I have an XP desktop that suddenly froze, and upon rebooting twice (it wouldn't get to a login screen the first time for some reason), started presenting me with the network administrator-style login box instead of the standard XP Home login that I'm used to (but no Domain option like I see on my computer at work, just username/password). My password would not work (gave me the standard message about passwords needing to be checked), but if I entered NO password, it would appear to log on, bring up my desktop background . . . and then give me this dialog:
Explorer.EXE - Application Error
The application failed to initialize properly (0xc0000006). Click on OK to terminate the application.
Clicking OK leaves me with a blank desktop. At this point the only thing I can do is bring up Task Manager with Ctrl+Alt+Del. I don't see anything suspicious in the running processes, but the moment I move to the File menu to try and start up a new process, the manager freezes. (I can eventually get it to close and open a fresh one, but clearly there is no way to get explorer.exe to work--or even a terminal window.)
I'm unable to run any program inside that machine, but since it's sitting right next to this one, I can read and type in the list of running processes along with the username associated with them and the memory usage (CPU is negligible--all processes are 0% except for System Idle Process at 99%):
svchost.exe LOCAL SERVICE 3,012K
svchost.exe NETWORK SERVICE 2,984K
SbieSvc.exe SYSTEM 2,536K
taskmgr.exe my username 4,368K
svchost.exe NETWORK SERVICE 3,892K
c2c_service.exe SYSTEM 5,528K
svchost.exe SYSTEM 4,472K
ati2evxx.exe SYSTEM 3,160K
lsass.exe SYSTEM 1,076K
services.exe SYSTEM 3,840K
winlogon.exe SYSTEM 1,272K
NitroPDFReaderDriverService.exe SYSTEM 2,236K
csrss.exe SYSTEM 3,412K
jqs.exe SYSTEM 1,448K
mDNSResponder.exe SYSTEM 2,874K
AppleMobileDeviceService.exe SYSTEM 3,272K
svchost.exe LOCAL SERVICE 3,424K
AvastSvc.exe SYSTEM 1,376K
smss.exe SYSTEM 432K
winvnc4.exe SYSTEM 3,412K
svchost.exe SYSTEM 3,420K
ati2evxx.exe SYSTEM 4,880K
System SYSTEM 256K
System Idle Process SYSTEM 28K
I should note that of the above, I do have NitroPDF installed but never use it, I do have an iPod Nano hence the Apple device service, and I do have VNC running at startup (though I usually end up closing it right afterwards--never got around to removing it from the startup processes).
Since I was unable to get this to a usable state, I attempted scanning with two outside tools:
First, I already had a Linux Mint 13 Mate 32-bit live DVD, and am somewhat familiar with Mint, so I booted into it and "installed" the Linux equivalent of ClamWin to memory and did a scan. Although it found a few of my archives (I have some zip files of old DOS games that trigger antivirus alarms, but I have never opened them so they do not worry me), there were no major suspicious results. I was unable to save the results of the scan as I accidentally tried opening a large pdf file that froze the OS and I had to reboot.
I also tried running the AVG Rescue CD v120.12083. It did a full scan, found one file--in a Downloads folder--that was suspicious and healed it. However, this file was not one I had run for years, if that, so I'm quite positive that that had nothing to do with the current issues.
I'm still very suspicious that this is a virus, or else the operating system has gotten seriously corrupted. I can find lots of hits on google for this error but they all seem to presume that one can actually log in, if not to normal mode, to safe mode. However, I get the SAME results in safe mode. So whatever this is, it's quite serious.
When this first occurred, I was on the verge of getting a new computer anyway, so I just accelerated the process and am now running Mint 13 Mate 64-bit on a new desktop I built but would like to recover the old XP box for some games that I can't run in either Wine or a VM. If I have to, I'm willing to re-install (provided that I have a way to retrieve the product key, since I don't think I have it written down anywhere). But it would really be nice if I could figure out what virus (or whatever else it could be) is doing this and clean it up without a complete reinstall.
Edited by Doranwen, 15 April 2013 - 01:43 AM.