[mdr29]

I hope you can help me with my Windows problems. After working extensively with Michelle from the Malware Removal forum, she referred me to this board because my machine is still acting strangely and she thinks the problems might be related to corrupt XP files.

When booting normally, I cannot access Internet Explorer (I use Firefox normally but IE occasionally for certain things), Control Panel, Windows Explorer, nor view the contents of the Recycle Bin, among other things. When I do try to open any of these, my machine just seems to hang for a while, then the desktop clears other than the wallpaper, and then everything reappears but the program never opens. Also, about half of the stuff in the Notification Area doesn't come back. When booting into Safe Mode, though, everything seems functional.

I have Win XP SP1 (waiting to resolve issues before installing SP2). I appreciate any help you can give me. Thanks!

[Advertisements]

I don't know if this is related, but now when I open Thunderbird (Mozilla's email client) and download messages, it freezes for about 5 seconds before letting me scroll through my inbox contents. Also forgot to mention that MS Word has been incredibly slow to load, giving a blank page for about 10 seconds before I'm able to type text.

Can anyone help?

[mdr29]

I don't know if this is related, but now when I open Thunderbird (Mozilla's email client) and download messages, it freezes for about 5 seconds before letting me scroll through my inbox contents. Also forgot to mention that MS Word has been incredibly slow to load, giving a blank page for about 10 seconds before I'm able to type text.

Can anyone help?

[gerryf]

Well, it sounds like explorer is crashing, but let's start with this first

start > run, type
regedit

navigate to the following key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

if there is a plus there, click it to expand....do you see subkeys marked
EXPLORER
or
SYSTEM
?

Next,

start > run, type
eventvwr.msc
I want you to select both Programs and Application, right click each, choose CLEAR ALL EVENTS (don't bother saving logs)

Now duplicate the crash earlier by opening IE, MY COMPUTER...whatever. Keep trying until the explorer crashes and reloads and your system tray empties. Now, back to

start > run
eventvwr.msc

Look for RED Xs in Application and System

report back

[mdr29]

Thanks for responding, gerryf. After a fresh boot, under the key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

it says below the (Default) entry:

NoDriveTypeAutoRun REG_DWORD 0x0000091 (145)

After duplicating the crash twice (by trying to open my Norton-protected Recycle Bin and then by clicking Windows Explorer), eventvwr.msc did not show any red Xs under either Application or System. However, Application did give this Information item both times:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1002
Date: 4/17/2005
Time: 6:14:47 PM
User: N/A
Computer: D2NBNF31
Description:
The shell stopped unexpectedly and Explorer.exe was restarted.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

Is this meaningful?

[mdr29]

[gerryf]

I think I am going to have to re-read that entire four page thread to get a handle on it....I flipped to the last page and your startup list is...peculiar.....

You may just be better off with a repair process, as outlined in the top thread in this forum....do you have a windows CD?

[mdr29]

Do you mean this thread?

Repair Windows XP - How to Perform an In-Place Upgrade

Yes, I have the Windows XP reinstallation CD that came with my Dell.

[gerryf]

that is the thread, I am not sure your windows xp reinstall disk is up to the task though....it may be a recovery disk, meaning it wipes out your system and puts you back to factory fresh condition (killing your data along with it and any programs you added).

Pop the cd in and explorer it...is their a i386 directory on it?

Also, scan your harddrive for an i386directory

[mdr29]

There is an I386 directory on both c:/ and the XP CD that I have. What should I try next?

[gerryf]

really, on the CD, what's in the i386 directory? A full set of installation files?

That would be useful...about 8 folders and 5000 files?

[mdr29]

Yes, I386 on the CD has 8 folders and boatloads of files ending in _.

[gerryf]

sounds like you have yourself a functional windows xp cd, then...I would do a repair installation following the thread above. I thnk Michelle was right, sounds like a bad piece of malware took out a basic file, but what it is could take us a decade to track down. The shell relies on hundreds of files to work properly.

A repair will replace any corrupted file, and replace any that are missing. The only drawback is you may need to reactivate, but that still saves you a boatload of time over

ok, now let's replace this file
now this file
now this file.....

Follow the instructions in the thread...it's quite painless.

[mdr29]

Not good. After pressing F8 for the agreement, the next screen showed this partition information:

-: Partition1 [FAT] 39MB (32MB free)
H: Partition2 [NTFS] 76246MB (46716MB free)
Unpartitioned space 8MB

When I selected the largest partition, I got a message saying: Windows XP cannot recognize the partition you selected. Setup cannot install Windows XP on the partition... [more snipped, that basically said I could delete the existing partition and install Windows on the resulting free space.]

Is there anything else I can try, or am I doomed to reformat my hard drive?

Edited by mdr29, 20 April 2005 - 10:15 AM.

[gerryf]

crud, OEM cd...my mistake....no repair option with an OEM CD.....

all right, in the mood to make yourself a oem/retail hybrid...? I think that will work....got a CD burner and a couple of blank CDs?

[mdr29]

CD burner: check.
Blank CDs: check.

Explain away...