[Ham-Computers] RE: "Disappearing" Desktop

[Hsu, Aaron (NBC Universal)]

Then one of two things has occured:

1.  Windows is not looking in the right place for EXPLORER.EXE (path problem)
2.  Explorer.exe was deleted or moved by some app (spyware, virii, etc).

EXPLORER.EXE should be in the C:\WINDOWS folder (replace "C:" if your system drive is another drive letter).  Try starting it by specifying the full path, "C:\WINDOWS\EXPLORER.EXE".  If this works, then Windows is not looking in the right place to start EXPLORER.EXE.  I would normally say this is a "system path" problem, but I don't think Windows relies on the system path to start EXPLORER - it's more likely a registry setting.  I'll have to research this one.

If specifying the full path didn't work, then something moved or deleted EXPLORER.EXE.  If this is the case, the only "easy" fix is to try an "in-place" re-installation of Windows (as referenced in my previous post).  However, if your system is infected by something, chances are that the system will still be corrupted after the in-place re-install.  Also remember that you'll need to re-install *ALL* Windows Updates after the installation.

The more difficult alternative is to put a copy of EXPLORER.EXE back in the C:\WINDOWS directory and reboot.  EXPLORER.EXE can be found on the original installation CD's or in the DLLCACHE (or a HOTFIX) folder.  Question is, how do you put it back if you can't boot into Windows?

1.  Boot to your task manager (as you have been doing) and launch "CMD.EXE".  This will bring up a command prompt.  Enter "DIR \EXPLORER.EXE /S" to have the command prompt search the entire drive for EXPLORER.EXE and note any locations where it is found.  Typically, the one in the "DLLCACHE" folder is the one you want to use.  If you find one elsewhere, post the location here and someone can determine if it's legit.  If you don't find a copy of EXPLORER.EXE, then you'll need to get it from the installation CD, or, from another working copy of Windows XP (from a different system).  Best if it's the same version of WinXP (SP1, SP2).  Copy the EXPLORER.EXE to "C:\WINDOWS" and reboot the system.  See how far you can get from here.

2.  Boot using a different bootable drive (making the problematic system a secondary drive).  Do the same search and replace of EXPLORER.EXE as mentioned in option #1.  While your at it, do a complete malware scan on the drive, if possible.  Examples of using a different bootable drive is to boot from a WinPE CD (such as BartPE), or moving the drive to a different system and installing it as the second HD.

Either way, you'll still need to make sure whatever deleted EXPLORER.EXE is cleaned off the system.  Be prepared to spend some time on this as I predict it will take several hours.

73 & GL,

  - Aaron, NN6O


-----Original Message-----
Sent: Friday, December 01, 2006 12:55 AM
Subject: Re: [Ham-Computers] RE: "Disappearing" Desktop

Explorer is NOT showing up in task manager. When I try to run it from "new task" I get an error message saying that Windows cannot find explorer.exe


Paul