Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Explorer.exe not loading (No Task Manager)


  • This topic is locked This topic is locked
27 replies to this topic

#1 craad

craad

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:57 PM

Posted 11 March 2012 - 09:16 PM

Hey all,

I have had an issue with my custom build computer for a couple of years now but I haven't had a chance to work on it for a very long time. I'm now looking to remedy the issue which is as follows: when I boot up my computer, Windows XP Pro loads up and automatically logs me in to my user account like normal (it's the only one on the computer). The background is the only thing that loads up (no icons, taskbar, etc...). Obviously this is an issue with the explorer.exe not loading properly. But unlike most threads I've found online, I am unable to pull up the Task Manager by pressing ctrl+alt+del or ctrl+shift+esc. I can't do anything other than move my mouse around. After about a minute or so, it will just log me off and take me to the screen where I can pick which user to log on as. If I click my user account it will start to log me on then just as it starts to log on, it instantly logs back off and goes back to the screen where I can pick the user account again. It will keep doing this without fail. If I try logging on in any of the Safe Modes, it takes me first to the screen where I can pick between either logging in as Administrator or my normal account. No matter which account I choose it will do the same thing of trying to log me on then immediately logging back off.

The issue originally began when I was running my spyware like I normally have before (I honestly can't remember which program it was exactly because this happened almost four years ago). It detected a couple of threats and deleted them as recommended. After being deleted that is when explorer.exe was not loading properly. However, when the problem first started, I was able to load the Task Manager and it was not being force logged off. The problem progressed to what it is now fairly soon after the initial problem began.

Basically the only things that I can access now are the Recovery Console and BIOS setup. So here I am posing my problem to you all looking for a possible solution. Let me know what you all think I can do to fix this problem or any other information you would like for me to provide.

Edited by Andrew, 13 March 2012 - 04:13 PM.
Mod Edit: Moved from XP to MRL due to malware logs - AA


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,726 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:11:57 PM

Posted 12 March 2012 - 06:01 AM

<<I have had an issue with my custom build computer for a couple of years now...>>

Tried a clean install?

Have you run the appropriate hard drive diagnostic...before doing a clean install?

Louis

#3 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:57 PM

Posted 12 March 2012 - 08:17 AM

The well-known and previously quite common problem that you describe is known as the XP LogOn/LogOff Loop (perhaps some variation of it anyway) ... usually arising after attempted malware removal.

I will assume that if performing a clean install of the Windows operating system was an acceptable option, you would have done it long ago, and that you would now like to have the problem fixed. In that case ... please sit tight and be patient.

I have requested that an experienced helper who specialises in malware-related un-bootable computers respond to your topic.

Thank you.

Edited by AustrAlien, 12 March 2012 - 08:17 AM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#4 craad

craad
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:57 PM

Posted 12 March 2012 - 08:35 AM

I really appreciate that AustrAlien. A couple bits of info I forgot to mention earlier is that the computer has two 330 GB hard drives with a few partitions and I would of course love to fix the problem without losing any of the data on those drives.

#5 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:57 PM

Posted 12 March 2012 - 08:39 AM

That should not be a problem.

Good luck.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,076 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:07:57 AM

Posted 12 March 2012 - 09:26 AM

Hello,

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer
  • Insert your USB drive
  • Press Start > My Computer > right click your USB drive > choose Format > Quick format
  • Double click the unetbootin-xpud-windows-latest.exe that you just downloaded
  • Press Run then OK
  • Select the DiskImage option then click the browse button located on the right side of the textbox field.
  • Browse to and select the xpud-0.9.2.iso file you downloaded
  • Verify the correct drive letter is selected for your USB device then click OK
  • It will install a little bootable OS on your USB device
  • Once the files have been written to the device you will be prompted to reboot ~ do not reboot and instead just Exit the UNetbootin interface
  • After it has completed do not choose to reboot the clean computer simply close the installer
  • Next download http://noahdfear.net/downloads/xPUD_userinit_fix to your USB (without a file extension, you may have to right click on the link and click on Save Target As, and make sure that "All Files" is selected)
  • Remove the USB and insert it in the sick computer
  • Boot the Sick computer
  • Press F12 right as the computer is initially starting up, and choose to boot from the USB
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your hard drive
  • sdb1 is likely your USB
  • Click on sdb1 (this is your USB drive)
  • Confirm that you see xPUD_userinit_fix on your USB drive (sdb1)
  • Double click on xPUD_userinit_fix
  • After it has finished a report will be located on your USB drive named UserinitReport.txt
  • Click on the Home tab, click on Power Off, and then click on Turn Off
  • Remove the USB drive and insert back in your working computer and navigate to UserinitReport.txt

    Please note - all text entries are case sensitive
Please copy and paste the UserinitReport.txt for my review.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 craad

craad
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:57 PM

Posted 12 March 2012 - 12:33 PM

When I am in xPUD and I go to File then expand mnt I see sda1, sda2, sda3, sda5, and sdb1. I opened up sdb1 and the files that showed were not what is on my USB drive. I am almost positive they are the files and folders that were on my second hard drive. I looked through the rest of the subfolders in mnt and could not find any that had the xPUD_userinit_fix file in it. sda2 is blank for some reason though, I'm not sure if that is relevant. I also tried putting basic word documents on the USB drive afterwards to see if I could find them in xPUD but I still was unable to. It seems as if xPUD is not recognizing the USB drive or something. Any ideas as to why this is happening?

#8 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:57 PM

Posted 12 March 2012 - 12:38 PM

While booted into xPUD, remove the flashdrive and then re-insert it. xPUD should then recognise it ... probably as sdc1.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#9 craad

craad
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:57 PM

Posted 12 March 2012 - 12:52 PM

Remote Registry Userinit Report

Hive </mnt/sda1/WINDOWS/system32/config/software>
(...)\Windows NT\CurrentVersion\Winlogon> Value <Userinit> of type REG_SZ, data length 70 [0x46]
C:\WINDOWS\SYSTEM32\userinit.ex e,
(...)\Windows NT\CurrentVersion\Winlogon> EDIT: <Userinit> of type REG_SZ with length 70 [0x46]
[ 0]: C:\WINDOWS\SYSTEM32\userinit.ex e,
-> newkv->len: 68
(...)\Windows NT\CurrentVersion\Winlogon> Value <Userinit> of type REG_SZ, data length 68 [0x44]
C:\WINDOWS\system32\userinit.exe,

userinit.exe search results

a93aee1928a9d7ce3e16d24ec7380f89 /mnt/sda1/WINDOWS/SoftwareDistribution/Download/dd9ab5193501484cf5e6884fa1d22f9e/userinit.exe
25.5K Apr 14 2008
39b1ffb03c2296323832acbae50d2aff /mnt/sda1/WINDOWS/ServicePackFiles/i386/userinit.exe
24.0K Aug 4 2004
39b1ffb03c2296323832acbae50d2aff /mnt/sda1/WINDOWS/system32/userinit.exe
24.0K Aug 4 2004
39b1ffb03c2296323832acbae50d2aff /mnt/sda1/WINDOWS/system32/dllcache/userinit.exe
24.0K Aug 4 2004
e931e0a2b8bf0019db902e98d03662cb /mnt/sda1/WINDOWS/$NtServicePackUninstall$/userinit.exe
21.5K Aug 29 2002

winlogon.exe search results

ed0ef0a136dec83df69f04118870003e /mnt/sda1/WINDOWS/SoftwareDistribution/Download/dd9ab5193501484cf5e6884fa1d22f9e/winlogon.exe
496.0K Apr 14 2008
01c3346c241652f43aed8e2149881bfe /mnt/sda1/WINDOWS/ServicePackFiles/i386/winlogon.exe
490.5K Aug 4 2004
01c3346c241652f43aed8e2149881bfe /mnt/sda1/WINDOWS/system32/dllcache/winlogon.exe
490.5K Aug 4 2004
01c3346c241652f43aed8e2149881bfe /mnt/sda1/WINDOWS/system32/winlogon.exe
490.5K Aug 4 2004
2246d8d8f4714a2cedb21ab9b1849abb /mnt/sda1/WINDOWS/$NtServicePackUninstall$/winlogon.exe
504.5K Aug 29 2002

explorer.exe search results

7712df0cdde3a5ac89843e61cd5b3658 /mnt/sda1/WINDOWS/$hf_mig$/KB938828/SP2QFE/explorer.exe
1009.0K Jun 13 2007
12896823fb95bfb3dc9b46bcaedc9923 /mnt/sda1/WINDOWS/SoftwareDistribution/Download/dd9ab5193501484cf5e6884fa1d22f9e/explorer.exe
1009.5K Apr 14 2008
a0732187050030ae399b241436565e64 /mnt/sda1/WINDOWS/ServicePackFiles/i386/explorer.exe
1008.0K Aug 4 2004
a0732187050030ae399b241436565e64 /mnt/sda1/WINDOWS/$NtUninstallKB938828$/explorer.exe
1008.0K Aug 4 2004
a82b28bfc2e4455fe43022a498c0ef0a /mnt/sda1/WINDOWS/$NtServicePackUninstall$/explorer.exe
980.5K Aug 29 2002

#10 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,076 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:07:57 AM

Posted 12 March 2012 - 01:51 PM

Can you boot normally now?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#11 craad

craad
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:57 PM

Posted 12 March 2012 - 05:00 PM

The computer is now booting without it automatically logging off but I still have the issue of explorer.exe not loading. I can use the Task Manager now though.

#12 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,076 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:07:57 AM

Posted 13 March 2012 - 03:42 AM

Press Windows Key + R, type explorer.exe and press enter. Does the desktop come up now? If not, let me know what error message you get.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#13 craad

craad
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:57 PM

Posted 13 March 2012 - 10:47 AM

Pressing Windows Key + R doesn't pull up the run box but I can get to it through the Task Manager. When I type eplorer.exe the error message the pops up is: Windows cannot find 'explorer.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

#14 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,076 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:07:57 AM

Posted 13 March 2012 - 10:57 AM

Hi again,

Try this please. You will need a USB drive.

Download driver.sh to your USB drive
  • Remove the USB & CD and insert it in the sick computer
  • Boot the Sick computer with the xPUD CD.
  • The computer must be set to boot from the CD
  • Gently tap F12 and choose to boot from the CD
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh -f and press enter.
  • Type explorer.exe and press Enter
  • After it has finished a report will be located on your USB drive named filefind.txt
  • Remove the USB drive and insert it back in your working computer and navigate to filefind.txt

    Please note - all text entries are case sensitive
Copy and paste the filefind.txt for my review

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#15 craad

craad
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:57 PM

Posted 13 March 2012 - 12:08 PM

Search results for explorer.exe

7712df0cdde3a5ac89843e61cd5b3658 /mnt/sda1/WINDOWS/$hf_mig$/KB938828/SP2QFE/explorer.exe
1009.0K Jun 13 2007

12896823fb95bfb3dc9b46bcaedc9923 /mnt/sda1/WINDOWS/SoftwareDistribution/Download/dd9ab5193501484cf5e6884fa1d22f9e/explorer.exe
1009.5K Apr 14 2008

a0732187050030ae399b241436565e64 /mnt/sda1/WINDOWS/ServicePackFiles/i386/explorer.exe
1008.0K Aug 4 2004

a0732187050030ae399b241436565e64 /mnt/sda1/WINDOWS/$NtUninstallKB938828$/explorer.exe
1008.0K Aug 4 2004

a82b28bfc2e4455fe43022a498c0ef0a /mnt/sda1/WINDOWS/$NtServicePackUninstall$/explorer.exe
980.5K Aug 29 2002




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users