How To: Fix explorer.exe from restarting.
-
Through out my job of being a computer technician I always seem to come across the famous Windows XP explorer.exe killer. You know the one. As soon as you log into your account, explorer.exe starts (you see the task bar, and all the icons) and just as suddenly you saw them, they disappear just like that. Then, out of no where they appear again, but to, disappointingly disappear again.
Most of the time it can be a nasty little bugger to get removed, and most anti-virus and anti-spyware software doesn’t remove or fix the problem. That is because the bug likes to hide using different techniques.
So today I wanted to share all the the types of explorer.exe killers I have found, and how I fix the problem.
Before we begin:
I just want to say before I get started on letting you know how to fix this problem, is the trick to fixing this issue, has more to do with identifying which technique the bug is using, or if it even a bug at all. Explorer.exe can also start to do the same thing if a update didn’t take correctly. So, make sure that it wasn’t an update that killed off Explorer.exe first before assuming it’s a bug. If you think it was an update problem, I suggest reading this article.
The Killer Driver:
The first type of explorer.exe killer I find is simply a bug that installs a startup driver that kills that restarts the explorer.exe process any time it starts up. It is one of the easiest to spot, and is easy to fix. The first process is to find what drivers are being loaded, and which one it is that it is. What I recommend to do is to start up into safe mode (Reboot, hold F8, select Safe Mode). The reason we want to startup into safe mode is safe mode only starts the operating system with the minimum startup items, services, and drivers. So if we indeed do have a startup driver that is causing the issue, we should be able to login into Safe Mode and not have any explorer.exe problems.
First thing is to optimize the machine, so lets have you startup Msconfig. Go to Start > Run > Type in “msconfig” and hit enter.
In the window that appears choose the startup tab, and choose to disable all. Now go over the the “services” tab, and check the box to hide all non-microsoft services. Click “Apply” and hit “Ok”.
What we have done is cleaned out your startup and services, so if by chance the bug is one of those, we have stopped it from starting up, typically it isn’t going to do the trick, but will cover all our bases.
Now lets download a quick tool. Download link. This tool will allow us to see what drivers are currently loaded in Windows.
Reboot your system into Normal mode and run the program. Scroll through the list of drivers that are loaded, and see if you find any with any description or file type that is blank. If a driver has blank information, it may be the file we are looking for. Once you have found one, do a search for it, and delete the .sys file.
The .DLL File:
The majority of the time, this problem comes from a .DLL file. I would say about 90% of the machines I have worked on with this problem comes from a bad .dll file in hidden in the Windows or System32 directory. The technique I use to find the file we want to look for is a simple process as long as you have the right tools. First, we need a tool to help us watch system processes.
Go ahead and download Process Explorer. Process Explorer will allow you to watch system processes, and see what files, directories, etc they are calling for.
Once you have that up and running, make sure that you have the program running when explorer.exe is currently crashing and restarting. What you want to do is watch Process Explorer for the explorer.exe startup, and see if any other processes start up along side of it.
Typically what I see is explorer.exe starts up, then you have x process open up, and explorer.exe quits, and then x process quits. When x process starts up we want to hurry and take a look at what .dll files it is calling for. Once you have that info, go to the location of the file while being booted into a Live CD. and change the x.dll file to x.dll.bak. This way, if by changing the file messes up your system, you can go back and change it back to x.dll.
On the other hand, if it fixs the problem, you can go in and completly remove the file all together.
I know I didn’t get really to technical here and I apologize. If you have any questions or other techniques please leave a comment.
Leave a Comment
January 28th, 2008 at 12:38 am
Hi, I have an issue with explorer.exe i googled and came across your post here, I ran into explorer.exe restarting before, and i’ve always fixed by re-format the computer. Recently, my computer boot up into windows with blank screen, i did the combinations Ctrl Alt Del and Windows Task Manger popup, i went File->New Task(Run…) an Creat New Task window popup i entered “explorer.exe” and voila, my desktop showsup. Ok so i’ve beening doing that for a while cause i’m too lazy to re-formate the pc. Up untill today, i do as what i’ve been doing to login by type explorer.exe and now i got an error message “explorer.exe is not a valid Win32 application” any thought or ideas on how to fix this?
Ty
Mark
January 28th, 2008 at 11:29 am
[quote comment=""]Hi, I have an issue with explorer.exe i googled and came across your post here, I ran into explorer.exe restarting before, and i’ve always fixed by re-format the computer. Recently, my computer boot up into windows with blank screen, i did the combinations Ctrl Alt Del and Windows Task Manger popup, i went File->New Task(Run…) an Creat New Task window popup i entered “explorer.exe” and voila, my desktop showsup. Ok so i’ve beening doing that for a while cause i’m too lazy to re-formate the pc. Up untill today, i do as what i’ve been doing to login by type explorer.exe and now i got an error message “explorer.exe is not a valid Win32 application” any thought or ideas on how to fix this?
Ty
Mark[/quote]
Well now your in for a reformat Mark. It has been my experience as a computer technician that when you start to run into the “…. is not a valid Win32 application” error, you have major OS corruption that is best fixed by reformatting the machine.
January 29th, 2008 at 3:14 am
haha, thanks i knew someone is going to say that, umm… i just want to learn how, and what sort of error causes these type corruption on a file, the “…is not a valid Win32 application”? I’m not clear about this, it must has been some sort of worm or trojan that modified *.exe, am i correct?
anyway, i think i fixed the problem but i’m not for how long this is going to last but it seem to be working fine for several hours now, basically what i did was, i copy a explorer.exe from my laptop and overwritten the orginal, the inffected explorer on my desktop and it works.
Mark
January 29th, 2008 at 8:01 am
[quote comment=""]haha, thanks i knew someone is going to say that, umm… i just want to learn how, and what sort of error causes these type corruption on a file, the “…is not a valid Win32 application”? I’m not clear about this, it must has been some sort of worm or trojan that modified *.exe, am i correct?
anyway, i think i fixed the problem but i’m not for how long this is going to last but it seem to be working fine for several hours now, basically what i did was, i copy a explorer.exe from my laptop and overwritten the orginal, the inffected explorer on my desktop and it works.
Mark[/quote]
I’m sure that your fix will work for a bit, but don’t be surprised if it gets reinfected. Most of the time these errors occur because of a trojan that modifies the .exe in a certain way. Other times, you can have Windows Updates that cause the problem by not properly installing, but I would say this is not as big as a virus infection.
Good luck with your system Mark!
January 31st, 2008 at 3:42 am
Thanks Eric,
hey, this is going to be off topic, but i thought to get your input. so, as i have described earlier how my computer startup without loading explorer.exe and i have to manually load it. Do you know any detection softwares which can detects or monitors what has been changed? this is actually quite annoying, to be honest i had reinstalled my computer for over 10times already over the past 12-13months time. not only the explorer.exe not load but it causes some of the function not to work, such as, RightClick on desktop->Properties, access Computer Manager, Run->cmd, Control Panel, ect… this happen both on my laptop and desktop.
p.s. the desktop is still working fine, i just want to know how to prevent this sort of thing from happening again, cause i’m planning to reinstall the window again.
Mark
January 31st, 2008 at 11:13 am
[quote comment=""]Thanks Eric,
hey, this is going to be off topic, but i thought to get your input. so, as i have described earlier how my computer startup without loading explorer.exe and i have to manually load it. Do you know any detection softwares which can detects or monitors what has been changed? this is actually quite annoying, to be honest i had reinstalled my computer for over 10times already over the past 12-13months time. not only the explorer.exe not load but it causes some of the function not to work, such as, RightClick on desktop->Properties, access Computer Manager, Run->cmd, Control Panel, ect… this happen both on my laptop and desktop.
p.s. the desktop is still working fine, i just want to know how to prevent this sort of thing from happening again, cause i’m planning to reinstall the window again.
Mark[/quote]
Honestly as a technician and my experience if your having these problems I strongly recommend getting some anti-spyware and anti-virus software. I recommend Webroot’s Spysweeper and also Trend Micro’s Antivirus (AKA PC Cillin).
February 27th, 2008 at 10:49 pm
Okay but see here is MY problem which is RIDICULOUSLY annoying. Its the same thing, one day I came in, start up my PC (im currently using my laptop) and it loads windows then explorer restarts, loads up the icons, then poof there gone again, and will keep doing this FOREVER. I think its funny how all these fixed im finding online and on Google are telling me to install stuff on the pc to check for errors and what not.. HOW IN THE HECK DO I INSTALL ANYTHING on that PC if explorer.exe restarts every 5 seconds. Its impossible. Please PLEASE help me if you have any sort of fix without having to install anything let me know. I am pretty computer savvy and still have yet to find a fix, and formating is NOT an option.
March 4th, 2008 at 2:31 pm
hi my name is mike i resently got the explorer.exe virus. i beleve it was frome lime wire.
because it hapend as soon as i got it. but it is exactly as you described and i follwoed your steps but i tried to close a prosses i think is it. it says somthing about perimiter idk i just need advice. plz help
March 6th, 2008 at 11:32 am
[quote comment=""]hi my name is mike i resently got the explorer.exe virus. i beleve it was frome lime wire.
because it hapend as soon as i got it. but it is exactly as you described and i follwoed your steps but i tried to close a prosses i think is it. it says somthing about perimiter idk i just need advice. plz help[/quote]
For what it’s worth, I’ve been having exactly the same problems (explorer restarting every 5 seconds) from something I dl’d from limewire. I followed the instructions above, but unfortunately neither fix worked for me. I came across a suggestion somewhere else to download “vundofix” and run that. I did & it came up with 3 corrupted files (this is after running AVG which did not fix it). I deleted the files
c:\WINDOWS\system32\jillm.ini
c:\WINDOWS\system32\jillm.ini2
c:\WINDOWS\system32\mllii.dll
Everything seems fine at the moment. No more restarting & all applications are working so far. I’m pretty ignorant on the subject, so maybe I did some harm somehow, we’ll see. Just thought it might help someone else.
Jeff
April 17th, 2008 at 7:02 pm
” Thanks Eric,
hey, this is going to be off topic, but i thought to get your input. so, as i have described earlier how my computer startup without loading explorer.exe and i have to manually load it. Do you know any detection softwares which can detects or monitors what has been changed? this is actually quite annoying, to be honest i had reinstalled my computer for over 10times already over the past 12-13months time. not only the explorer.exe not load but it causes some of the function not to work, such as, RightClick on desktop->Properties, access Computer Manager, Run->cmd, Control Panel, ect… this happen both on my laptop and desktop.
p.s. the desktop is still working fine, i just want to know how to prevent this sort of thing from happening again, cause i’m planning to reinstall the window again.
Mark”
There is an freeware application called “system protect” which might help, just google it.
April 17th, 2008 at 7:36 pm
[quote comment=""]”
Thanks Eric,
hey, this is going to be off topic, but i thought to get your input. so, as i have described earlier how my computer startup without loading explorer.exe and i have to manually load it. Do you know any detection softwares which can detects or monitors what has been changed? this is actually quite annoying, to be honest i had reinstalled my computer for over 10times already over the past 12-13months time. not only the explorer.exe not load but it causes some of the function not to work, such as, RightClick on desktop->Properties, access Computer Manager, Run->cmd, Control Panel, ect… this happen both on my laptop and desktop.
p.s. the desktop is still working fine, i just want to know how to prevent this sort of thing from happening again, cause i’m planning to reinstall the window again.
Mark”
There is an freeware application called “system protect” which might help, just google it.[/quote]
Well, Webroot’s Spysweeper is a pretty good Anti-Spyware program that notifies you of system changes. I would give that a try.
April 30th, 2008 at 1:08 pm
There is an freeware application called “system protect” which might help, just google it.[/quote]
Thanks I’ll google it up for sure,
Mark
May 12th, 2008 at 9:48 pm
Hey, Eric.
I have the explorer.exe problem and I am almost certain it is a “killer driver.”
I have found 4 unknown file types and file types with no descriptions through Driver View.
You then state to search for them and delete them. I can’t do this, because explorer.exe retarts itself too fast in time for a search.
I attempted to search in safe mode but when I searched the files, it came up with no results.
Please help or e-mail me:
syca @ cox.net
May 13th, 2008 at 5:07 am
yes me too…
i did all the tips you suggested here on your post… sir..
but i can’t delete also the unknown file type thing because explorer.exe restarts in 5 secs…
and by the way…
deleting dump_atapi.sys, and dump_WMILIB.sys can cause effects on my OS??
please tell me what to do
email me…cjonline101@yahoo.com
May 25th, 2008 at 2:57 am
[quote comment="2310"][quote comment=""]hi my name is mike i resently got the explorer.exe virus. i beleve it was frome lime wire.
because it hapend as soon as i got it. but it is exactly as you described and i follwoed your steps but i tried to close a prosses i think is it. it says somthing about perimiter idk i just need advice. plz help[/quote]
For what it’s worth, I’ve been having exactly the same problems (explorer restarting every 5 seconds) from something I dl’d from limewire. I followed the instructions above, but unfortunately neither fix worked for me. I came across a suggestion somewhere else to download “vundofix” and run that. I did & it came up with 3 corrupted files (this is after running AVG which did not fix it). I deleted the files
c:\WINDOWS\system32\jillm.ini
c:\WINDOWS\system32\jillm.ini2
c:\WINDOWS\system32\mllii.dll
Everything seems fine at the moment. No more restarting & all applications are working so far. I’m pretty ignorant on the subject, so maybe I did some harm somehow, we’ll see. Just thought it might help someone else.
Jeff[/quote]
Geee… Hi all you’ve got these troubles with explorer.exe. I’ve found this blog just in time and i want especially thanks for Jeff’s post. Hey man, you turned me at least into the right direction of resolving this problem. You mind soft called Vundofix i’ve tried it, but it found nothing. On the other side i find now in the %system%\system32 directory similiar files to yours… they are: KQBcJkkj.ini, KQBcJkkj.ini2 and finally jkkJcBQK.dll - i don’t know why “vundofix” have problems with recognizing them. I’m sure for 90% that they are something like malware or etc. … so i’m going to delete them manually (recovery console or safe mode - but they are hidden i think). Is there anyone who had same kind of explorer virus? Or can you give me some tips ? And sorry for my “central european english” i’m Slovak.
May 25th, 2008 at 3:26 am
Hmm s***, sorry for double post… as Eric said in article, i’ve renamed these infected files (3) and then deleted in Win32 GUI without protection. Everything was fine for 5 minutes and then something generated new files with different names in same location! Somewhere i read it can be caused by torrent and p2p applications (i don’t have any LimeWire, KaZaa or uTorrent installed) and also i don’t use Xvid codecs…It’s very curious that it can’t be recognized with NOD32, SpyBot S&D or Ad-Aware too. Have someone any ideas? I will be gratefull.
June 9th, 2008 at 10:08 am
Hey i have located the corupt files through Driveviewer although there is no way i have found in deleteing them without using a Explorer.exe program, and unlike the other programs which stay open even as the screen is dissapearing these ones delete with the screen. any suggestions?
June 11th, 2008 at 3:43 pm
Hi Eric,
I am fairly good with computers, but I got a really annoying problem. Everytime I log into my account it shows up as a blank screen. I usally go to task manager and cilck run new program and type in explorer.exe and then my desktop shows up. I did a spyware/virus check and nothing shows up. The laptop I have is fairly new and I would love to fix this problem ASAP.
Thanks,
VermontyPythonz
July 1st, 2008 at 3:50 am
Hi Eric…
I tried the procedures…. but instead of blank its a unknown type of file and i cant file that file…. i really want to delete it… will it solve my problem in explorer.exe?
Plz help me…. Our computer cant play a video in the window media player….
August 16th, 2008 at 8:42 am
I am currently having this problem. Even in safe mode i do not have access to the desk top. I can still access the Task Manager by pushing crt-alt-Del. I Have manualy deleted explorer exe from windows folder using command prompt. I copied explorer.exe from another computer and started it using Task Manager and every thing is working accept, copy and psting. Now i am in the process of backing up my files. I will reformat and reinstall. Three days are enough waste of time. I would like to konw how to deal with this problem. I tried reinstalling explorer form XP Cd it did not work
August 16th, 2008 at 5:20 pm
Well Paul, I can honestly say from my experience with this issue, removing explorer.exe doesn’t always fix it. Majority of the time, I have found that this problem is caused by spyware/malware that installs a .dll file somewhere in the /Windows or /Windows/system32 folder. I use software that my company made for our technicians to easily hunt these guys down by sorting out which DLL’s are being used on startup, and finding the “Author” information linked to them. Most of the time, we find that the trouble DLL doesn’t have any information on it, such as not made by “Microsoft Corporation” and has a funny file name, like kil88 (Just as an example.) Tracking these DLL files can be difficult but I would highly suggest looking into this issue to solve explorer.exe problem. I can almost guarantee it will be a DLL problem, unless you have recently installed in new updates, drivers, it most likely is going to be Malware in the form of a DLL.
Good Luck hunting.
August 16th, 2008 at 5:33 pm
Math3z, I’m glad to hear you were able to remove it, and sad to here that they have bounced back. Yes, P2P programs can be the source of GETTING the infection, but removing them will not solve the problem at hand. Most P2P programs are not the “virus”/”spyware” but allow viruses and spyware to easily slip into your system because of their vulnerabilities, security holes, and the fact that your downloading content from other people from them.
I can’t be of much help on your problem because I don’t have any software to recommend to you, but here is what I do when this problem arises.
Like mentioned in my above post my company and I have made software tools for our technicians to use in situations like this we solve it be doing the following. We watch the current process of the computer, when explorer.exe is closed, we relaunch it using the “Task Manager”, once relaunched we can see it in our “Processes”, most the time, a couple seconds later, explorer.exe closes. The key is, for us anyways, it when the kill command is sent to explorer.exe, it has to be sent from another process, so by viewing the active processes, we can see what process is sending the kill signal to explorer.exe, and actively hunt and remove it from there.
I guess the concept is, view your processes, and find the program that is killing explorer.exe by viewing active processes. Now you can use Task Manager to do this, but its not as nice as other software that gives you a better layout of processes, how they associate with each other, and in our case, color code things depending on whether it is “active” “killing” “starting” etc.
Good luck hunting!
October 4th, 2008 at 7:11 am
Dear Eric,
Just wanted to say thanks for all this information.
I’ve searched the Net now for a couple days on this exact issue, that I’m having, and although there IS information on it none of the info is as exacting in description as yours has been - so thanks for that.
I’ve tried almost everything and am still having the explorer.exe issue. At the same time, I cannot start in Safe Mode because I get a BSOD (blue screen of death) stating “video card failed to initialize”. I’m able to start in normal mode and I use the Process program you suggested to run IE and keep on researching the Net for a solution. Seems like my video card is corrupted, but I’ve tried backrolling it, & re-installing it - neither worked. I also uninstalled and reinstalled WinXP Service Pack 3 - did not help either.
I am now going to try your tips on searching out this DLL that you say is prob the issue. I hoping to God that I can fix this without having to reformat my hard drive - but it’s not looking good atm.
Any other tips you got are greatly appreciated. Thanks for your wonderful help here though.