explorer.exe dead (cannot kill it)

waterdrinker · 03 Apr 2011

Hello,
I'm having this problem since several days. I have windows 7 64bits. Below describes what happens every time I have the problem:

1.Explorer can no longer display any icon inside a folder. if I open a folder, only file/sub folder names are displayed; if I open "computer", it displays nothing inside and is always searching without terminating.

2.So I try to kill the process in task manager. The desktop disappears as normal, but explorer.exe persists in the list. Meanwhile other applications function well.

3.If I try to open another explorer, it does. But at this time i cant open any folder (looks like the previous explorer is blocking all). More I try to open folders, more explorer.exe appear in task manager. I can kill them all except the dead one.

4.At last I cannot shutdown or restart. The system is stuck at the "logging off" screen and never ends. I have to shut it down manually. (It hurts..)

(end )

Successfully restarting the OS, everything returns to normal, until the problem comes again..

Please, how can I solve the pb? (I'm having it, i don't want to hurt the hard disk..)

Mike Connor · 03 Apr 2011

First, check to see if you have any malware on your machine.Download this and run it;

Malwarebytes

tell us what it says.

Regards....Mike Connor

waterdrinker · 03 Apr 2011

3.5：Now I'm at step 3. I can display the desktop but it's dead too (no right click menu). But the start bar is fine.

waterdrinker · 03 Apr 2011

Thank you Mike Connor. I'm running a full scan!

waterdrinker · 04 Apr 2011

Hello!

So I ran a full scan. Here is the log. I deleted some items and ignored those which seem safe to me.

HKEY_CLASSES_ROOT\CLSID\{3F5A62E2-51F2-11D3-A075-CC7364CAE42A} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{317AA3CE-DFF9-454F-8131-FFC2569113CE} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\YingSoft (Malware.Trace) -> Quarantined and deleted successfully.

c:\program files (x86)\LuDaShi\computerz7.dll (Trojan.BHO) -> Not selected for removal.
c:\program files\shadow\TheWorld.exe (Trojan.Chifrax) -> Quarantined and deleted successfully.
c:\program files (x86)\Tencent\QQ\Plugin\com.tencent.qqpet\bin\QQPet\qqpetdazzle.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.
c:\Users\Lijiayi\AppData\Local\Google\Chrome\user data\Default\Cache\f_0007dc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Lijiayi\AppData\Local\Tencent\qqconcept\1.2.1.1\2010.05.05t06.59\Virtual\STUBEXE\@programfi les@\Tencent\qqconcept\Bin\qqconcept.exe (Trojan.Agent) -> Quarantined and deleted successfully.
d:\LiJiaYi\documents\Etudes\4EII\openGL\rectangle\Debug\openGL.exe (Trojan.Agent) -> Quarantined and deleted successfully.
d:\LiJiaYi\documents\书籍\林语堂文集.exe (Spyware.AdaEbook) -> Quarantined and deleted successfully.
d:\LiJiaYi\documents\书籍\魔戒\魔戒全集（修正插图版.五部）.exe (Trojan.Agent) -> Quarantined and deleted successfully.
d:\LiJiaYi\

The log finishes here.. maybe because of Chinese characters.

After that I redid a full scan and there's nothing dangerous left.
Please, what is the problem of my os?

Regards

DreemWarrior · 04 Apr 2011

Also, download and run SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware! make sure to update the program before scan. The problem isnt the OS, its the malware/spyware on your system.

Mike Connor · 04 Apr 2011

Well, the malware changes settings on various things and can cause other damage. Your machine was obviously infected, and there is no way of knowing what all this malware has actually done without very long and involved investigation. Even after removing the malware you don't automatically get your settings back.The only really satisfactory procedure is to wipe your machine and re-install Windows. If you have a good backup image then you can use that instead.

Sorry, but that's how it is. In future, make sure you have the Windows Firewall and an Anti-virus program running. Microsoft Security Essentials is adequate for many users.

In some countries various blockers and security programs are not readily available.

English to Chinese (Simplified) translation

那么，恶意软件变动对各种事物的设置，并可能导致其他损坏。您的机器明显感染，也没有什么都知道这个恶意软件其实没有很长，涉及的调查所做的那样。即使你删除了恶意软件不会自动让你设置回来。，唯一真正满意的过程是消除你的机器和重新安装Windows。

很抱歉，但是这是怎么回事。确保你在未来有Windows防火墙和反病毒程序运行。微软安全基础是对很多用户足够了。

在一些国家的各种受体阻滞剂和安全方案不易获得。

Regards....Mike Connor

waterdrinker · 05 Apr 2011

Thank you so much.
(And it's nice that you translated it into Chinese

I'll manage my files and reinstall 7.

btw, it's strange that my avast! and windows firewall have said nothing (or have deleted infected files..)

Thank you 谢谢

Mike Connor · 05 Apr 2011

My pleasure. Please let us know how things work out for you.

我很高兴。请让我们知道如何为你工作的事情了。

Regards....Mike Connor

seekermeister · 05 Apr 2011

Before committing to a complete reinstallation of the OS, I would suggest running chkdsk /r, sfc /scannow. If neither of those two fix the problem, do a repair install, so that you will retain your programs and data. Of course, if all else fails, a clean install fixes all woes...except those caused by hardware and user errors.