Explorer stops working

[Knitter]

After having used explorer, and then try to open another program, I get the message "windows explorer has stopped functioning". I let it search for a solution, and then it works again.
It is not always, though that I get this message. Sometimes I only find out when opening PhotoshopCS2 and see only empty frames. Then I end explorer.exe in the joblist and start a new one.
It would be nice if explorer was a bit more stable. Anybody know a solution?
I have searched the net, and there are really many with similar problem, but no solutions as far as I can tell.
Op: Vista Business 32bit, and I have never had any Nero program installed.

[Mister2]

Hi Knitter, and Welcome to SpywareHammer! ;D

I'm not familiar with Vista (still clinging to XP) but some basic questions:

- Has this suddenly started happening or might it be related to the addition of new hardware/software?
- Do you have any other problems such as your system running slowly or shutting down unexpectedly?
- Does Explorer always do this, or only when your computer has been running for a while?

Try booting into Safe Mode:
Turn your computer off, wait 30 seconds then press the power button to start the computer.  Immediately start tapping the F8 key and continue until you see a text menu on a black background.  (You may hear several beeps as the computer boots up.  This is normal and can be ignored.)

When you see the menu, choose Safe mode by using the cursor keys (arrow keys) to highlight Safe Mode and then press the Enter key.  Your screen may look a little different as Windows boots up.  At some point you will be asked if you want to continue booting into Safe Mode.  Click 'Yes' and wait for the boot process to complete (the hard drive indicator light will stop flashing).

You are now running in Safe Mode, as shown by the words 'Safe Mode' in each corner of the screen and the fact that your Desktop will look rather strange due to the fact that only the basic Windows display driver has been loaded.

Does Explorer still misbehave in Safe Mode?

[Knitter]

Now I have been in safe mode, and I couldn't make the error occur, even if I know how to do it. I open two instances of explorer and move some files, close both explorers and try to open another program and it use to come up with an error message, but not this time. 
I have no other problems with my computer, and it doesn't do this evry time, but very often.
A good thing about Vista, though, safe mode doesn't make a mess of my desktop like W2K did.
CPU temp. after several hours in use: 41°C - 104°F

My PC:
MB: XFX MB-N680-ILT9
chipset: nVidia nForce 680i-LT-SLI
CPU: Intel Core2Duo E6600 2,4GHz
RAM: Corsair XMS2, in all 4GB
Videocard: nVidia GeForce 8600T
PS: Hiper Modular 580W
2 monitors

[Mister2]

That sounds like a problem with a startup program - Safe Mode starts with the bare minimum of processes running in the background, so it would appear that Explorer itself is running OK.

Download Process Explorer, double click the Zip file (named ProcessExplorer.zip) and extract the files.  Then run procexp.exe.

In the process Explorer window go to File, Save As and save to your Desktop with the name Procexp.txt (the default name offered).  Then either attach that file to your next post or else open the file in Notepad, copy the contents and paste into your next post.

If you know how to check for program updates to your antivirus and firewall then it would be a good idea to do this to make sure they are of the latest version.  If not then don't worry - we can sort that out when I see what is running.

[Knitter]

All of my programmes are updated automatically. And I know how to do it manually. ;D
File attached.

[Mister2]

All of my programmes are updated automatically. And I know how to do it manually. ;D

Good to hear! ;D

What we need to do next is to (temporarily) stop some programs running at startup.  If the problem goes away then we can re-enable them one by one until we find the culprit.  This can be done using the tools built into Windows but I find it easier and more informative to use a small utility.

Download Mike Lin's Startup Control Panel 2.8 , unzip it and install it.  Go to Start, Control Panel and you will find a new entry named 'Startup'.  Click this and a new window will open showing 7 tabs containing entries corresponding to your startup programs and processes.  We will leave all your protection in place (antivirus, anti-spyware and so on) and anything we do in here is completely reversible.

Look through all the tabs (apart from 'About' and 'Deleted' - there's nothing there to interest us yet) and uncheck anything related to the following programs:

Gadwin PrintScreen
Skype
Mailwasher

Close the Startup window, reboot and see if Explorer is still misbehaving.  If so then open the Startup window again and re-enable these 3 programs.  Oh, and don't download your mail until we turn Mailwasher back on. ;)

However, if the problem appears to be fixed, open the Startup window again, check the entry for Mailwasher and reboot.  If all is OK then do the same for Skype, then Gadwin.  One of these programs should make the problem apparent again and we can look at fixing that one.

[Knitter]

Explorer is still misbehaving.
I attach a file from the eventlog, don't know if it helps.

[Mister2]

OK, re-enable those entries using Startup Control Panel (simply check the appropriate boxes).

Now a shot in the dark.

What version of SpySweeper are you running?  (Open the Spysweeper window from the icon in the systray at the bottom right and click the Help button - the version is shown in the title bar of the Help window).  It should be V5.8

Then close the Help window and in the Spysweeper window go to Options, click the Program tab and uncheck 'Load the program at Windows startup'.  Shut your computer down, physically disconnect it from the Internet and start up again.  Try doing a few of the things that normally show the Explorer error.

The event log mentions SSCtxMnu.dll, a SpySweeper file.  SS has been known to cause problems in Vista despite MS claiming V5.8 is completely compatible.

When done, go back end enable SpySweeper to load at startup, shut down, re-connect your Internet connection and boot up normally.

[Knitter]

SpySweeper v.5.8.1.55.   With SS disabled, the error only partly showed up. Evrything went fine, until I started Photoshop. The moment I started to use it, all the icons disappeared and left only empty frames.

I have the feeling that there is more than one program causing this error, and that PS is one of them, a video-card driver another. Furthermore I think that it can not be solved until there is a better compatibility between Vista and third party programmes

Smile of the day:
Reading through my event-logs I found this:

"Description: The Windows Image Scan Service depends on the Hardware-Recognition service which failed to start because of the following error:
The action is completed."

Special MS logic?  ;D

[Mister2]

*lol*  Good one!
One of those 'logical but baffling' statements!

Do you have any warnings or errors in the Application or System sections in Event Viewer that relate to Explorer or that mention GDI ?
How much memory is free?  Press Ctrl + Alt + Del to bring up Task Manager, click the Performance tab and you should see the available physical memory toward the bottom of the window.
What video card do you have?

There used to be a problem with lack of video memory resources in older versions of Windows that caused similar problems,  but I don't think it applies so much with XP or Vista.

[Knitter]

Video card: (XFX) GeForce 8600GT 256MB PCI E

I found only one more error similar to the one you have seen. Nothing on GDI.

But I must have been in touch with some malware, because there was some errors about something that failed to start, among other things WSearch and NetMan. I searched in the reg.editor but found no trace of it.

BTW, in Vista it is not Ctrl + Alt + Del, but Ctrl + Shift + Esc.

I attach a screen-shot of my task manager.

[Mister2]

Hi Knitter,

... in Vista it is not Ctrl + Alt + Del, but Ctrl + Shift + Esc

Trust MS to fiddle with their most famous shortcut!

As far as I can ascertain, WSearch is a valid component of Vista, though it can slow your computer down.  Netman has my suspicions aroused.  If you didn't install an application with that name then it may well be malware.

I need to ask someone here who is familiar with Vista to check a file out.

Back soon, but in the meantime perhaps you could let me know if you have a file named netserv.dll in your C:\Windows\System32 folder?

[Knitter]

Sophos about WSearch:
http://www.sophos.com/security/analyses/adware-and-puas/wsearch.html

I found a folder named inetsrv, but it was empty.
I have never installed netman, but I got suspicious when there was several errors in a row with something that failed to start, among others WSearch and netman, and I thought they might be connected.

[Mister2]

Hi Knitter,

Apologies for not replying sooner - the real world got in the way!

Having done a little research I'm inclined to think both WSearch and Netman are the remnants of an infection, as you have surmised.  WSearch can be a valid Windows process but there are many references to a malware version.

Netman allows a user to remotely control another PC (amongst other things).  Whilst not inherently bad when used in the correct way, such an application can be dangerous.  Many of the downloads I found were related to dubious sites.

In view if this, I recommend you post a HiJackThis log here - http://spywarehammer.com/simplemachinesforum/index.php?board=10.0
Read through this thread first then post your log in a new topic together with a link to this thread for reference.

Hopefully you will be given a clean bill of health and we can look into some other areas, but we need to be sure we are working on a malware-free machine first.  Post back here when your log has been checked and we can continue.

Good luck!

[Knitter]

My PC was free of malware
http://spywarehammer.com/simplemachinesforum/index.php?topic=915.0
and the problem seems to be resolved, at least for now. I have not been able to provoke the error.
Thanks for all your help. ;D