No Explorer.exe on Login

[cgiuk]

I have a domain user who logs onto the domain but no explorer is shown. All that is displayed is a My Documents window. If she closes this window then explorer kicks in and the desktop is shown. I was just wondering if anyone else had seen this problem before?

[cookie_monster]

Is it possible that a My Documents shortcut has found it's way into her startup folder? You could also try to delete their profile, check the run keys for odd entries and run a virus scan.

[Gibson335]

I'd certainly start by deleting any relevant profiles - it may be that something is trying to run in that My Documents window, preventing anything else from running until it's closed down.

[cgiuk]

Ok..the plot thickens. I removed the relevant user profiles and recreated the user on the server. All well and good. The user has just come to login this morning and the same thing has happened. It's also thrown up a new error. When the user logs in, the full explorer is not shown, just a My Documents window as before. This time however, a Data Execution Prevention error message is shown and after a few seconds, closes the My Documents window leaving the desktop wallpaper with no icons or toolbars etc. Has anyone got any brilliant ideas because i'm stumped?

[Michael]

I've seen this happen on Windows Vista a few times and it was caused by spyware.

[steve_nfi]

I had this error a while ago. Explorer gets corrupted somehow. I think mine was caused by a virus.

You have to go into the registry and rename the program. I renamed mine to something like explorar.

Then restart the PC and windows creates a new explorer.

I cant remember the exact path in the registry.

 

Give me a few minutes and try to track down my post on this.

[Michael]

@cgiuk - Is this an XP or Vista machine? Desktop in school or laptop?

[steve_nfi]

FOUND IT!!

 

 

To fix the problem you need to edit the registry on every machine that is affected, follow these instructions:

 

start -> run -> type in regedit

 

HKEY_LOCAL_MACHINE -> SOFTWARE -> MICROSOFT -> WINDOWS NT -> CURRENT VERSION -> IMAGE FILE EXECUTION OPTIONS

 

Look thought the list of .exe files and youll find a "explorer.exe" process, you need to rename this process to something, doesnt matter what as it will create a new explorer process, i renamed all mine to explorir.exe

 

Dont know why this happened but once i followed this fix all the machines came back up and running.

 

Give that a bash and let me know how it goes =)

 

This was thanks to Bluetooth.

[Michael]

@steve_nfi - How would this solve the problem out of curiosity as the explorer.exe file is still in C:\Windows?

[steve_nfi]

When you log on, the machine just sits doing nothing as if it's going to start but doesn't.

Try Cntl/Alt/Del and open task manager. In Applications tab click on new task and run regedit.

 

Alternately if you have a boot disk of some sort (Erd, Hirens or some other equivalent) and do the regedit changes that way.

 

Don't know if it changes the actual program or whether Windows creates an new one. It works.

Edited November 18, 2009 by steve_nfi

[cgiuk]

Thanks for the posts everyone. Everything that everyone's said makes sense but I'm sure this is a profile problem because it is following the user around the school. If they log onto a machine and have the problem, I can go onto the machine straight afterwards and it will behave perfectly. I have a feeling it's something in the user's home folder but I've scanned it all multiple times for nasty bits and pieces and nothing is turning up.

 

The machines are XP by the way.

[cookie_monster]

So you say you deleted the users profile and the problem came back? Did you delete local and roaming profiles?

 

Have you checked logon scripts for the user? If a path in the logon script refers to a file that no longer exists explorer sometimes just opens the folder where it resides.

[PiqueABoo]

@steve_nfi - How would this solve the problem out of curiosity as the explorer.exe file is still in C:\Windows?

 

I've seen malware fiddle with that key a couple of times this term and it used those subkeys to stop you running most AV apps and other apps you might use to figure out what is going on. It works like this:

 

If I make a subkey called A.exe and create a Debugger value of B.exe, then B.exe will be run in place of A.exe. Rename/delete that subkey and we're back to running A.exe.