Missing explorerframe.dll Fixed but no Explorer ?

[JerometheGiraff]

I ran MalwareBytes because I knew I had malware and adware on my computer, somehow it got on my system. MalwareBytes successfully removed everything; to my surprise restarting my computer and loading windows caused an explorerframe.dll is missing. To fix this, I ran sfc /scannow as an administrator, I was informed there was problems and they were fixed. Restarted the computer once again, the explorerframe.dll is missing error is gone but windows doesn't load, since I have a background loader, I can see all my drivers loading, except one thing that makes my computer usable, explorer, no start button etc.

 

[Jackbnimble924]

Hi Jerome,
I've done the same thing on a friend's computer (MBAM, sfc for explorerframe) and am getting the Windows load without explorer.exe as well. If I try to start it manually the process closes itself after a second (before loading Task bar, etc).
Did you manage to resolve your issue?
If so, I'd really like to know how
Thanks

 

[JerometheGiraff]

Hi, I did manage to resolve, I had to restore a 2 month old backup, it was the only way, that or you'd have to re-install fresh

If you had the same virus/malware that I had, Malwarebytes Anti-Malware will remove the Virus/malware, but because the Virus/malware embedded its self deep into the windows registry, there is no other solution then what I mentioned, it crippled everything else in the process. I did endless searching for answers before restoring my backup, hours upon hours hoping I didn't have to go that route, I came up empty handed.

I got attacked today, by two malware, one I removed, the other is not a major threat so I will remove soon. I have a solution in the works, but I haven't got it fully operational yet

 

[Jackbnimble924]

Didn't have a backup to restore from but my persistence won and I found a solution.

The adware/malware had infected the explorerframe.dll and MBAM mistakenly removed a bunch of registry keys that referenced explorerframe.DLL along with the malware specific keys.
I restored the keys (only) from the MBAM quarantine then went through the log and manually removed the restored keys that referenced the malware (in my case, something called plesome), and left the others that only referenced explorerframe.DLL alone.
After a reboot, explorer.exe was running again and they were no longer getting hidden iexplore windows making random sounds!

 

[JerometheGiraff]

Wait, how did you do this ? If I had of know three weeks ago; I got another virus three weeks later, Bronchitis, coughing is a real pain in the ass, especially when recovering !

 

[Jackbnimble924]

In MBAM (the latest version at least) I went into the quarantine and selected all the registry keys that had been removed by the scan.
Then I've gone into regedit and checked out the keys manually, using the MBAM results log as a guide.
Only about 6 keys in my case out of the 30 or so removed, actually referenced the malware. So I deleted those keys and left the rest which I assume are regular keys that reference Explorerframe.DLL some/all of which are required to actually run explorer.exe.

Might not seem very safe, but another MBAM scan was clean and the symptoms are gone so I'm pretty happy!

Hope you feel better soon!

 

[JerometheGiraff]

That was a smart way, I'm going to keep that method in mind. I hope I feel better soon tool, I had a cold,flu & Bronchitis combined over several days, real brutal.