no longer able to restart Windows Explorer

[pikalax]

Following a string of updates installed this afternoon, I am no longer able to restart Windows Explorer, be it from the context menu or from Task Manager (Run explorer.exe). The old instance closes successfully, but the new instance does not run. I am no longer able to run explorer.exe from system32. C:\Windows\explorer.exe still works, but it's the explorer.exe that can't be configured to start with administrator privileges.

 

[MilesAhead]

There should be a Restore Point from before the updates so you can roll it back.

 

[pikalax]

I tried that and it worked, though not without some residual DLL-related crashes on boot. I backed up the system32/explorer.exe to my desktop and started the updates again. I'll report back after the reboot.

EDIT: No dice. Not even restoring the backed-up copy of Explorer.exe seems to have helped. The system32 copy of explorer.exe is still unable to run; when called, it does not appear in the process list, which means something is killing it as soon as it is launched. Here's the list of all the updates installed.

It seems to be dependent on where explorer.exe is run from; swapping around various instances of explorer.exe seems to have no effect. To reference my earlier problem, running explorer.exe from C:\Windows causes the system tray icons (volume, network, power status) to be irrestorably missing. Running from C:\Windows\System32 formerly fixed the problem. Running from C:\Windows\SysWOW64 only brings up an Explorer window, not the desktop.

 

[MilesAhead]

Unfortunately, unless you see a post where someone tracked down the offending update and named it, it's a process of elimination. Is there some particular update you need? My inclination would be to restore to a working state and leave it that way. Then I'd watch for indications of the cause.

But that's my modus operandi. Not everyone agrees. But I hesitate to install fixes in a bunch unless it's a formal Service Pack. Just too many variables in the equation.

 

[pikalax]

I think I've solved my problem using the following two steps:
1) I went into C:\Users\[MY-USERNAME] and showed all protected hidden files. There were several files named ntuser.dat followed by a 64-bit string. I moved all but three of them to a backup folder on my desktop and restarted my computer. I was then able to restart Explorer from system32.
2) My original problem with explorer.exe was that it would launch from C:\Windows with standard privileges, causing the battery, WiFi, Volume, and Action Center system tray items to be irreversibly hidden. I solved this problem by going into regedit to the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and changing its value from 'explorer.exe' to 'C:\Windows\system32\explorer.exe'. After a restart, this problem was determined to be fully solved.

 

[MilesAhead]

Good job. Thanks for posting the solution.

 

[AddRAM]

You should still Run a system file check if you haven`t yet.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[pikalax]

I did run that, and it found no issues it could repair.

 

[pikalax]

UPDATE: The problem returned following the most recent Windows update, but was resolved when I logged off and back on without a system reboot, implying the problem is potentially related to the automatic login protocol I set up on this machine. I'll try disabling that prior to my next round of updates and report back. For now, though, I am marking this as SOLVED.

 

[UsernameIssues]

~~~
2) My original problem with explorer.exe was that it would launch from C:\Windows with standard privileges, causing....
~~~

Does "standard" mean the medium integrity level?



If so, then that is as it should be. Entire papers have been written on how Microsoft manages to force Explorer to stay at the medium integrity level for security reasons. If you manage to get around that, your system might not be as secure as it should be.

You should still Run a system file check if you haven`t yet.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

I did run that, and it found no issues it could repair.

Does that mean that there were no integrity errors?
Or
Does that mean that there were integrity errors that could not be repaired?

 

[pikalax]

The system did not report any errors following the execution of sfc /scannow.

 

[pikalax]

I spoke too soon. I did another sfc /scannow and got a message that it found "corrupt files but was unable to fix some of them". Here's the log.

 

[pikalax]

It's been 2 weeks with no response to my sfc /scannow log. The problem persists, and I am at a loss as to how to solve it. The symptoms occur every time I run a Windows update

- c:\windows\system32\explorer.exe fails to start with Windows as directed in the SHELL registry key. Attempts to start this process using conventional methods (eg. "New Task" in Task Manager) fail; the process does not appear on the list in Task Manager.
- c:\windows\explorer.exe runs "normally" - that is, it is able to start, however system tray icons such as VOLUME, POWER, and NETWORK indicators are irrestorably missing.
- When calling c:\windows\system32\explorer.exe while another instance of explorer.exe is active, the result is a window within the existing explorer.exe process.
- The problem resolves itself after 2-3 days and remains resolved until the next round of system updates.
- Windows behaves oddly when the shell does not start on logon i.e. when HKEY_LOCAL_MACHINE\SOFTWARE\WINDOWS NT\WINLOGIN\SHELL = C:\WINDOWS\SYSTEM32\EXPLORER.EXE when this process fails to launch. For instance, I am unable to load my touchpad settings during this time; the default settings load instead. I am unable to modify these settings until the symptoms clear up. This is very disorienting for me, as I tend to type while resting my palm heels on either side of the touchpad, so I frequently touch the touchpad, and the default settings interpret this as a LEFT MOUSE CLICK unlike my custom settings.

 

[UsernameIssues]

I have asked others to take a look at you SFC results. That is not an area that I can help you with.

 

[gregrocker]

SFC /SCANNOW Command tutorial shows how to replace any named problem files. If this fails you can consider doing a Repair Install.

Have you checked thoroughly for infection using Malwarebytes and your AV as it may not repair until disinfected. If you are running a bloatware AV then uninstall it and install Microsoft Security Essentials, run a Full scan and try running with it for awhile to see the difference.

In addition work through the other Troubleshooting Steps for Windows 7 which almost always uncovers the problem.

 

[matts6887]

Also; in addition to what greg mentioned; I would do a spyware scan as well using the program at the link below; even though it may not be something spyware related; its still worth doing a full scan of your system.

SUPERAntiSpyware - Downloading File

 

[NoelDP]

There is almost never any point in running an SFC scan more than once unless file changes have occured. Almost the only thing it chanes is the look of the summary report. I'lltake a look at the log when I get back to a real pc

 

[NoelDP]

OK - back a a PC now

Here's the error from the SFC log...

 Line 239561: 2014-03-23 12:42:30, Info                  CSI    00000430 [SR] Repairing 1 components
 Line 239562: 2014-03-23 12:42:30, Info                  CSI    00000431 [SR] Beginning Verify and Repair transaction
 Line 239563: 2014-03-23 12:42:30, Info                  CSI    00000432 [SR] Cannot repair member file [l:40{20}]"UIAutomationCore.dll" of Microsoft-Windows-UIAutomationCore, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 (10), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file cannot be checked

There don't appear to be any other errors on the past couple of weeks, in the CBS background log.

I'll post a fix for this in a few minutes.

 

[NoelDP]

I've uploaded a file - pkxaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\pkxaa
hit the enter key - if you get a 'Not Found' error try
DIR D:\pkxaa
or
DIR E:\pkxaa



The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...



XCOPY <drive>:\pkxaa <drive>:\windows\winsxs /y /i /s /v /h



(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )



run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

 

[pikalax]

If the only error is in the UIAutomationCore.dll, then I'll choose to ignore it. I have modified that file to allow FSX to run in Windows 7. The built-in version of this DLL file causes a fatal error in FSX with 100% certainty.