Solved

Windows Explorer has stopped working errors

Posted on 2010-11-10
13
422 Views
Last Modified: 2012-05-10
Hello,

Recently in the last 1-2-3 months I'm getting more and more errors like "Windows Explorer has stopped working. Restart the program". After I click restart the program Kaspersky shows up and tells me "C:\WINDOWS\EXPLORER.EXE (PID: ****) Behavior similar to PDM.Keylogger detected. And then the display freezes a bit and all the Open folders are closed and taskbar restarts. I've attached an complete report on my computer and also some screenshots.

I don't want suggestions that involve reinstalling the OS or formatting the PC because thats not a solution, so I hope anyone has some ideas why this is happening.

These errors are occurring when an torent has finished the download, or when I perform the Everest Report that I've attached here, or after I connect through OpenVPN and many other situations when some windows systems files are being used I presume.

Thank you
0
Comment
Question by:itudor
  • 6
  • 6
13 Comments
 
LVL 13

Accepted Solution

by:
stergium earned 300 total points
Comment Utility
hello. i think its a false positive.
you can try excluding explorer process from kaspersky.
a maybe riskier route to solve the problem is to insert your windows cd and start-> run sfc/scannow  (in order to restore any tampered exe system file)
hope that helps
0
 

Author Comment

by:itudor
Comment Utility
stergium, I forgot to mention that I already uninstalled KS and got that error without it being installed. Also I made explorer.exe Trusted in KS and no joy either.

I don't think I have windows 7 original or the backup cd here with me.

Thank you for your response, let me know other ideas.
0
 
LVL 47

Expert Comment

by:dbrunton
Comment Utility
You've got Daemon Tools on this machine.  According to your logs it is an incompatible version.  Try removing it and see what happens after it has gone.  It is also possible that Kapersky is detecting Daemon as being a keylogger although I would not swear on that.

I've also asked EE to remove your attachment as there is far too much personal information within that you don't need placed here.
0
 

Author Comment

by:itudor
Comment Utility
Thank you dbrunton but I've only installed Daemon Tools few days, a week max ago and this problem was there before of that.
0
 
LVL 47

Expert Comment

by:dbrunton
Comment Utility
Are you getting a runtime error message besides the messages above?
0
 

Author Comment

by:itudor
Comment Utility
No the programs runs ok. Only that error message above displays then explorer.exe restarts if I click 'restart the program' and after starting Kaspersky identifies its behavior similar to PDM.Keylogger.
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 47

Assisted Solution

by:dbrunton
dbrunton earned 200 total points
Comment Utility
This could be just about anything.  I did note a Roxio installation that seemed to have problems.  If this started happening around the same time then uninstall Roxio.

The other possible is a virus infection of some type.

I asked about the runtime error because of this thread http://forums.majorgeeks.com/showthread.php?s=bc5f80d1e823d802783cfc77a2c1d0f8&t=152704

Similar but not necessarily the same.

They go through a long list of virus troubleshooting.  If you wish to go that way these are the ones that are usually recommended here

MalwareBytes:
http://www.malwarebytes.org/mbam-download.php

HitmanPro:
http://www.surfright.nl/en/hitmanpro

TDSSKiller:
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

0
 
LVL 47

Assisted Solution

by:dbrunton
dbrunton earned 200 total points
Comment Utility
I can find this file is set to run on startup.

orsaxnwecm.exe        Registry\Common\Run        C:\Users\THEDOC~1\AppData\Local\Temp\orsaxnwecm.exe

I don't know what it does.  You may have installed some application to do this or not but if that file is still there treat it as suspcious.
0
 
LVL 47

Expert Comment

by:dbrunton
Comment Utility
Your Explorer errors start around the 25-08-2010

There is some sort of failed Nero installation around the same time but I don't know if this is related or not.  Not Roxio as stated earlier.

0
 

Author Comment

by:itudor
Comment Utility
I don't know if its relevant but Malwarebytes found a single Malware: C:\Users\The Doctor\Local Settings\Application Data\Windows Server\admin.txt
Inside that file its only: "ad"
But now I don't remember how but I've triggered something and Nero Installation showed up when I tried to access the folder directly or something. But after that it didn't render again I think now because I've opened the server.dat with notepad. See below:

C:\Users\The Doctor\Local Settings\Application Data\Windows Server>dir
 Volume in drive C has no label.
 Volume Serial Number is EC39-89E3

 Directory of C:\Users\The Doctor\Local Settings\Application Data\Windows Server

08/20/2010  18:23    <DIR>          .
08/20/2010  18:23    <DIR>          ..
07/14/2009  03:11                 2 admin.txt
08/20/2010  18:23            38,566 server.dat
               2 File(s)         38,568 bytes
               2 Dir(s)  96,699,301,888 bytes free

C:\Users\The Doctor\Local Settings\Application Data\Windows Server>cd ..

C:\Users\The Doctor\Local Settings\Application Data>cd ..

C:\Users\The Doctor\Local Settings>tree
Folder PATH listing
Volume serial number is EC39-89E3
C:.
No subfolders exist




Now I'm trying to delete this folder but:

C:\Users\The Doctor>rmdir Local Settings
The system cannot find the file specified.
The system cannot find the file specified.



I don't know if this is causing the problem or not but I want to remove the whole folder and it doesn't allow me.
0
 
LVL 47

Assisted Solution

by:dbrunton
dbrunton earned 200 total points
Comment Utility
If you are trying to delete that folder then the syntax should be

rmdir "Local Settings"

But there should be no need to delete that folder.  It is part of your settings and contains other folders as well that may be important.
0
 

Author Comment

by:itudor
Comment Utility
In windows 7 I think the local settings have moved to C:\Users\The Doctor\AppData\Local

C:\Users\The Doctor\Local Settings>tree
Folder PATH listing
Volume serial number is EC39-89E3
C:.
No subfolders exist
0
 

Author Comment

by:itudor
Comment Utility
It turns out it was something related to the taskbar notifications area. Whenever a notification should have appear the explorer.exe was going rogue and it needed to restart. I don't know how I didn't noticed this earlier, but after I fixed the problem I saw that sometimes where I knew there should've been a crash, a notification gets displayed now.

So the solution I've followed is from here: http://support.microsoft.com/kb/929833. It involves what stergium suggested but I didn't need the windows cd like he said so I could've solved this yesterday but I thought I needed the cd. But I have to give him credit because he suggested that some system files are tampered and indeed I think that was the case.

I installed MalwareBytes and HitmanPro and no medium/major problems were found.
I also disabled orsaxnwecm.exe to run at startup and I actually deleted everything from C:\Users\THEDOC~1\AppData\Local\Temp. I also deleted rmdir "Local Settings" because local settings for windows 7 are actually located in AppData\Local as I previously said.

Thanks you both for your answers.

Best Regards,
Ionut
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Article by: Lee
Windows 7 Ultimate and Enterprise (and 2008 R2) introduced a new feature you may not be aware of - Boot from VHD.   Boot from VHD (or what Microsoft refers to asNative Boot allows you to install Windows to a VHD (Virtual Hard Disk) file that is t…
I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
This Micro Tutorial will give you a basic overview of Windows Live Photo Gallery and show you various editing filters and touches to photos you can apply. This will be demonstrated using Windows Live Photo Gallery on Windows 7 operating system.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now