windows explorer has stopped working

[Judiver]

Hi, I'm a newbie here, not awfully computer literate... as I got myself into a mess. I hope someone here can help me.

A couple of days ago I installed some software from the internet and uninstalled it almost immediately. I do remember haven given permission to an interactive connection and was even stupid enough to give my computer password ... I remember having seen a message with a port being assigned to it. Afterwards I got suspicious and going over my user accounts I noticed permissions to an unknown user account and also an interactive account. I wanted to get rid of those asap. The accounts did not show up among the user accounts in the Control Panel and I eliminated the unknown account in my user account in c:\users. I also denied and/or eliminated some inheritance permissions. I can't recall exactly what I did and where, but now windows explorer has stopped working for the only user account (with admin privileges) I have. I can only work from the admin account.

This user account also doesn't work when booting in safe mode.

Can someone please help me ? I am afraid of making things worse if I touch more stuff without knowing what I'm doing.

Judith

 

[ICIT2LOL]

Hello and welcome Judith yes my friend that was indeed a really bad move. Now if it were me I would be running these
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
Malwarebytes | Malwarebytes Premium
AdwCleaner Download
ADW download from bleeping computer delete any rubbish found with the malware scans
(NB If you are running Kaspersky as the main AV then it might need disabling it when trying ADW because it does not like it at times)

I am assuming you ran a scan with your own AV?

Now after that I would be inclined to run a system restore to before you downloaded that junk. Let us know if you do and what was the outcome.

 

[Judiver]

Hi Icit2lol,

Thanks for reaction and sorry I haven't gotten back to you earlier.

Strange things are happening... Let me give a resume.

After having had the initial problem (not being able to log into with windows explorer with my user account - by the way the I/O error code I got then was 0xc000185), I ran a couple of security scans that I have on my machine but they didn't find anything really nasty (I don't think my problem is caused by spyware, I think it is caused by something stupid I did > delete a user account and/or denying an account to have access and thus generating a conflict).

Then I discovered I could still see my files. So I made a (new) back-up of all my docs on a flash drive.

I checked if I could go back to a restore point dating from before the initial problem happened, but lots of restore points had been created since then (mostly due to installation of Visual Basics and also a Windows update) and there was none that was from before that date. So I couldn't restore to a 'good working' state but I restored to a point 1 before the last one in the list. I also made a new restore point before touching anything else, just in case.

A sfc /scannow revealed 2 files missing at 1st attempt. At 2nd scan all was OK.

Not wanting to do more stupid things to my computer, I contacted this forum.

In the meantime, waiting for someone to reply, I discovered an account WMPnetworkSvc in my pictures folder that I had never seen there before. Looking on the internet a website advised to uncheck Windows Media Player Network Sharing Service in msconfig, services. Which I did. The user account continues to show in the pictures folder though.

Then a popup window appeared (I can't remember if I made a new restore point or not at that time), saying something like "break point reached". It appeared that all my restore points all had gone, there a only 5 system image restore points from 2013 (when I first "adopted" this laptop). Checking the internet to what might have been the problem here, I raised the space allocated to restore points from 25% to 50% = 116GB (although I do not think that this was the problem, as my laptop always eliminated the oldest restore point when a new one was created).

Now windows explorer even stopped when logging on to my admin account.

I re-checked the unchecked WMPnetworkSvc (in case this was that caused the problem).

I did a chkdsk but it stopped a 22%... ?

At this point you wrote a reaction. So I did a scan with Superantispyware (which found some tracking cookies, adware.downware.variant, and c:\users\ben\appdata\local\nsj8a5e.tmp... ?) and Malwarebytes. I got an error code whilst installing Malwarebytes (IPersistFile save failed code 0x80070005 access denied). A scan found 1 malware (rogue.multiple) in ProgramData and for the remainder only potentially unwanted programs (among which Wiseregistrycleaner and spyhunter, I kept both). In watching the scanning process I saw that Malwarebytes scanned the 'unknown' user account that I had deleted in the c:\$recycle bin.

The account is S-1-5-21-1936491739 etc. and retrospectively I think that although the account is named "account unknown", it may be a legitimate account which I never should have deleted in C:\users. In some places it still is on my machine and the unknown account turns into HomeUsers when I open the security tab. So I looked in the recycle bin, but I cannot find it there (even when unchecking the "hide system operating files"). I have no clue how to find and retrieve it. It must be somewhere as Malwarebytes scanned it. By the way, there is 1 recycle bin that has 5,6 GB in it in 2135 files and 43 folders, which seems ridiculously high.

I haven't run adwarecleaner (which I used to have on my laptop, I must have uninstalled it at some time...), as I do not want this account to be eliminated, if it is still out there and retrievable somewhere. I have the feeling that eliminating it is at the origin of all my problems.

Another chkdsk hung at 22%, then continued and and completed and informed me that there is an error in index $I30 for file 931 and 419411.

I cannot do a chkdsk /f or /r. It gives me the following error message:
"The type of file system is NTSF. Cannot lock current drive.
Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts ? (Y/N) "

SFC /scannow gave no integrity violations.

I can log into my admin account again without window explorer stopping (don't know what did the trick), but still not the only user account I have.

By the way you have to know that this computer used to be my sister's and when she gave it to me to use (in 2013), it had a 1 admin account and only 1 user account. No new account account could be created (I can create it, but no registry files or a folder is created and trying to logon fails). I spent a week trying to find a solution to this problem (I am apparently not the only one, it seems frequent in Windows 7) but there seems to be none, except for reinstalling Windows 7... maybe... To work around this predicable state I gave the only user account admin privileges. All that I have left now is the admin account and I cannot created a new user account. Guest account is also not working.

Well this is where I stand. One admin account, one (corrupt?) user account on which windows explorer doesn't work, cannot create a new account and I have no useable restore points. I have a system repair disk, but I am not sure how that works, if it repairs user account, and if I will loose things (for instance installed programs).

Oh yes, there also is that interactive account (for which I give my computer password, I cannot believe I did that, I usually am pretty careful... must have had a black out up there in my brain...). It didn't show up in the control panel and I deleted it in c:/users, but it stills shows for instance in the security tab of Firefox and Chrome. How to un-allocate the port that it was allocated to ? As I give permission for the connection to be set up, an antivirus program will not catch it...

Sorry to give such an elaborate resume, I have no idea what can be important and what not to draw up the diagnosis for this sick computer...

I hope you have some ideas as to what I could try. And thank you in advance for your time, I much appreciate it.

Judith

 

[torchwood]

Hi Judith,
after a quick once over,
The WMPxxxxxsrv and User account SHOULD NOT be in your pictures folder, System32 type folders only.
WMP auto-connects to other site's/users, so basically you've been ALLREADY compromised.
DELETE THEM

Disconnect from the NET then change your passwords, and if you know which port No's being used block it.

The user account is causing the 0Xc error, registry corruption, and removing it is possibly why your recycle bin is so big.
(note there is an option to restore ALL - use it to check)
Unchecking WMP in SERVICES just stops it, removal is via Programs/features >> features

Do you have another comp, if not then your SAFEST option is a clean install.
(note scan your recovery usb you made BEFORE re-installing from it, even then could be compromised.)

Can provide you with a W7 SP1 iso if required.


Roy

 

[torchwood]

Its not IE, its the system exe windowsExplorer.

Roy

 

[ICIT2LOL]

Well Judith I am with Roy on this one and as long as you have your data backed up rather than run around trying to track down something that may prove to be un-trackable because the system seems to be compromised or corrupt in maybe a few ways - then a clean install is your best bet.

Now providing you have got the activation code you can download an ISO to do that if you have not got the original installation media. The code is on a sticker on the bottom of your machine - just make a note of it before you start to do anything. Another thing you can do to verify that code is to run software in this
Product Key Number for Windows 7 - Find and See both of the softwares in that are good to use to find the key for your machine. Just be careful if you ever post back with key details to make sure the code is partially or completely obliterated for security reasons.

to do a clean install see this Clean Install Windows 7 and early on in the tutorial there is link or tow for that ISO download. It will need to have a bootable disk (DVD) or USB stick (at least a 4GB one) made to boot the OS from.

Personally what I would do if it were me would be to buy a new 500GB SSD to install the OS onto - it saves having to clean the old drive and the SSD you will appreciate the performance difference.

Edit: Now I meant to mention as you have a Toshiba of some vintage it is an easy job to swap out the hard drive if you are stuck I can link you to a disassembly site that will show you how it is done.

 

[Judiver]

Thanks for you your reactions.

First in reply to your message, Roy, I only want to use re-install if all else fails. I have a system repair DVD and also a HDD Recovery on the D drive, in case... When I adopted this laptop I spent 3 weeks in getting rid of all the junk that was there (trying not to eliminate vital things...) and installing all my data and programs, some of which were very old (operating on Windows 1995, I think ?), and some of which were searching for a link to confirm my legitimate copy whereas the link and/or the company didn't exist anymore. I found patches, ways to work around etc. to install and make it all work, but if I can avoid it, I never want to go through that process again, at least not until I buy a new pc! It is risky to throw everything away if you're not sure if you can get it back and working again...

In the mean time I did some more searching. I cannot exactly recall what I did (I must remember to make notes the next time I do something stupid as to give my password and start messing with my computer), but I recall wanting to get rid off the INTERACTIVE account that was created. "Remove" was greyed and I couldn't change anything because of the inheritance. I recall denying access and removing inheritance in some places. I remember an error message popping up saying I could created conflicts but I could not cancel to get out of there without making the changes. Most likely this created an "unknown user S-1-5- etc" (with a red question mark) among my c:\users. As I had never seen that there before and it didn't show up in the user accounts in the control panel, I deleted both the "interactive" and the "S-1-5-xxxx" in c:\users. I think this is how I blocked myself out of my own user account. In some areas the S-1-5-xxx changed to homeusers when opening a security tab and my user account is part of the homeusers group. The inheritance premission may have been broken.

Yesterday I did a reset of the inheritance (icacls * /reset /t /c /q. That did the trick, although I did get a lot of "denied access" lines. I can log onto my user account again, and all seems to be working as it should. Eureka!

I immediately made a restore point and I run superantispyware, malwarebytes, adwcleaner, wise registry cleaner, ccleaner, spybot, full scan ms essentials (took +7 hours! I've played enough Mahjong for the rest of my life now...). No serious threats were found, I didn't expect any as I do not think my problems are related to malware. After all the scans I made a 2nd restore point. I am not sure whether my pc is very compromised. The software I downloaded from the web was a trial to be able to make architectural designs (Graphisoft), and students could share their projects/work together through this interactive network. So I'm not sure that the access to the data on my laptop is meant to do harm, but I do want to get rid of it. I don't like open doors.

A scannow was OK, but a chkdsk revealed the same error in index $I30 for file 931 as a couple of days ago. So I am trying to find what is still wrong...

Is there a way in Home Premium to reset the local permission policies to default status?

How to get rid of this interactive account that still shows in the security tab of for instance Firefox? Remove is greyed and "include inheritable permissions from parent" is checked. Permissions (all grey) contains "traverse folder/execure file", "list/read data", "read attributes", "read extended attributes". I am too scared now to touch any of this without knowing what I am doing. This is what got me into all this trouble...

Thanks for the help!

Judith.

 

[torchwood]

Hi Judith,
gonna do a QUICK run thru your latest post and comment on your actions/proposals.
but first of all
I AM NOT A MALWARE EXPERT,
BUT AS I SAID PREVIOUSLY YOU ARE NOT THE ONLY USER WITH ACCESS

IF YOU KEEP YOUR CURRENT OS AND ONLY INTEND TO MAKE CHANGES
I CANNOT GUARENTEE A SAFE AND SECURE SYSTEM

i can provide you with a bloatfree iso..

Did you uninstall those files in your pictures folder??
Have you changed your passwords, offline??
did you "uninstall WMP via programs/features

now back to yourpost

Para 2
The changes you have made are possibly creating an even more unstable system
removing users in C is only what you see, there will also be associated entries in your registry, which will then regenerate the unknown users profile and more importantly RENEWING his control of permissions
Hence the access denied errors/greyed out options

para 3
Creating a restore point on a corrupt system is pointless, your just causing a problem for the future.
The graphisoft download part has 2 caviats, the source and the program.
As for the student part why your comp, assuming your at a college, they will have their own I.T systems use that as the "hub" and network thru that, go talk to the I.T dept
(also ask them about Dreamspark, Microsoft Imagine - Wikipedia )

Para 4
follow this link
Download Tweaking.com - Reset Registry Permissions - MajorGeeks

para5
The interactive account that shows on the security tabS means its got access, presumably created when you downloaded/installed graphisoft

IF IT WAS MINE ID CLEAN INSTALL.

Roy

 

[Judiver]

Hi Roy,

Well reading your findings, as well as strangs things happening (logging off my user account and logging into my admin account got me to the highest level of administrators with an error message saying my desktop was moved; after an update of Firefox today I couldn't log out of my google account any more; when I start up realtime web protection of Malwarebytes is turned off but maybe that's because of the installation error I got when installing it... and chkdsk /f or /r isn't working), I think I probably cannot escape from reinstalling... Someone else in my computer or an instable computer with my only user account all corrupted, it leaves me few options.

It just scares me, loosing everyting with starting from scratch... I need to see if I have all the keys and/or a disk for the products that were on this pc (MS Office package for instance...) when I got this pc. I need to backup my Firefox bookmarks and I need to look through the papers of my internet provider to see how I need to set up my internet connection again. That will be my 1st priority. It is my only pc/internet connection... and without internet I will be totally on my own. I need to think what else I need to do before reinstalling and going offline...

I am no student and I do not have an IT dept to consult, I wish I had. I eliminated the WMP account from the security tabs in pictures, music and videos (the latter two contained no files). WMP didn't show up in the program list but I turned off the feature. Will change my password offline next and when I will go through a reinstall of Windows, the pictures (a tonne of GB...) will be gone automatically.

Do you think a reinstall from the d drive would be safe, should my computer be monitored by someone else?

Well, the reinstall will be for tomorrow then (and the next 3 weeks...). It is late here on the other side of the ocean. What a nightmare...

Thank you for the help and the offer to help.

Judith

 

[Judiver]

Oups I see you're in England, it's late there too !

 

[ICIT2LOL]

Hello Judith now I don't know what you mean by installing from D: drive and to clean install if it were me I would have only the drive that the OS is going to be installed on connected up.

Now it depends on how far you want to go with preparing the drive for the installation because you would need to at least clean the drive to remove any stuff on it.

Again and personally I would buy a new drive altogether and preferably an SSD but that is your choice of course. The old drive can then be kept for a spare and when all the data has been retrieved then clean it and use it for storage of data - let the new drive be the OS boot device.

There are ways like Roy said to get an ISO which i did link last time I posted and Roy has another. The installation process is set out in the tutorial I linked too. The site I also get the ISO from is this Windows 7 Direct Download Links and you only need to be sure to download the correct version and bit format and in the language you want. It is then a straight forward thing to install from the bootable disk or stick you make from the ISO I prefer a disk (DVD) but the choice is yours.

This is in my mind the only thing to do because the current set up seems to be in some disarray to say the least.

 

[Judiver]

Hi Icit2lol,

As I mentioned in an earlier post, I have a HDD recovery on my D:\. Reading the Toshiba user guide this is a "hidden partition allocated on the hard disk drive for the System Recovery Options. It stores files which can be used to repair the system in the event of a problem". Ah, so it is only to repair not to reinstall... which now that I think of it (never gave it much thought before...) is more than logical. You would need an external medium, stick or disk, to reinstall the OS. You can see I've never configured a computer from scratch...

I'm not going to invest in a new drive. In my mind reinstalling the OS compares to reformat a CD or DVD (and so all would be gone), but maybe this perception is wrong? Is there an easy way to clean a drive without manually uninstall programs and delete personal data?

Best regards from down under,
Judith

 

[torchwood]

Hi Judith,
A ray of sunshine on the Horizon, and not cos its summer down-under,
"real time protection" would indicate you have Malwarebytes PAID version, this includes support
Malwarebytes |

Portal
I would think they will ask for remote access.
cross ref this thread.

RE D,,
That should be a FACTORY Reset option, not repair.
The system repair dvd where'd you get it laptops dont come with them thats why youve got "D"
and likely W7 not W7 SP1.
as i mentioned earlier i can provide an iso which you could use to do a repair, NO loss of data.
Repair Install

you could use this program to find various licence keys
Belarc - System Management For The Internet Age. Software license management, IT asset management, IT security audits and more.
within firefox there is a passwords stored on my comp section, assume google has the same.


Going back to Graphisoft, been lookin at the homepage site, ARCHICAD install set-up from what i can see does NOT have a your password request option, enter your licence detail yep.


Roy

 

[Judiver]

Hi Roy,

When I start my computer Malwarebytes gives a message that online protection is off. I can open the program and set it to "on". Probably only possible during the trial period? Ah a cloud just obscured the sun...

Re Grafisoft, I am sure I gave my password, but it only happened after downloading the software (archicad). A request popped up if I wanted to set up a network or something and I clicked yes mad: !!).

Re Toshiba HDD recovery on d: and the repair disk, this is what it says in the user guide:
"Depending on the model you purchased, different ways for restoring the pre-installed software are offered;
- Creating optical recovery discs and restoring the pre-installed software from them (the disc I have is one I made myself in April 2015, but now that I think about it, it must contain de error that prohibits creating a new user account; I've never been able to do that).
- Restoring the pre-installed software from the recovery hard disk drive (so this would repair and restore to factory settings)
- Ordering recovery discs from Toshiba and restoring the pre-installed software from them"

I'm not sure why Icit2lol prefers a disk over a stick... I much prefer sticks > newer and faster. I only have (old) CR-RW disks of 700MB and am not sure just how big Windows 7 home premium SP1 is.

I am not sure how to use Belarc. I made a list of all the programs I have installed (hoping to not miss any...) and have been looking for installation disks, product keys etc. and also my info on how to reinstall my internet connection and reconnect my printer (which is a wireless connection). I still need to check a couple of programs, for which I miss info or disks off hand.

You've reinstalled operating systems maybe a hundred times, but for me it will be the 1st and it gives me the creeps. Most of all the idea of not having an internet connection to fill in the huge gaps in my computer knowledge.... Feels like plunging in the middle of the ocean with no mobile phone to call for help...

Judith

 

[RolandJS]

Fixing or reconstructing Windows 7 explorer.exe operations is a complicated and often futile process. If memory serves me, I saved to external media all of my data folders; all of my desktop folders & desktop icons; saved all downloads from Downloads folder; and so on. I was forced to do a clean Windows 7 Pro install to fix explorer.exe operations. I used the desktop folders and icons as roadmaps -- telling me what to reinstall and where. Although I was able to fix IExplore.exe [Internet Explorer] several times, I have never been able to reconstruct or fix explorer.exe, Windows 7 file manager, operations.
Going forward, when usb ext 1TB HDs got cheap, I bought two for each of my three computers, and I make routine bi-monthly full images of the OS partition and of the data partition, sometimes once weekly, sometimes more often. When big things explode, I reach for one of two ext HDs and do a restore. I have restored OS partitions several times, and have restored data partition's specific folders or files.

 

[Judiver]

Hi Roland and Bigmck,

I can be pretty stubborn, but Icit2lol and Torchwood, as well as the strange things happening - and the idea of finally being able to create another user account AND to have a clean computer (I'm not ever going to take over a pc from someone else with lots of unknown stuff), have convinced me to do a clean install. It's just being offline and not being able to get help if needed that scares me (as well as getting all my programs to work again, but I succeeded once, so why not twice).

I noted the product key that is on my laptop (that's the least of my worries, it is ready at hand and will not run away!) and will make 2 copies of Windows 7. Just in case one is on a medium that has a flaw (wouldn't be the first time a stick or a disk lets me down because it got corrupted). I'll carefully read the instructions on this nice tutorial and make a print. I need to make sure I have everything (backed up, copied, keys, instructions etc,) before actually pressing the button...

Judith

 

[torchwood]

Hi Judith,
AHHH the trial option oh Kangaroos'
RolandJS is correct explorer exe is the mainstay behind everything, its got its fingers in all the pies.

Programs
They are all shown in the programs/features option via control panel.
just screendump them via your printer, that'll leave you room to note the licence keys next to them.
then look them up on the net to get the downloads for them
note firefox gives you the to option to download to external devices

run Belarc it will create a file, listing programs and keys, read the faq's in the same link for more info

discs v usb were old school, still got floppy's

your re-installation dics, if the system was corrupt so are they

as for your internet, W7 comes driver complete it will find the right one automatically
just get the key from the label on the router.

There is nothing to fear performing a clean install,
it does nearly everything for you, just needs language/name, and how big,
i only use 1 partition my data is on an external drive/usb's etc,
let it do everything else

Roy

 

[Judiver]

Hi again,

Yeah Windows 7... its like Google who tries to get its fingers everywhere and monopolize everything (they don't stop to try to push Chrome down my throat...). I liked XP a lot better. Didn't have all those problems with user accounts, groups and permissions etc...

Control Panel, why didn't I think of that? See, experience helps!
I'm very grateful for all the help and tips I get here! I feel less lonely with my sick computer.

I ran Belarc. That is a really good tip! Finally my pc gives me all its mysteries on a couple of pages, nicely suscinct. I do have some interrogation though. Belarc does not state the same product key for my Windows 7 Home Premium as is on the sticker on the back op my laptop. That is really strange. Any thoughts?

I've been looking at these Windows versions but I am not sure which I should download. Belarc says I have:
Windows 7 Home Premium (x64) Service Pack 1 (build 7601)
Install language: English (United States)
System Locale: Dutch (Netherlands) > not sure what it means but I like to have everything in English, nobody understands Dutch where I live...
Installed 27-5-2010
Boot Mode: BIOS (Secure Boot not supported)

Floppies? Naaah old school, I still use pen and paper.

What's this with partitions? Can you choose what or how much you download?

What about cleaning my pc, as Itic2lol mentioned. Do I need to wipe everything off before doing a clean install? I've been wondering as well, if I cannot perform a chkdsk now, maybe there are bad sectors. Would that be a problem when doing a clean re-install?

Judith

 

[bigmck]

Don't worry about the Product Key sticker being different than what a program tells you. The Sticker is what you put into Windows to activate after installation. == One thing, during installation it will ask you if you want to Activate. Answer NO. You can do it later after everything is OK. You have a month to do it. == Keep us informed of you progress. == Put in the same Windows version you have. It might cause problems otherwise. == System Locale. You want English. When installing you will get an option for Language.== Partitions are if you have divided your disk into parts. Each one is a Partition. If you don't want any, say NO. == You do not need to wipe anything before Installation. Installation takes care of that for you. == Get back if you need help, but you have done this once before so you should be OK.

 

[ICIT2LOL]

Hi Icit2lol,

As I mentioned in an earlier post, I have a HDD recovery on my D:\. Reading the Toshiba user guide this is a "hidden partition allocated on the hard disk drive for the System Recovery Options. It stores files which can be used to repair the system in the event of a problem". Ah, so it is only to repair not to reinstall... which now that I think of it (never gave it much thought before...) is more than logical. You would need an external medium, stick or disk, to reinstall the OS. You can see I've never configured a computer from scratch...

I'm not going to invest in a new drive. In my mind reinstalling the OS compares to reformat a CD or DVD (and so all would be gone), but maybe this perception is wrong? Is there an easy way to clean a drive without manually uninstall programs and delete personal data?

Best regards from down under,
Judith

Ok Judith unless I am terribly wrong then that partition would be the factory restore and using it will get rid of anything on the drive. What I don't get is why it is named D: drive??

Now best go with what Roy has suggested and just for the record you would be wise to do images of the system (when it is put right) to fall back on for installation purposes. See this
Imaging with free Macrium

The new drive method I only mentioned as an option and is something I always do to ensure the system is clean and ready to go, and if the drive is an SSD makes the machine run that much faster. But the choice is yours of course.

Cleaning a drive needs the drive to be hooked up to another machine because a C: drive cannot clean itself that is. There two methods I use one being DISKPART and the other with Partition Wizard which has the wipe function.

But run with Roy's stuff he is better at this than I am - I only do this for a hobby to be honest.