[Harveycolt]

Can anyone tell me why, when my grand-daughter's PC starts up (or re-starts) it boots up 'past' the desktop and straight into Windows Explorer? If Windows Explorer is cancelled it then reverts to the desktop.
It's not really a problem, just an annoyance, but I would like to know, if possible, what caused it to happen, and, more importantly, how to stop it.

Thanks

Harvey Meadows

[Advertisements]

Hi Harveycolt...

Why? Hard to say...but there are a couple of ways to try and get it to stop.

Try msconfig first. Click Start, then Run, type msconfig, and click "Ok". Under the "Startup" tab, look for an entry for Windows Explorer. If you find such an entry, uncheck the box next to it, click "Apply" then "Ok".

Upon restarting, you will see a Selective Startup dialog box...this is normal. Check the box to not show it and click "Ok".

If that doesn't resolve the issue...post back and we'll look at a registry adjustment.

wannabe1

[wannabe1]

Hi Harveycolt...

Why? Hard to say...but there are a couple of ways to try and get it to stop.

Try msconfig first. Click Start, then Run, type msconfig, and click "Ok". Under the "Startup" tab, look for an entry for Windows Explorer. If you find such an entry, uncheck the box next to it, click "Apply" then "Ok".

Upon restarting, you will see a Selective Startup dialog box...this is normal. Check the box to not show it and click "Ok".

If that doesn't resolve the issue...post back and we'll look at a registry adjustment.

wannabe1

[Harveycolt]

Hi wannabe 1, ( Hope I'm doing this correctly!).

I looked at the Startup tab as explained and there is nothing there there seems to relate to Explorer. What's the next move please?

[wannabe1]

Hi Harveycolt...sorry about the delay in getting back to you...I had some ISP issues on my end

Let's take a look at one other thing before we head into the registry. Open the My Documents folder, click on "Tools" in the toolbar, and choose "Folder Options". In the Folder Options window, click on the "View" tab. Scroll down the list and see if the box next to "Restore previous folder windows at logon" has a check in it. If it does, remove the check, apply the change, and reboot.

Let me know what you find...

wannabe1

Edited by wannabe1, 02 February 2006 - 08:12 PM.

[Harveycolt]

Thanks Wannabe 1.

That "Restore previous folder windows at logon" box wasn't checked. Next move please?

Harveycolt

[gerryf]

this is sometimes a startup program reference that has been cleaned...if you will run hijackthis and attach a log,I can take a quick look whil we wait for wannabe to come back

[wannabe1]

Thanks, gerryf...I'd kinda like to peek a an HJT log, too....

Harveycolt...navigate to the following registry key, but don't change anything unless I ask you to. We will back up the registry before making any changes.

Click Start, then Run, type regedit in the Run box, and click "Ok". Then expand (click +) HKEY_CURRENT_USER, then Software, then Microsoft, then Windows, then CurrentVersion, then Explorer, and click on Advanced. In the right pane, find the entry PersistBrowsers...what is the value (listed under "Data") for this key?

wannabe1

[Harveycolt]

Right chaps.

Just back from my grand-daughter's PC.


I found PersistBrowsers and the value is 0(zero).

I also installed and ran hijackthis and took a copy of the log. See below. Not sure how to include an attachment. Is this Copy and Paste acceptable? (This is all very interesting but I've got beyond understanding what I am doing now!).


Logfile of HijackThis v1.99.1
Scan saved at 11:35:33, on 07/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\vsnpstd2.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
E:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip....pGameLoader.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.funtigo.c...ureUploader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



Harveycolt

[wannabe1]

Harveycolt...

I didn't realize you have to make a trip to the problem computer...I'll give you more to look at this time to speed things up. The HJT log looks good with the exception of one curious entry I'm going to have someone look at. I don't think it is related to the Explorer problem, though. The value for PersistentBrowsers is correct...we'll have to keep digging.

Click Start, point to All Programs, then to Startup...What is listed in this folder?

Click Start, then Run, type msconfig, and click "Ok". Under the Startup tab, is there an entry like /L:ENG?

Then back into the registry...

Click Start, then Run, type regedit in the Run box, and click "Ok". Then expand (click +) HKEY_LOCAL_MACHINE, then Software, then Microsoft, then Windows, then CurrentVersion, and click on Run. Please list the names and values of everything in the right pane for me.

Click Start, then Run, type regedit in the Run box, and click "Ok". Then expand (click +) HKEY_LOCAL_MACHINE, then Software, then Microsoft, then Windows NT, then CurrentVersion, and click on Winlogon. In the right pane, what is the value listed for Userinit?

wannabe1

Edited by wannabe1, 08 February 2006 - 08:47 AM.

[Harveycolt]

The problem PC is 30 miles away and even when I get over there I don't always get the opportunity to get at it so if you will bear with me I will follow up your ideas ASAP. I don't like to abandon the 'project' if I can help it.

Harveycolt

[Harveycolt]

Hi Wannabe

Answers to last 'questionaire' are:-
Startup folder: only 'Adobe Gamma Loader'.
Startup tab entries:- nothing like '/L:ENG' anywhere.
Registry entries 1) see attachment run.jpg
Registry entries 2) see attachment userinit.jpg

Harveycolt

[wannabe1]

I'm not seeing what I expected to see in the reg keys...

Let's look at this one...

Click Start, the Run, type regedit, and click "Ok"

In the left pane, expand HKEY_CURRENT_USER, then Software, then Microsoft, then CurrentVersion, and click on Run

In the right pane, is there an entry for explorer.exe? If there is, right click on the entry and choose "Delete"...accept the change. Exit the Registry Editor.

Reboot and see if Windows Explorer still opens.

Edited by wannabe1, 15 February 2006 - 04:05 PM.

[Harveycolt]

Hello Wannabe1,

I don't quite know how to tell you this - but the problem has gone away!!! (I haven't followed your last posting's investigative guidance therefore).

After I had gone through the procedures as per my last reply to you, when I had completed them I did a re-boot so I could clear the System Configuration Utility notice that always comes up when msconfig has been called up, and not leave it for my grand-daughter to have to wonder what it was when she next switched on.

It wasn't until my mind was ticking over later that evening at home that I realised that the PC had booted up to the desktop quite properly and Windows Explorer had not surfaced. I rang my daughter-in-law to confirm that I had remembered correctly (I'm pushing on a bit and have lots of Senior Moments these days) but she has done two re-boots and the desktop came up as it should on both occasions.

What the answer is I don't know. I have changed nothing and done nothing on the computer except slavishly follow your excellent instructions. What my grand-daughter might have I don't know of course. I'm told that she downloads all sorts of stuff without fear and whether she has installed something or uninstalled / deleted something that has had an effect we will never know.

It only remains to thank you, and 'Gerryf' also if he is monitoring these exchanges, and apologise for taking up your time.
It was nice 'talking' to you however,

Harveycolt
Norwich
UK

Edited by Harveycolt, 16 February 2006 - 06:35 AM.

[gerryf]

we're just glad you fixed it!



Thanks for letting us know