How To: Fix explorer.exe from restarting.
Through out my job of being a computer technician I always seem to come across the famous Windows XP explorer.exe killer. You know the one. As soon as you log into your account, explorer.exe starts (you see the task bar, and all the icons) and just as suddenly you saw them, they disappear just like that. Then, out of no where they appear again, but to, disappointingly disappear again.
Most of the time it can be a nasty little bugger to get removed, and most anti-virus and anti-spyware software doesn’t remove or fix the problem. That is because the bug likes to hide using different techniques.
So today I wanted to share all the types of explorer.exe killers I have found, and how I fix the problem.
Before we begin:
I just want to say before I get started on letting you know how to fix this problem, is the trick to fixing this issue, has more to do with identifying which technique the bug is using, or if it even a bug at all. Explorer.exe can also start to do the same thing if an update didn’t take correctly. So, make sure that it wasn’t an update that killed off Explorer.exe first before assuming it’s a bug. If you think it was an update problem, I suggest reading this article.
The Killer Driver:
The first type of explorer.exe killer I find is simply a bug that installs a startup driver that kills that restarts the explorer.exe process any time it starts up. It is one of the easiest to spot, and is easy to fix. The first process is to find what drivers are being loaded, and which one it is that it is. What I recommend to do is to start up into safe mode (Reboot, hold F8, select Safe Mode). The reason we want to startup into safe mode is safe mode only starts the operating system with the minimum startup items, services, and drivers. So if we indeed do have a startup driver that is causing the issue, we should be able to login into Safe Mode and not have any explorer.exe problems.
First thing is to optimize the machine, so lets have you startup Msconfig. Go to Start > Run > Type in “msconfig” and hit enter.
In the window that appears choose the startup tab, and choose to disable all. Now go over the the “services” tab, and check the box to hide all non-microsoft services. Click “Apply” and hit “Ok”.
What we have done is cleaned out your startup and services, so if by chance the bug is one of those, we have stopped it from starting up, typically it isn’t going to do the trick, but will cover all our bases.
Now lets download a quick tool. Download link. This tool will allow us to see what drivers are currently loaded in Windows.
Reboot your system into Normal mode and run the program. Scroll through the list of drivers that are loaded, and see if you find any with any description or file type that is blank. If a driver has blank information, it may be the file we are looking for. Once you have found one, do a search for it, and delete the .sys file.
The .DLL File:
The majority of the time, this problem comes from a .DLL file. I would say about 90% of the machines I have worked on with this problem comes from a bad .dll file in hidden in the Windows or System32 directory. The technique I use to find the file we want to look for is a simple process as long as you have the right tools. First, we need a tool to help us watch system processes.
Go ahead and download Process Explorer. Process Explorer will allow you to watch system processes, and see what files, directories, etc they are calling for.
Once you have that up and running, make sure that you have the program running when explorer.exe is currently crashing and restarting. What you want to do is watch Process Explorer for the explorer.exe startup, and see if any other processes start up along side of it.
Typically what I see is explorer.exe starts up, then you have x process open up, and explorer.exe quits, and then x process quits. When x process starts up we want to hurry and take a look at what .dll files it is calling for. Once you have that info, go to the location of the file while being booted into a Live CD. and change the x.dll file to x.dll.bak. This way, if by changing the file messes up your system, you can go back and change it back to x.dll.
On the other hand, if it fixes the problem, you can go in and completely remove the file all together.
I know I didn’t get really to technical here and I apologize. If you have any questions or other techniques please leave a comment.
47 Comments so far
leave a commentHi, I have an issue with explorer.exe i googled and came across your post here, I ran into explorer.exe restarting before, and i’ve always fixed by re-format the computer. Recently, my computer boot up into windows with blank screen, i did the combinations Ctrl Alt Del and Windows Task Manger popup, i went File->New Task(Run…) an Creat New Task window popup i entered “explorer.exe” and voila, my desktop showsup. Ok so i’ve beening doing that for a while cause i’m too lazy to re-formate the pc. Up untill today, i do as what i’ve been doing to login by type explorer.exe and now i got an error message “explorer.exe is not a valid Win32 application” any thought or ideas on how to fix this?
Ty
Mark
[quote comment=""]Hi, I have an issue with explorer.exe i googled and came across your post here, I ran into explorer.exe restarting before, and i’ve always fixed by re-format the computer. Recently, my computer boot up into windows with blank screen, i did the combinations Ctrl Alt Del and Windows Task Manger popup, i went File->New Task(Run…) an Creat New Task window popup i entered “explorer.exe” and voila, my desktop showsup. Ok so i’ve beening doing that for a while cause i’m too lazy to re-formate the pc. Up untill today, i do as what i’ve been doing to login by type explorer.exe and now i got an error message “explorer.exe is not a valid Win32 application” any thought or ideas on how to fix this?
Ty
Mark[/quote]
Well now your in for a reformat Mark. It has been my experience as a computer technician that when you start to run into the “…. is not a valid Win32 application” error, you have major OS corruption that is best fixed by reformatting the machine.
haha, thanks i knew someone is going to say that, umm… i just want to learn how, and what sort of error causes these type corruption on a file, the “…is not a valid Win32 application”? I’m not clear about this, it must has been some sort of worm or trojan that modified *.exe, am i correct?
anyway, i think i fixed the problem but i’m not for how long this is going to last but it seem to be working fine for several hours now, basically what i did was, i copy a explorer.exe from my laptop and overwritten the orginal, the inffected explorer on my desktop and it works.
Mark
[quote comment=""]haha, thanks i knew someone is going to say that, umm… i just want to learn how, and what sort of error causes these type corruption on a file, the “…is not a valid Win32 application”? I’m not clear about this, it must has been some sort of worm or trojan that modified *.exe, am i correct?
anyway, i think i fixed the problem but i’m not for how long this is going to last but it seem to be working fine for several hours now, basically what i did was, i copy a explorer.exe from my laptop and overwritten the orginal, the inffected explorer on my desktop and it works.
Mark[/quote]
I’m sure that your fix will work for a bit, but don’t be surprised if it gets reinfected. Most of the time these errors occur because of a trojan that modifies the .exe in a certain way. Other times, you can have Windows Updates that cause the problem by not properly installing, but I would say this is not as big as a virus infection.
Good luck with your system Mark!
Thanks Eric,
hey, this is going to be off topic, but i thought to get your input. so, as i have described earlier how my computer startup without loading explorer.exe and i have to manually load it. Do you know any detection softwares which can detects or monitors what has been changed? this is actually quite annoying, to be honest i had reinstalled my computer for over 10times already over the past 12-13months time. not only the explorer.exe not load but it causes some of the function not to work, such as, RightClick on desktop->Properties, access Computer Manager, Run->cmd, Control Panel, ect… this happen both on my laptop and desktop.
p.s. the desktop is still working fine, i just want to know how to prevent this sort of thing from happening again, cause i’m planning to reinstall the window again.
Mark
[quote comment=""]Thanks Eric,
hey, this is going to be off topic, but i thought to get your input. so, as i have described earlier how my computer startup without loading explorer.exe and i have to manually load it. Do you know any detection softwares which can detects or monitors what has been changed? this is actually quite annoying, to be honest i had reinstalled my computer for over 10times already over the past 12-13months time. not only the explorer.exe not load but it causes some of the function not to work, such as, RightClick on desktop->Properties, access Computer Manager, Run->cmd, Control Panel, ect… this happen both on my laptop and desktop.
p.s. the desktop is still working fine, i just want to know how to prevent this sort of thing from happening again, cause i’m planning to reinstall the window again.
Mark[/quote]
Honestly as a technician and my experience if your having these problems I strongly recommend getting some anti-spyware and anti-virus software. I recommend Webroot’s Spysweeper and also Trend Micro’s Antivirus (AKA PC Cillin).
Okay but see here is MY problem which is RIDICULOUSLY annoying. Its the same thing, one day I came in, start up my PC (im currently using my laptop) and it loads windows then explorer restarts, loads up the icons, then poof there gone again, and will keep doing this FOREVER. I think its funny how all these fixed im finding online and on Google are telling me to install stuff on the pc to check for errors and what not.. HOW IN THE HECK DO I INSTALL ANYTHING on that PC if explorer.exe restarts every 5 seconds. Its impossible. Please PLEASE help me if you have any sort of fix without having to install anything let me know. I am pretty computer savvy and still have yet to find a fix, and formating is NOT an option.
hi my name is mike i resently got the explorer.exe virus. i beleve it was frome lime wire.
because it hapend as soon as i got it. but it is exactly as you described and i follwoed your steps but i tried to close a prosses i think is it. it says somthing about perimiter idk i just need advice. plz help
[quote comment=""]hi my name is mike i resently got the explorer.exe virus. i beleve it was frome lime wire.
because it hapend as soon as i got it. but it is exactly as you described and i follwoed your steps but i tried to close a prosses i think is it. it says somthing about perimiter idk i just need advice. plz help[/quote]
For what it’s worth, I’ve been having exactly the same problems (explorer restarting every 5 seconds) from something I dl’d from limewire. I followed the instructions above, but unfortunately neither fix worked for me. I came across a suggestion somewhere else to download “vundofix” and run that. I did & it came up with 3 corrupted files (this is after running AVG which did not fix it). I deleted the files
c:\WINDOWS\system32\jillm.ini
c:\WINDOWS\system32\jillm.ini2
c:\WINDOWS\system32\mllii.dll
Everything seems fine at the moment. No more restarting & all applications are working so far. I’m pretty ignorant on the subject, so maybe I did some harm somehow, we’ll see. Just thought it might help someone else.
Jeff
” Thanks Eric,
hey, this is going to be off topic, but i thought to get your input. so, as i have described earlier how my computer startup without loading explorer.exe and i have to manually load it. Do you know any detection softwares which can detects or monitors what has been changed? this is actually quite annoying, to be honest i had reinstalled my computer for over 10times already over the past 12-13months time. not only the explorer.exe not load but it causes some of the function not to work, such as, RightClick on desktop->Properties, access Computer Manager, Run->cmd, Control Panel, ect… this happen both on my laptop and desktop.
p.s. the desktop is still working fine, i just want to know how to prevent this sort of thing from happening again, cause i’m planning to reinstall the window again.
Mark”
There is an freeware application called “system protect” which might help, just google it.
[quote comment=""]”
Thanks Eric,
hey, this is going to be off topic, but i thought to get your input. so, as i have described earlier how my computer startup without loading explorer.exe and i have to manually load it. Do you know any detection softwares which can detects or monitors what has been changed? this is actually quite annoying, to be honest i had reinstalled my computer for over 10times already over the past 12-13months time. not only the explorer.exe not load but it causes some of the function not to work, such as, RightClick on desktop->Properties, access Computer Manager, Run->cmd, Control Panel, ect… this happen both on my laptop and desktop.
p.s. the desktop is still working fine, i just want to know how to prevent this sort of thing from happening again, cause i’m planning to reinstall the window again.
Mark”
There is an freeware application called “system protect” which might help, just google it.[/quote]
Well, Webroot’s Spysweeper is a pretty good Anti-Spyware program that notifies you of system changes. I would give that a try.
There is an freeware application called “system protect” which might help, just google it.[/quote]
Thanks I’ll google it up for sure,
Mark
Hey, Eric.
I have the explorer.exe problem and I am almost certain it is a “killer driver.”
I have found 4 unknown file types and file types with no descriptions through Driver View.
You then state to search for them and delete them. I can’t do this, because explorer.exe retarts itself too fast in time for a search.
I attempted to search in safe mode but when I searched the files, it came up with no results.
Please help or e-mail me:
syca @ cox.net
yes me too…
i did all the tips you suggested here on your post… sir..
but i can’t delete also the unknown file type thing because explorer.exe restarts in 5 secs…
and by the way…
deleting dump_atapi.sys, and dump_WMILIB.sys can cause effects on my OS??
please tell me what to do
email me…cjonline101@yahoo.com
[quote comment="2310"][quote comment=""]hi my name is mike i resently got the explorer.exe virus. i beleve it was frome lime wire.
because it hapend as soon as i got it. but it is exactly as you described and i follwoed your steps but i tried to close a prosses i think is it. it says somthing about perimiter idk i just need advice. plz help[/quote]
For what it’s worth, I’ve been having exactly the same problems (explorer restarting every 5 seconds) from something I dl’d from limewire. I followed the instructions above, but unfortunately neither fix worked for me. I came across a suggestion somewhere else to download “vundofix” and run that. I did & it came up with 3 corrupted files (this is after running AVG which did not fix it). I deleted the files
c:\WINDOWS\system32\jillm.ini
c:\WINDOWS\system32\jillm.ini2
c:\WINDOWS\system32\mllii.dll
Everything seems fine at the moment. No more restarting & all applications are working so far. I’m pretty ignorant on the subject, so maybe I did some harm somehow, we’ll see. Just thought it might help someone else.
Jeff[/quote]
Geee… Hi all you’ve got these troubles with explorer.exe. I’ve found this blog just in time and i want especially thanks for Jeff’s post. Hey man, you turned me at least into the right direction of resolving this problem. You mind soft called Vundofix i’ve tried it, but it found nothing. On the other side i find now in the %system%\system32 directory similiar files to yours… they are: KQBcJkkj.ini, KQBcJkkj.ini2 and finally jkkJcBQK.dll – i don’t know why “vundofix” have problems with recognizing them. I’m sure for 90% that they are something like malware or etc. … so i’m going to delete them manually (recovery console or safe mode – but they are hidden i think). Is there anyone who had same kind of explorer virus? Or can you give me some tips ? And sorry for my “central european english” i’m Slovak.
Hmm s***, sorry for double post… as Eric said in article, i’ve renamed these infected files (3) and then deleted in Win32 GUI without protection. Everything was fine for 5 minutes and then something generated new files with different names in same location! Somewhere i read it can be caused by torrent and p2p applications (i don’t have any LimeWire, KaZaa or uTorrent installed) and also i don’t use Xvid codecs…It’s very curious that it can’t be recognized with NOD32, SpyBot S&D or Ad-Aware too. Have someone any ideas? I will be gratefull.
Hey i have located the corupt files through Driveviewer although there is no way i have found in deleteing them without using a Explorer.exe program, and unlike the other programs which stay open even as the screen is dissapearing these ones delete with the screen. any suggestions?
Hi Eric,
I am fairly good with computers, but I got a really annoying problem. Everytime I log into my account it shows up as a blank screen. I usally go to task manager and cilck run new program and type in explorer.exe and then my desktop shows up. I did a spyware/virus check and nothing shows up. The laptop I have is fairly new and I would love to fix this problem ASAP.
Thanks,
VermontyPythonz
Hi Eric…
I tried the procedures…. but instead of blank its a unknown type of file and i cant file that file…. i really want to delete it… will it solve my problem in explorer.exe?
Plz help me…. Our computer cant play a video in the window media player….
I am currently having this problem. Even in safe mode i do not have access to the desk top. I can still access the Task Manager by pushing crt-alt-Del. I Have manualy deleted explorer exe from windows folder using command prompt. I copied explorer.exe from another computer and started it using Task Manager and every thing is working accept, copy and psting. Now i am in the process of backing up my files. I will reformat and reinstall. Three days are enough waste of time. I would like to konw how to deal with this problem. I tried reinstalling explorer form XP Cd it did not work
Well Paul, I can honestly say from my experience with this issue, removing explorer.exe doesn’t always fix it. Majority of the time, I have found that this problem is caused by spyware/malware that installs a .dll file somewhere in the /Windows or /Windows/system32 folder. I use software that my company made for our technicians to easily hunt these guys down by sorting out which DLL’s are being used on startup, and finding the “Author” information linked to them. Most of the time, we find that the trouble DLL doesn’t have any information on it, such as not made by “Microsoft Corporation” and has a funny file name, like kil88 (Just as an example.) Tracking these DLL files can be difficult but I would highly suggest looking into this issue to solve explorer.exe problem. I can almost guarantee it will be a DLL problem, unless you have recently installed in new updates, drivers, it most likely is going to be Malware in the form of a DLL.
Good Luck hunting.
Math3z, I’m glad to hear you were able to remove it, and sad to here that they have bounced back. Yes, P2P programs can be the source of GETTING the infection, but removing them will not solve the problem at hand. Most P2P programs are not the “virus”/”spyware” but allow viruses and spyware to easily slip into your system because of their vulnerabilities, security holes, and the fact that your downloading content from other people from them.
I can’t be of much help on your problem because I don’t have any software to recommend to you, but here is what I do when this problem arises.
Like mentioned in my above post my company and I have made software tools for our technicians to use in situations like this we solve it be doing the following. We watch the current process of the computer, when explorer.exe is closed, we relaunch it using the “Task Manager”, once relaunched we can see it in our “Processes”, most the time, a couple seconds later, explorer.exe closes. The key is, for us anyways, it when the kill command is sent to explorer.exe, it has to be sent from another process, so by viewing the active processes, we can see what process is sending the kill signal to explorer.exe, and actively hunt and remove it from there.
I guess the concept is, view your processes, and find the program that is killing explorer.exe by viewing active processes. Now you can use Task Manager to do this, but its not as nice as other software that gives you a better layout of processes, how they associate with each other, and in our case, color code things depending on whether it is “active” “killing” “starting” etc.
Good luck hunting!
Dear Eric,
Just wanted to say thanks for all this information.
I’ve searched the Net now for a couple days on this exact issue, that I’m having, and although there IS information on it none of the info is as exacting in description as yours has been – so thanks for that.
I’ve tried almost everything and am still having the explorer.exe issue. At the same time, I cannot start in Safe Mode because I get a BSOD (blue screen of death) stating “video card failed to initialize”. I’m able to start in normal mode and I use the Process program you suggested to run IE and keep on researching the Net for a solution. Seems like my video card is corrupted, but I’ve tried backrolling it, & re-installing it – neither worked. I also uninstalled and reinstalled WinXP Service Pack 3 – did not help either.
I am now going to try your tips on searching out this DLL that you say is prob the issue. I hoping to God that I can fix this without having to reformat my hard drive – but it’s not looking good atm.
Any other tips you got are greatly appreciated. Thanks for your wonderful help here though.
thanks.. Your process killing method worked..
I just wanted to say that i had the same problem with explorer closing and reopening. I couldnt get process explorer to work so all i did was use task manager to view my system 32 folder. Then i used my detailed view so i could see which files had be recently created, after that it was easy to spot the DLL file that was causing the problem because it was just random letters and numbers. It was something like asde4asf.dll. I just deleted it and in no time at all explorer had stopped crashing
Hi Eric…
I tried the .DLL file procedures…. but after i write .dak. it copys new dll. files…..
ang the old dll.dak. can’t bee removed
?
MISTER ERIC TAYLOR
YOU MAKE A WONDERFUEL JOB
MANY THANKS FROM
GREECE
Hie.I have a problem with ma explorer.When u start the comp n after booting process the explorer disappears completely.I have tried all these tricks but none is working.Infact I think the hard disk has been corrupted.Who gonna help there,coz wen I try to format after f8,the partition is unknown.Thanks geeks.
Hi
As you all seem to be very worth reading, I truly hope you can help me.
I have the .exe not a win32 applicattion message poping out more and more often.
My laptop has been reformarted by the manufacturer, 4 times in 11 months, and even the hard drive has been replaced. This message appears even when I am downloading applications/ updates from the official microsoft site. I am cursed by having purchased a dell with vista home premium as an OS and have been suffering this ever since. I have an antivirus programme, that doesn’t detect anything wrong, due frequent tune ups, have downloaded something regcure, that apparentely should help and NOTHING .
s.o.s and thank you in advance
If
Try this : start–> run—> sfc /scannow and press OK
hi nirmal,
i have tried this what it would it do?
nirmal, forgot to tx you!
try the 2ns one which is bit complicated..but make sure that you have Microsoft Windows XP CDROM (In case needed for re-installation)
1.Go to “C:\WINDOWS” folder through “My Computer”. If accessing the My Computer folder is not possible then you can go to Command prompt by typing “cmd” in the “Run” command line and accessing the “WINDOWS” folder from here.
2.Copy the EXPLORER.EXE (Computer icon) file and paste it in the same folder. A file “Copy of EXPLORER.EXE” will be created in the folder. Now change the file name to your name.exe. For example, I renamed it to “test.exe”
3.Now go to Start >> Run and type “regedit” and press enter key. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon. In this folder, you will find a sub named “shell”. Double click it and rename the “explorer.exe” to “test.exe”
4.Restart your computer after making this change. Everything will be back to normal without any problems!
Dear Nirmal,
Thanks a million, but I was wondering this would also work with my OS, which is Vista Home Premium?
Hi Anaclara..
im not getting this : what you mean by
“I have the .exe not a win32 applicattion message poping out more and more often.”
is it explorer.exe
Can you post some screen shots here… ?
Hey Eric! I wanted to ask if theres anything I can do about this little problem of mine. Everytime I restart or log into my computer, there is a small box that pops out saying ‘Personalized Setting’. Then, after the icons on the lower left are loaded, my screen blocks out again only showing my wallpaper and loads again. I know the culprit is explorer.exe but I cant seem to fix it and its been bothering me. Any help would be appreciated. Thanks
Ron
Well Ron, from the sounds of it, you most likely have a program that is running in task with explorer. It most likely takes over some operation over explorer.exe at one point.
Best thing I could suggest, that I suggest to everyone, is backup all important files, and reload your Operating System.
As much as that sounds like a painful process, I highly recommending reloading your OS at least every 6 months, and no longer then 1 year. It really helps things run smooth and help get rid of the junk on your machine you are not aware of was there in the first place.
Let me know how reloading your OS goes!
hi eric which file is delete ?? on driver view ? why to remove explorer .exe ??
hi Eric! i would like to ask you if you know something about this kind of error
i mean it all work perfectly until the moment i try to delete a folder or a file or something like that my pc gets blocked i can’t use anything if i do the Ctrl plus Atl plus Del thing opens the task manager but i can’t do anything after 1 min gets blocked that one too …. th e only option remais restart
i don’t want to format the pc cause i have stuff that i can’ t put on cd or dvd and i can’t afford to lose it so if you know somwthing plssss answer this !!
thank you
Hello Eric.
I’ve followed your guide for the “Killer Driver” fix. Using the Driver View tool, I found three drivers with no description:
dump_atapi.sys
dump_WMILIB.sys
SYMEFA.sys
All three files are said to be located at C:\WINDOWS\SYSTEM32\DRIVERS\ according to the Driver View program.
However, browsing the folder, none of the files could be found. I found out that SYMEFA.sys is a file related to Norton Internet Security, and is located in C:\WINDOWS\DRIVERS\NIS\1005000.086
I was unable to delete the file although I’m sure Norton wasn’t running.
I was unable to find info on the other “dump_” drivers.
Following the “.DLL File” guide, I saw no processes starting and ending along-side explorer.exe
Finally, I’d like to say that the article you’ve linked to Microsoft Support is no longer working.
Sorry for the double post, but I believe I’ve fixed my problem. Using the Windows Task Manager, I ran explorer.exe *while* it had just restarted. I then recieved an error message that Windows Explorer had to close, followed by another message saying the problem was because of igfxcpl.cpl in my SYSTEM32 folder. I then disabled it through TweakUI. I hope this will help someone.
my dell pc one day decided to show up pink on my aubrey user and i have no desktp cant see the start buttong ever time i type explorer it say ……not valid win32 app i just wanna kno i can i get my desktop back , i really need it back apap . please HELP MEE
Eric, my exeplore.exe is constantly resetting and I have tried everything but your suggestions, which I will do shortly. However, I need to know if you are still providing assistance…
Eric, I am using a freeware called Resource Hacker. (Wish I never did)
In the program it allows you to format the start button. So I edited what the start button said, what it said when I hovered over it, and also the icon next to the word.
To save you must open Task Manger go into processes and kill explorer.exe. –> Alt-Tab to Resource Hacker & Save.
Then go back into Task Manager and Run new task and type explorer.exe.
Fine! It worked no problem, but I then changed the start menu .bmp icon too many times, the last time after saving I tried starting explorer.exe as a new task and i ended up with this error.
“EXPLORER.EXE IS NOT A VALID WIN32 APPLICATION”
Seriously? Any help would be greatly appreciated, Sorry4TheNovel.
I solved the problem by ending the dll. thingy in task manager then open it by running explorer.exe. Thanks so much ^^
windows 7: start menu, Run…, msconfig, Startup; from here you can disable startup items
dear eric,
my system has win 7 32 bit professional OS .the explorer.exe suddenly stops frequently & shows application error which cannot be minimized else explorer stops .hence i use task manager to restart explorer.pls help me to get rid of this stupid method.
thanks;
prateek