100 replies to this topic

[Ztruker]

My bad copy is not a exe, it's a shell (DOS emulated) command, so use: cmd copy c:\windows\explorer.exe c:\windows\explorer.exe.sav see if that works. The expand command should work as I showed before.

[denno]

I just took a guess at "D" 'cause I don't know what letter it is w/o seeing "My Computer." Question = should that line read i386\explorer.ex_ or .exe? Anyway, I put it into a cmd window as written and it says: Microsoft Windows XP [Version 5.1.2600] © Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\Miekro S. Dallalio>expand -r d:\i386\explorer.ex_ c:\w indows Microsoft ® File Expansion Utility Version 5.1.2600.0 Copyright © Microsoft Corp 1990-1999. All rights reserved. Expanding d:\i386\explorer.ex_ to c:\windows\explorer.exe. d:\i386\explorer.ex_: 359533 bytes expanded to 1032192 bytes, 187% increase. C:\Documents and Settings\Miekro S. Dallalio> Izzat right?

[denno]

Well, nothing still happened with Explorer and Explorer.exe. I.e., no icons appeared on my desktop. First, are you perceiving that I got the file copied from the CD into Windows correctly? I can't tell, of course. If so, is a reboot going to help anything?

[appleoddity]

If I may throw in my two cents?

This is a challenging problem, that seems like it has a fairly simple solution (or it seems it is within grasp). I'd really hate to lose the opportunity to diagnose this problem directly before doing a complete reinstall. I feel there are a few more things to try.

I don't believe you are suffering from explorer.exe corruption seems how the file has been restored. I also don't believe your problem is related to the carbonite install but it is possible. More likely just conincidence.

There are a few registry points that may have been changed by a backup program such as carbonite that are related to the startup process explorer.exe goes through.

Its possible those entries are invalid now.

If this problem is simply related to a settings change possibly caused by Carbonite, then try performing a system restore to before the problem occured.. To do so, open task manager again, and then RUN the following command: C:\windows\system32\restore\rstrui.exe

Take your computer back to a day or two before the problem occured.

I also would like to point out that this is an extremely common problem associated with a malware infection. What anti-virus products do you run, and have you been experiencing any malware related symptoms such as warnings from your anti-virus product, or pop-ups, etc? Do you have any reason to believe that you may have an infection?

Edited by appleoddity, 22 May 2009 - 08:40 PM.

[appleoddity]

Well, nothing still happened with Explorer and Explorer.exe. I.e., no icons appeared on my desktop.
First, are you perceiving that I got the file copied from the CD into Windows correctly? I can't tell, of course.

If so, is a reboot going to help anything?

Yes, you expanded the file correctly, albeit probably a different version which is OK.

[LDTate]

denno,
Would you mind following the instructions here and posting a Hijackthis log in the Malware forum?
http://forums.whatth...ers_t34502.html

Please don't post it here but start a new topic in the Malware forum as the log could give us a look at what's running, etc.

[denno]

Hi gents, and welcome to the party. I appreciate the interest in the problem by at least four of you. OK --- tried opening up system restore and the window came up empty. AV is Shield Deluxe Also have whatisit? Adaware? No, I have had no big alarms on malware. SD runs a couple times a week, never shows anything but tracking cookies, if that. I now use Adaware infrequently. Firewall is only Windows. I had Zone Alarm, but awhile ago had problems with IE, switched to FF, ZA has a compatibility problem, had to shut it off. [Just did a malware workup for my wife's computer; and Noviciate suggested some other firewalls to try]. [IE problem seemed to be a takeover. Some new home page appeared; could not get back to Google as home page; in fact, the browser wouldn't go to Google, and a few other sites, including could not sign onto an IE forum. Never found out what the problem had been, but FF has worked fine]. Will I be able to to an HJT scan and all the other stuff with the machine in this condition? Run things from command window and so forth?

[appleoddity]

Sounds like a critical service has failed or has been turned off. All your symptoms point to what sounds like a missing service. First of all, do not post the HJT log here. But, yes, you should be able to run FF or Iexplore and download and run the programs using your new task option.

[denno]

OK, well, I will go get that begun. Should have HJT already on this computer. Can y'all tell me how to open it from cmd? (Dunno what the name of the .exe file is). Then I can make a scan and post it in the malware forum on first post.

[LDTate]

It will be HijackThis.exe Does Task Manager work when you do Atlt/Ctrl/Del ?

[denno]

Well, the next two observations; Tried that in New Task, got message "Windows cannot find HijackThis.exe.........." Meanwhile, went to Malware, went to page to download latest IE version (making sure, as it says, that I have all the updates for Windows), and when the download window appeared and I browsed for where to download it, the window for My Computer was empty. Guess someone there can tell me how to work around all this, step at a time? Oh---yeah, I can get Task Manager to open. 'Bout the only way I'm able to use the computer.

Edited by denno, 22 May 2009 - 09:41 PM.

[appleoddity]

Forget doing windows updates at this point.... That can cause more problems. When you go to download a file and you are prompted where to save the file, add C:\ in front of the filename and it should just save it right in the root of your C: drive. Then you can start a new task using C:\whateverfile.zip, etc....

[appleoddity]

Another option is to download the files on your wife's computer and put them on a flash drive. Then you may be able to just run them from the flashdrive using, G:\whateverfile.zip, (or .exe) while adjusting the drive letter and filename to match the file on your flashdrive. Thats assuming that the flashdrive will actually install in this present state.

[appleoddity]

Sorry to keep posting while you are trying to work.. But, in case I leave for a while, I would like to request that you attach one more file for review here after you post your HJT log in the malware thread. It can then all be reviewed for later.

How to use CodeStuff Starter to manage services:

• Please download and install CodeStuff Starter
• Run Starter by finding it on your start menu after it is installed.
• When the program opens, you will see three tabs on the main screen (Startup, Processes, Services)
• Please make sure you are viewing the "Services" tab by clicking on it.
• Once the Services tab is open, please click the File menu and choose Save as HTML.
• Please save the file to a recognizable location with a recognizable file name. Your desktop is a good place.
• Attach the file in your reply to this message.

Obviously, the above instructions need to be modified somewhat and you need to run codestuff starter with the following command if you installed it in the default location: "C:\Program Files\CodeStuff\Starter\Starter.exe" Save the HTML file in C:\ so you can find the file easily.

Lets hold off on making any other changes to your system at the moment. I'll try to get a malware member to review the HJT log and clear any suspicion of malware infection so that we can move forward freely and not waste our time.

Edited by appleoddity, 22 May 2009 - 09:55 PM.

[denno]

Was able to download and run HJT, posted file and some remarks. Trying to work the Starter thing. Can't seem to locate it to run it. Extracted to Program Files, Desktop, and C drive, but cannot located it from New Task. Can you give me explicit instructions where to extract it to from winRar, and exactly what to type into the new task window? Or should it be a cmd window?

Edited by denno, 22 May 2009 - 10:09 PM.