What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Explorer.exe crashing all the time

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi! I got a new PC for a while ago :) But one reacuring problem I have is that the process explorer.exe crashes all the time following drwatson freezes to When it happends I need to press CTRL ALT DEL and end drwtsn32.exe process before explorer.exe will restart itself (or before I can restart it if it dosent automaticly). This happends pretty often when I am browing thrue folders on my hardrive and it is quite anyoing. Could someone check the HJT logg below and see if it any malware that is causing it? Wold be very appreciating. HJT logg: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:56:07, on 2009-05-30 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program\Delade filer\Autodesk Shared\Service\AdskScSrv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program\VIA\VIAudioi\HDADeck\HDeck.exe C:\Program\Säkerhet\ZoneAlarm\zlclient.exe C:\Program\Säkerhet\WinPatrol\winpatrol.exe E:\Program\Filhantering\PowerISO\PWRISOVM.EXE C:\WINDOWS\system32\rundll32.exe C:\Program\Java\jre1.6.0_07\bin\jusched.exe E:\Program\Multimedia\Itunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program\MSN Messenger\MsnMsgr.Exe C:\Program\SKERHE~1\ZONEAL~1\MAILFR~1\mantispm.exe C:\Program\Skype\Phone\Skype.exe E:\Program\Internet\Orbitdownloader\orbitdm.exe E:\Program\Internet\Orbitdownloader\orbitnet.exe C:\Program\iPod\bin\iPodService.exe E:\Program\SkrivLasa\OpenOffice.org 3\program\soffice.exe E:\Program\SkrivLasa\OpenOffice.org 3\program\soffice.bin C:\Program\Skype\Plugin Manager\skypePM.exe C:\Program\Java\jre1.6.0_07\bin\jucheck.exe C:\Program\MSN Messenger\usnsvc.exe C:\WINDOWS\explorer.exe E:\Program\Internet\GreenBrowser\GreenBrowser.exe E:\Program\Verktyg\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - E:\Program\Internet\Orbitdownloader\orbitcth.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - E:\Program\Internet\Orbitdownloader\GrabPro.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HDAudDeck] C:\Program\VIA\VIAudioi\HDADeck\HDeck.exe 1 O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program\Säkerhet\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [WinPatrol] C:\Program\Säkerhet\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [PWRISOVM.EXE] E:\Program\Filhantering\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [QuickTime Task] "E:\Program\Multimedia\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "E:\Program\Multimedia\Itunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 3.0.lnk = E:\Program\SkrivLasa\OpenOffice.org 3\program\quickstart.exe O4 - Global Startup: Orbit.lnk = E:\Program\Internet\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: &Download by Orbit - res://E:\Program\Internet\Orbitdownloader\orbitmxt.dll/201 O8 - Extra context menu item: &Grab video by Orbit - res://E:\Program\Internet\Orbitdownloader\orbitmxt.dll/204 O8 - Extra context menu item: Do&wnload selected by Orbit - res://E:\Program\Internet\Orbitdownloader\orbitmxt.dll/203 O8 - Extra context menu item: Down&load all by Orbit - res://E:\Program\Internet\Orbitdownloader\orbitmxt.dll/202 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program\Delade filer\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - E:\Program\Bild\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe – End of file - 5826 bytes
Post #2
Hi,

Nothing obvious in the log,

let's check further…please do the following:

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Run an on-line scan with Kaspersky

Please do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.)

If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.


  • under the Scan section on the left:
    Select My Computer
  • The program will now start and scan your system. This will run for a while, be patient and let it finish.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
You can refer to this animation by sundavis.
Post #3
Took me a while to get Kaspersky to download the updates properly, had to update Java :) Ow well here are both Mbam and Kaspersky's logg. Note about the Mbam logg: The line that are about infected registery post is proberly because I have set those settings in the security center in windows, when I had removed that with Mbam I got the red shield icon besides the clock. Mbam logg (Want a translation?): Malwarebytes' Anti-Malware 1.37 Databasversion: 2236 Windows 5.1.2600 Service Pack 2 2009-06-06 11:55:52 mbam-log-2009-06-06 (11-55-52).txt Skanningstyp: Snabb skanning Antal skannade objekt: 81154 Förfluten tid: 3 minute(s), 18 second(s) Infekterade minnesprocesser: 0 Infekterade minnesmoduler: 0 Infekterade registernycklar: 0 Infekterade registervärden: 0 Infekterade registerdataposter: 3 Infekterade mappar: 0 Infekterade filer: 0 Infekterade minnesprocesser: (Inga illasinnade poster hittades) Infekterade minnesmoduler: (Inga illasinnade poster hittades) Infekterade registernycklar: (Inga illasinnade poster hittades) Infekterade registervärden: (Inga illasinnade poster hittades) Infekterade registerdataposter: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Infekterade mappar: (Inga illasinnade poster hittades) Infekterade filer: (Inga illasinnade poster hittades) Kaspersky logg: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Saturday, June 6, 2009 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Saturday, June 06, 2009 11:55:57 Records in database: 2318124 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 105972 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 01:18:59 No malware has been detected. The scan area is clean. The selected area was scanned.
Post #4 last edited
Hi, It doesn't appear as though there are any infections. Please describe how your computer is behaving and what issues are outstanding
Post #5
Sometimes when I browse for files my explorer crashes and I need to restart it. It doesent happen all the time and I don't know what is causing it. Would be alot easier to get it fixed if I knew what the problem is. Atleast I now know there isent any malware that is causing it. Thanks for helping out with that :notworthy: I noticed now that there is new updates avalible for my computer, do you recommend applying thoose? (I regulary have that check off :unsure: )
Post #6
Hi,

I recommend starting a new topic in the General Hardware forum - as there may be some hardware failure or some other reason for the crashing. Once that has been resolved then I would do the updating.

Good luck.

Link back to this topic so they can see you are clean of Malware.

I will close this thread now as this is not malware related.
Post #8
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI