Explorer.exe Crashing

[LuGer33]

I apologize in advance if this is vague and if I'm not following correct protocols (first post), but I thought I would seek some opinions / advice here on an unusual problem I had with my system the past day and a half.

First a long version, followed by a short bullet list. Both convey same info:

----

I have Windows 7 Home Premium on a Dell XPS M1530 and have had it for a while now with no issues. Randomly last night, after finishing a movie (a .mp4 of 1408), my explorer.exe just started crashing. Over and over. It would come up with the usual message, "explorer.exe has encountered a problem and needs to close;" then close, restart, and pop up with the same error. It kept doing this so I restarted, expecting the problem to be fixed, but when I booted the system back up, the same error occurred.

I've spent the good portion of today trying to fix it. Using sfc /scannow and Start Up Repair from my system's boot menu. When I booted the system in Safe Mode, it worked fine, so I assumed it was a software conflict with a start up program, but after running a Clean Boot, explorer.exe was still crashing. I would have done a simple System Restore, but I had no restore points available - which made me think it was some kind of virus / trojan / malware.

From the Task Manager, and using a different computer, I was able to get my copy of PC Tools - Spyware Doctor up and running. Spyware Doctor returned no infections. I installed and ran Malwarebytes 1.5 as well, and it too returned no infections.

So it wasn't something Windows' Tools could fix (System Repair, etc.), a boot up software conflict (Clean Boot), or something malicious (Malwarebytes, Spyware Dr) that was causing the error, so I just resigned to a reformat.

Until about 5 minutes ago, the error just stopped. First time in 24 hours or so (come to think of it - close to exactly 24 hours. That's kind of weird?) I can use explorer.exe on my computer with no issues.

So do you guys think it's safe to start using regularly again? It's been disconnected from the Internet since I discovered my restore points had vanished. Anyone have any idea what could have been causing this problem?

---
Short Version

• Windows 7 Home Premium; Dell XPS M1530
• Explorer.exe randomly started crashing over and over again with no hardware or software changes
• sfc /scannow, System Repair, other Windows tools found no problems
• Problem does not occur in Safe Mode; problem did occur after a Clean Boot
• System Restore points MIA but Malwarebytes and Spyware Dr. found no infections
• Problem randomly stopped about 20 minutes ago without me doing anything
• Ideas on what caused the problem? Safe to use PC again?

 

[James Colbert]

Hi luGer33. Welcome. I'll forego the obvious '24 hr. virus' quip .

Did you do a full Malwarebytes scan? And also, I really recommend the free version SuperAntiSpyware. A neighbor brought me his laptop last week, and although malwarebytes found a few nasties, SAS found many more. Run a full scan (will take some time) What AV are you running?

James

 

[Britton30]

Welcome to Seven Forums. You might go to msconfig, start up, and see what is starting at boot. Try another security scan with something different, Super Anti Spyware. Just to see what it finds, or not. Make sure you do a definition update before a full scan.
If Malwarebytes is running actively ot another AV, I think it would be safe to go to the web.

 

[richc46]

Tying a clean boot procedure may work
How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

 

[LuGer33]

Thanks for the quick responses, guys. Appreciate it.

Hi luGer33. Welcome. I'll forego the obvious '24 hr. virus' quip .

Did you do a full Malwarebytes scan? And also, I really recommend the free version SuperAntiSpyware. A neighbor brought me his laptop last week, and although malwarebytes found a few nasties, SAS found many more. Run a full scan (will take some time) What AV are you running?

James

Maybe it was a 24 hour bug.

But stupidly, I did not run "full scans," only the normal scans before making this post. I've got SUPERAntiSpyware running a full scan right now. As for antivirus, I've got the version of Spyware Doctor that includes AV protection as well.

I'll report back once the full scans have completed.

Tying a clean boot procedure may work
How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

I did do a Clean Boot and the problem persisted even when all non-Windows programs / services were disabled.

If Malwarebytes is running actively ot another AV, I think it would be safe to go to the web.

Yeah Spyware Dr is running active protection, so I connected.

Any thoughts as to why the problem randomly stopped? I was literally just sitting here, reading crap on this laptop while mine sat next to me, restarting explorer.exe over and over again until it just started working like normal. Super weird.

 

[Britton30]

Any thoughts as to why the problem randomly stopped? I was literally just sitting here, reading crap on this laptop while mine sat next to me, restarting explorer.exe over and over again until it just started working like normal. Super weird.

I suspect for the same reason we have to push a button labeled "Start" to stop (shut down) the computer.

Seriously, I have no idea, but things have broken and fixed them selves for me too.

 

[LuGer33]

Hi luGer33. Welcome. I'll forego the obvious '24 hr. virus' quip .

Did you do a full Malwarebytes scan? And also, I really recommend the free version SuperAntiSpyware. A neighbor brought me his laptop last week, and although malwarebytes found a few nasties, SAS found many more. Run a full scan (will take some time) What AV are you running?

James

Full Scan with SUPERAntiSpyware yielded a bunch of tracking cookies and one suspicious file:

Trojan.Agent/Gen-Frauder which was found in C:\Windows\Installer\MSI6894.TMP

I can't even figure out what that is though, so I have no idea if it was related to the problem I had.

 

[Britton30]

Anyhing with Trojan in its name is no good. Did you manage to clean it?

 

[LuGer33]

Anyhing with Trojan in its name is no good. Did you manage to clean it?

SuperAntiSpyware took care of it as far as I can tell. This was the only explanation I could find on the web:

Trojan.Agent/Gen-FraudLoad is categorized as trojan downloader. Once it infects a comptuer, Trojan.Agent/Gen-FraudLoad will connects to internet and download another malware which is more risky and dangerous. It will be executed on computer without user’s permission.

Trojan.Agent/Gen-FraudLoad | Virus Removal at im-infected.com

Worrisome, but now it's taken care of and I'm not sure how that could cause explorer.exe to keep crashing over and over, unless it downloaded some other malware that did the damage. But then that malware just packed up and left before Spyware Doctor, Malwarebytes, or SuperAntiSpyware could detect / find it?

 

[Britton30]

The Trojan may have had something specific to do and your system wouldn't let it and became inactive, I don't know for sure. Is explorer working now? I would run more full scans to be sure.
Here's more on making a new admin account and transferring your current files.
User Profile - Change Default Location

 

[Layback Bear]

Welcome Luger. I would run sfc /scannow to see if those little nasty have change anything in you system files. If a problem is found run it two more times. Then if it was my computer I would again run full scans with MAM and SAS just to make sure things are okay. If you had any information about your finances, banking, Paypal, ebay, ect I would recommend changing your passwords.

 

[LuGer33]

Welcome Luger. I would run sfc /scannow to see if those little nasty have change anything in you system files. If a problem is found run it two more times. Then if it was my computer I would again run full scans with MAM and SAS just to make sure things are okay. If you had any information about your finances, banking, Paypal, ebay, ect I would recommend changing your passwords.

Yeah I didn't navigate to any important sites since the problem started. Pretty much only this forum --> am I still at risk?

So I ran the Full Scans w/ MBAM and Spyware Doctor over night. I think Spyware Doc finished first and restarted my computer because I can't find the log from MBAM. It came back clean yet again though.

But here's the fun part: explorer.exe is crashing again! So the original problem is back, having apparently needed a break from ******* w/ me and now, fully rested, is back to raise my blood pressure once again. I'm running some scans again (Quick Scans coming back clean) and will try sfc /scannow again as well.

I do have Restore Points available this time though, so worst comes to worst, I can restore to yesterday and see if its working. I'd like to try to figure this out some other way though so it doesn't keep happening. Where is the actual explorer.exe located?

 

[Layback Bear]

You don't have to go to a site before they can steel your passwords if you in any way store them on your computer. Some viruses will also install in restore points. Something else you could do. Ccleaner and in lower left corner is Wipe free space which cleans $Recycle Bin, another hiding place. All this takes time. If none of this solves your problem. Go to start and type in indexing, go there and rebuild indexing, that also takes a lot of time. Keep us posted.

 

[marsmimar]

Have you tried installing a clean copy of explorer.exe from your system files? If this doesn't help you might have to try a Repair Install assuming you're absolutely sure all traces of any malware have been removed.

Open TasK Manager > Processes tab
Highlight (left click) on explorer.exe (not to be confused with iexplore.exe)
Click End Process button, then End Process again on warning prompt
All desktop icons will disappear
Click File (upper left of Task Manager dialog box) > New Task (Run...)
In the Create New Task dialog box type in explorer.exe > OK
All desktop icons will reappear within a few seconds

If this doesn't help I'd try a Repair Install but I don't think you'll have any better luck because it would seem that more than just your system files are damaged or corrupt. If that's the case, and to be sure that all traces of any malware are removed, you might have no choice but to do a clean install from a system image, hidden recovery partition, or install media.

http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

http://www.sevenforums.com/tutorials/31402-clean-install-upgrade-windows-7-version.html

 

[LuGer33]

Open TasK Manager > Processes tab
Highlight (left click) on explorer.exe (not to be confused with iexplore.exe)
Click End Process button, then End Process again on warning prompt
All desktop icons will disappear
Click File (upper left of Task Manager dialog box) > New Task (Run...)
In the Create New Task dialog box type in explorer.exe > OK
All desktop icons will reappear within a few seconds

I've essentially been living out of Task Manager the past two days on this computer (launching anti-spyware apps, getting to Control Panel, etc), so I was aware of explorer.exe's crazy behavior (starting, crashing, disappearing from processes, restarting, reappearing, crashing, disappearing, etc.). Launching a new version never helped. Thank you though.

In other news...

Success! (for now)

I found the AppCrashView tool on the web and ran it on my Desktop. I had to scroll through a LONG list of explorer.exe crashes it reported, but I eventually got to the first one from two days ago. The report generated this:

explorer.exe Stopped working 6/11/2011 11:07:24 AM 0xc0000005 0x0009b890 DivXMFSource.dll 1.0.0.72

So I Googled "DivXMFSource.dll" and the first result was:

Codec Guide • View topic - DivXMFSource.dll causes Explorer to crash

Just started noticing this today, after downloading this movie off of Vodo. Now explorer crashes whenever I try to do something with the folder, including highlighting it or trying to right click it. I was able to navigate in and watch Sintel with no real problems, but now it's crashing like crazy. I've looked at my event logs and it appears to be an issue with DivXMFSource.dll.

So this guy essentially had the exact same issue - watched a movie then explorer.exe went freaking crazy, so I assumed this had to be it. That fine gentlemen uninstalled DivX entirely, but I just went to the DivX folder and deleted the specific .dll causing the problem (probably will cause issues w/ DivX, but I'm not too worried about that atm). Used CCleaner to wipe it away from my recycle bin, then launched explorer.exe and it didn't crash! All the other times I launched a new version, it crashed right away, so I'm assuming I'm good now.

Of course, if it starts crashing again, I'll be back here. As annoying as this was, at least I'm confident my system wasn't compromised and that all my ASW / AV software is working correctly.

Thanks everyone who replied to this - very nice community you guys got here.

 

[Layback Bear]

I would not use bittorrent Vodo. This can cause all kinds of problems.

 

[LuGer33]

I would not use bittorrent Vodo. This can cause all kinds of problems.

I don't, that was the other guy. Just that my problem started after watching a video file like his did.

 

[marsmimar]

Glad to hear the promising news. Hope this is the permanent fix you've been looking for. And congrats on your troubleshooting!

 

[Britton30]

Good to hear you figured it out.

I use the DivX player too, in its troubleshooting, follow the links and backdate it to, I think, version 1.5.