explorer.exe keeps restarting unless in safe mode

Question

slize 0 Newbie Poster

15 Years Ago

hello,
i got a problem with my netbook running windows xp home edition. explorer.exe keeps restarting approximately every 5 seconds unless i boot the netbook in safe mode. enclosing log file. thank you in advance for your help.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:34:22, on 2010-11-06
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
C:\WINDOWS\system32\taskmgr.exe
F:\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\IPSBHO.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe

--
End of file - 3851 bytes

http-protocol microsoft:windows-nt-2000-xp virus-malware

2 Contributors
1 Reply
202 Views
1 Day Discussion Span
Latest Post 15 Years Ago Latest Post by jholland1964

Dani AI

Generated 7 Months Ago

The symptom — explorer.exe repeatedly terminating under normal boot but running in Safe Mode — strongly points to a third-party component (shell extension, BHO, toolbar, or a missing/orphaned registry entry) causing Explorer to crash on load. is correct to restore Normal startup with msconfig as an initial sanity check, but the Safe Mode success suggests a targeted isolation approach will find the culprit faster than re-enabling everything blindly.

Recommended diagnostic sequence (in order):

From Safe Mode, check Event Viewer -> Application for Explorer fault entries and note the faulting module name/path; that name usually identifies the offending DLL.
Use Autoruns (Sysinternals) to inspect Run/Explorer/Browser Helper Objects and remove or disable entries that point to missing files. Orphaned BHOs/toolbars and LSP entries commonly break Explorer.
Use ShellExView to disable non-Microsoft shell extensions (context menu handlers, icon overlays). Reboot to normal after disabling batches to see when Explorer stabilizes.
For Winsock/LSP anomalies, run the reset command and reboot:

netsh winsock reset
sfc /scannow

Note: sfc on XP may require the original XP media.

Also run up-to-date anti-malware and rootkit scans (for example, Malwarebytes and a vetted rootkit tool) from Safe Mode or boot media. If a specific DLL is named in the Event log, focus remediation on that component (uninstall the associated program or remove its shell extension). Always back up the registry (export keys) or create a system restore point before making removals.

If isolation and malware removal fail, back up user data and consider a Repair Install or full reinstall of XP. Avoid randomized “fix” tools and registry cleaners; take incremental, reversible steps so the exact cause can be identified and corrected.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 1 · 2010-11-08T10:39:39+00:00

Don't know what all you have disabled using msconfig but it is likely you have turned off some needed files. msconfig should only be used for trouble shooting not as a way to stop auto starts permanently. You only have one auto start in programs and one in services. Go back into msconfig and choose Normal start up, re-enable all the services you have turned off and reboot. Then run a new HJT scan and post that log.