WINDOWS\EXPLORER.EXE (PID: ****) Behavior similar to PDM.Keylogger detected. And then the display freezes a bit and all the Open folders are closed and taskbar restarts. I've attached an complete report on my computer and also some screenshots.

I don't want suggestions that involve reinstalling the OS or formatting the PC because thats not a solution, so I hope anyone has some ideas why this is happening.

These errors are occurring when an torent has finished the download, or when I perform the Everest Report that I've attached here, or after I connect through OpenVPN and many other situations when some windows systems files are being used I presume.

Thank you
0
Comment
Question by:itudor
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 6
13 Comments
 
LVL 13

Accepted Solution

by:
stergium earned 1200 total points
ID: 34109503
hello. i think its a false positive.
you can try excluding explorer process from kaspersky.
a maybe riskier route to solve the problem is to insert your windows cd and start-> run sfc/scannow  (in order to restore any tampered exe system file)
hope that helps
0
 

Author Comment

by:itudor
ID: 34109535
stergium, I forgot to mention that I already uninstalled KS and got that error without it being installed. Also I made explorer.exe Trusted in KS and no joy either.

I don't think I have windows 7 original or the backup cd here with me.

Thank you for your response, let me know other ideas.
0
 
LVL 49

Expert Comment

by:dbrunton
ID: 34113295
You've got Daemon Tools on this machine.  According to your logs it is an incompatible version.  Try removing it and see what happens after it has gone.  It is also possible that Kapersky is detecting Daemon as being a keylogger although I would not swear on that.

I've also asked EE to remove your attachment as there is far too much personal information within that you don't need placed here.
0
Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

 

Author Comment

by:itudor
ID: 34114681
Thank you dbrunton but I've only installed Daemon Tools few days, a week max ago and this problem was there before of that.
0
 
LVL 49

Expert Comment

by:dbrunton
ID: 34114791
Are you getting a runtime error message besides the messages above?
0
 

Author Comment

by:itudor
ID: 34115437
No the programs runs ok. Only that error message above displays then explorer.exe restarts if I click 'restart the program' and after starting Kaspersky identifies its behavior similar to PDM.Keylogger.
0
 
LVL 49

Assisted Solution

by:dbrunton
dbrunton earned 800 total points
ID: 34115682
This could be just about anything.  I did note a Roxio installation that seemed to have problems.  If this started happening around the same time then uninstall Roxio.

The other possible is a virus infection of some type.

I asked about the runtime error because of this thread http://forums.majorgeeks.com/showthread.php?s=bc5f80d1e823d802783cfc77a2c1d0f8&t=152704

Similar but not necessarily the same.

They go through a long list of virus troubleshooting.  If you wish to go that way these are the ones that are usually recommended here

MalwareBytes:
http://www.malwarebytes.org/mbam-download.php

HitmanPro:
http://www.surfright.nl/en/hitmanpro

TDSSKiller:
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

0
 
LVL 49

Assisted Solution

by:dbrunton
dbrunton earned 800 total points
ID: 34115827
I can find this file is set to run on startup.

orsaxnwecm.exe        Registry\Common\Run        C:\Users\THEDOC~1\AppData\Local\Temp\orsaxnwecm.exe

I don't know what it does.  You may have installed some application to do this or not but if that file is still there treat it as suspcious.
0
 
LVL 49

Expert Comment

by:dbrunton
ID: 34115982
Your Explorer errors start around the 25-08-2010

There is some sort of failed Nero installation around the same time but I don't know if this is related or not.  Not Roxio as stated earlier.

0
 

Author Comment

by:itudor
ID: 34118483
I don't know if its relevant but Malwarebytes found a single Malware: C:\Users\The Doctor\Local Settings\Application Data\Windows Server\admin.txt
Inside that file its only: "ad"
But now I don't remember how but I've triggered something and Nero Installation showed up when I tried to access the folder directly or something. But after that it didn't render again I think now because I've opened the server.dat with notepad. See below:

C:\Users\The Doctor\Local Settings\Application Data\Windows Server>dir
 Volume in drive C has no label.
 Volume Serial Number is EC39-89E3

 Directory of C:\Users\The Doctor\Local Settings\Application Data\Windows Server

08/20/2010  18:23    <DIR>          .
08/20/2010  18:23    <DIR>          ..
07/14/2009  03:11                 2 admin.txt
08/20/2010  18:23            38,566 server.dat
               2 File(s)         38,568 bytes
               2 Dir(s)  96,699,301,888 bytes free

C:\Users\The Doctor\Local Settings\Application Data\Windows Server>cd ..

C:\Users\The Doctor\Local Settings\Application Data>cd ..

C:\Users\The Doctor\Local Settings>tree
Folder PATH listing
Volume serial number is EC39-89E3
C:.
No subfolders exist




Now I'm trying to delete this folder but:

C:\Users\The Doctor>rmdir Local Settings
The system cannot find the file specified.
The system cannot find the file specified.



I don't know if this is causing the problem or not but I want to remove the whole folder and it doesn't allow me.
0
 
LVL 49

Assisted Solution

by:dbrunton
dbrunton earned 800 total points
ID: 34119194
If you are trying to delete that folder then the syntax should be

rmdir "Local Settings"

But there should be no need to delete that folder.  It is part of your settings and contains other folders as well that may be important.
0
 

Author Comment

by:itudor
ID: 34119320
In windows 7 I think the local settings have moved to C:\Users\The Doctor\AppData\Local

C:\Users\The Doctor\Local Settings>tree
Folder PATH listing
Volume serial number is EC39-89E3
C:.
No subfolders exist
0
 

Author Comment

by:itudor
ID: 34123610
It turns out it was something related to the taskbar notifications area. Whenever a notification should have appear the explorer.exe was going rogue and it needed to restart. I don't know how I didn't noticed this earlier, but after I fixed the problem I saw that sometimes where I knew there should've been a crash, a notification gets displayed now.

So the solution I've followed is from here: http://support.microsoft.com/kb/929833. It involves what stergium suggested but I didn't need the windows cd like he said so I could've solved this yesterday but I thought I needed the cd. But I have to give him credit because he suggested that some system files are tampered and indeed I think that was the case.

I installed MalwareBytes and HitmanPro and no medium/major problems were found.
I also disabled orsaxnwecm.exe to run at startup and I actually deleted everything from C:\Users\THEDOC~1\AppData\Local\Temp. I also deleted rmdir "Local Settings" because local settings for windows 7 are actually located in AppData\Local as I previously said.

Thanks you both for your answers.

Best Regards,
Ionut
0

Featured Post

Want to be a Web Developer? Get Certified Today!

Enroll in the Certified Web Development Professional course package to learn HTML, Javascript, and PHP. Build a solid foundation to work toward your dream job!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Assume you have an outside contractor who comes in seasonally or once a week to do some work in your office, but you only want to give him access to the programs and files he needs and keep all other documents and programs private. Can you do this o…
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question