• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 434
  • Last Modified:

Windows Explorer has stopped working errors

Hello,

Recently in the last 1-2-3 months I'm getting more and more errors like "Windows Explorer has stopped working. Restart the program". After I click restart the program Kaspersky shows up and tells me "C:\WINDOWS\EXPLORER.EXE (PID: ****) Behavior similar to PDM.Keylogger detected. And then the display freezes a bit and all the Open folders are closed and taskbar restarts. I've attached an complete report on my computer and also some screenshots.

I don't want suggestions that involve reinstalling the OS or formatting the PC because thats not a solution, so I hope anyone has some ideas why this is happening.

These errors are occurring when an torent has finished the download, or when I perform the Everest Report that I've attached here, or after I connect through OpenVPN and many other situations when some windows systems files are being used I presume.

Thank you
0
itudor
Asked:
itudor
  • 6
  • 6
4 Solutions
 
stergiumCommented:
hello. i think its a false positive.
you can try excluding explorer process from kaspersky.
a maybe riskier route to solve the problem is to insert your windows cd and start-> run sfc/scannow  (in order to restore any tampered exe system file)
hope that helps
0
 
itudorAuthor Commented:
stergium, I forgot to mention that I already uninstalled KS and got that error without it being installed. Also I made explorer.exe Trusted in KS and no joy either.

I don't think I have windows 7 original or the backup cd here with me.

Thank you for your response, let me know other ideas.
0
 
dbruntonCommented:
You've got Daemon Tools on this machine.  According to your logs it is an incompatible version.  Try removing it and see what happens after it has gone.  It is also possible that Kapersky is detecting Daemon as being a keylogger although I would not swear on that.

I've also asked EE to remove your attachment as there is far too much personal information within that you don't need placed here.
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
itudorAuthor Commented:
Thank you dbrunton but I've only installed Daemon Tools few days, a week max ago and this problem was there before of that.
0
 
dbruntonCommented:
Are you getting a runtime error message besides the messages above?
0
 
itudorAuthor Commented:
No the programs runs ok. Only that error message above displays then explorer.exe restarts if I click 'restart the program' and after starting Kaspersky identifies its behavior similar to PDM.Keylogger.
0
 
dbruntonCommented:
This could be just about anything.  I did note a Roxio installation that seemed to have problems.  If this started happening around the same time then uninstall Roxio.

The other possible is a virus infection of some type.

I asked about the runtime error because of this thread http://forums.majorgeeks.com/showthread.php?s=bc5f80d1e823d802783cfc77a2c1d0f8&t=152704

Similar but not necessarily the same.

They go through a long list of virus troubleshooting.  If you wish to go that way these are the ones that are usually recommended here

MalwareBytes:
http://www.malwarebytes.org/mbam-download.php

HitmanPro:
http://www.surfright.nl/en/hitmanpro

TDSSKiller:
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

0
 
dbruntonCommented:
I can find this file is set to run on startup.

orsaxnwecm.exe        Registry\Common\Run        C:\Users\THEDOC~1\AppData\Local\Temp\orsaxnwecm.exe

I don't know what it does.  You may have installed some application to do this or not but if that file is still there treat it as suspcious.
0
 
dbruntonCommented:
Your Explorer errors start around the 25-08-2010

There is some sort of failed Nero installation around the same time but I don't know if this is related or not.  Not Roxio as stated earlier.

0
 
itudorAuthor Commented:
I don't know if its relevant but Malwarebytes found a single Malware: C:\Users\The Doctor\Local Settings\Application Data\Windows Server\admin.txt
Inside that file its only: "ad"
But now I don't remember how but I've triggered something and Nero Installation showed up when I tried to access the folder directly or something. But after that it didn't render again I think now because I've opened the server.dat with notepad. See below:

C:\Users\The Doctor\Local Settings\Application Data\Windows Server>dir
 Volume in drive C has no label.
 Volume Serial Number is EC39-89E3

 Directory of C:\Users\The Doctor\Local Settings\Application Data\Windows Server

08/20/2010  18:23    <DIR>          .
08/20/2010  18:23    <DIR>          ..
07/14/2009  03:11                 2 admin.txt
08/20/2010  18:23            38,566 server.dat
               2 File(s)         38,568 bytes
               2 Dir(s)  96,699,301,888 bytes free

C:\Users\The Doctor\Local Settings\Application Data\Windows Server>cd ..

C:\Users\The Doctor\Local Settings\Application Data>cd ..

C:\Users\The Doctor\Local Settings>tree
Folder PATH listing
Volume serial number is EC39-89E3
C:.
No subfolders exist




Now I'm trying to delete this folder but:

C:\Users\The Doctor>rmdir Local Settings
The system cannot find the file specified.
The system cannot find the file specified.



I don't know if this is causing the problem or not but I want to remove the whole folder and it doesn't allow me.
0
 
dbruntonCommented:
If you are trying to delete that folder then the syntax should be

rmdir "Local Settings"

But there should be no need to delete that folder.  It is part of your settings and contains other folders as well that may be important.
0
 
itudorAuthor Commented:
In windows 7 I think the local settings have moved to C:\Users\The Doctor\AppData\Local

C:\Users\The Doctor\Local Settings>tree
Folder PATH listing
Volume serial number is EC39-89E3
C:.
No subfolders exist
0
 
itudorAuthor Commented:
It turns out it was something related to the taskbar notifications area. Whenever a notification should have appear the explorer.exe was going rogue and it needed to restart. I don't know how I didn't noticed this earlier, but after I fixed the problem I saw that sometimes where I knew there should've been a crash, a notification gets displayed now.

So the solution I've followed is from here: http://support.microsoft.com/kb/929833. It involves what stergium suggested but I didn't need the windows cd like he said so I could've solved this yesterday but I thought I needed the cd. But I have to give him credit because he suggested that some system files are tampered and indeed I think that was the case.

I installed MalwareBytes and HitmanPro and no medium/major problems were found.
I also disabled orsaxnwecm.exe to run at startup and I actually deleted everything from C:\Users\THEDOC~1\AppData\Local\Temp. I also deleted rmdir "Local Settings" because local settings for windows 7 are actually located in AppData\Local as I previously said.

Thanks you both for your answers.

Best Regards,
Ionut
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 6
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now