Explorer.exe fails to load at startup

I have a handful of computers that at random will not launch explorer.exe
after a restart. It seems to be related to an update that was installed but
I can not figure out which one.

Has anyone else seen this occur? Any help would be great!

Hit Ctrl-Alt-Del and load Task manager.

From Task Manager, execute EXPLORER.EXE from; File --> New Task (run)

The desktop should load. Reboot the PC and see if you can logon and get the desktop again
without loading TaskManger and runing Explorer.exe .

I manage *many* computers in a Active Directory environment and we too experience this
sporadically. However, I do NOT consider this to be a problem unless this is consistently
seen on any one PC.

Out of 100 + users, I have handful of different PC's that experience this
too. I started getting the reports about 4 months ago after a series of
Windows updates. The same users report it randomly over and over. I have
users with the exact same PC configurations that do not experience it.
Because it was so random, I didn't immediately link it to the updates, though
that seems to be the pattern reported on the Web. With side by side
comparisons, I have not been able to pin this down.

It wasn't until recently that I discovered that loading Explorer through
Task Manager would load the desktop, so I have renewed my search for an
answer. Because this behavior causes my users pain and requires them to take
action outside the norm, namely using the Task Manager to run a program or
hard-start their PC, I DO consider this to be a problem.

I am considering forcing Explorer to run by adding a string in the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key in the
Registry. I am wondering whether you or anyone else has tried that and what
are (or could be) any adverse effects of doing so. Regardless, should I find
a solution, I will post it here.

we have the same problem here...Very annoying... Have you found a
solution ?

Correct - hitting ctl-alt-del ... explorer.exe does reload the desktop.
However I should not have to do this and the users that it is effecting are
not the most tech savy.

It happens at random - there is no pattern and it is effecting about 20
computers.

The only thing I did notice, I was rebuilding a computer for a family member
last night, I downloaded 97 updates and after the reboot this exact issue
happened. Which leads me to believe that it is related to the windows update.

I am glad someone else finds this behavior out of the norm and a problem. My
users expect their comptuers to work flawlessly and when they have to hit
ctl-alt-del to even start working .. i get the wrath.

I will try the reg edit on my test laptop and see if it continues to occur.
thanks for the ideas.

[hunterw44]

i had the same problem with vista, and i dont know if it works on xp but do this:
open up your registry editor
go in these folders:
HKEY_LOCAL_MACHINE/SOFTWARE/MICROSOFT/WINDOWS NT/CURRENT VERSION/ then click on WinLogon in the right window, look for Shell
double click it and in the value data box delete whats there and put this:
explorer.exe
restart your computer and there you go

I to am having this problem on a few machines. I thought about putting explorer.exe in startup but when explorer actually does run correctly the stupid thing loads windows explorer. The other problem is that the run calls actually go after the shell calls explorer. I also have deleted explorer.exe from the shell and put it back in hopes that would work. We are running Windows XP SP2 with Symantec Antivirus 10.1 Group Policy Active Directory and manage 500 plus machines. Anyone else running similar that is having the problem. Maybe if we try to see what we have alike we can get it figured out.

I was having this same problem (on 3 separate machines), but found a solution that worked for me. Here's what I was running with:

Windows XP Professional Version 2002 SP3
Dell Optiplex 755 w/ Intel Core2 Duo
Windows 2000 domain in mixed mode

Explorer would stop launching correctly after connecting to the domain and rebooting a few times. It could still be launched manually through the Task Manager.

For me, it turns out that the drivers for my Dell 1450 wireless USB adapter was causing the issues. There's a little blurb in the readme mentioning how the update is not recommended "on computers which have replaced the Microsoft Graphical Identification and Authentication (GINA) Logon screen for network logon." I didn't believe that had been modified, but it seemed suspicious. I hadn't even finished uninstalling the drivers and Explorer unhung and launched itself. It's worked fine since then.

Here's the version of the driver: v.I8.1.50,CM2.03.17,DR3.3.34, A06
It's packaged in self-extracting .exe labeled R114876.EXE

Try something here, and please post what works, if any:

DESKTOP ICONS AND THE TASKBAR FAIL TO LOAD AT STARTUP

This problem may be fixed by using one of these 4 repairs:

(1) RESTORE A MISSING "USERINIT" REGISTRY VALUE

1. Copy below and paste into Notepad:

----------copy inside only----------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\SYSTEM32\\userinit.exe,"

----------copy inside only----------

2. If your Windows is not on drive C: replace C: with your
Windows drive letter and Save-As Userinit.reg
(or any name + .reg).

3. Double-click or right-click and merge into the registry.

4. Restart.

(2) DELETE AN INCORRECT "EXPLORER.EXE" ENTRY IN THE REGISTRY

1. Open the Run box and enter: regedit

2. Go to this key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

3. If you see "explorer.exe" as a subkey below, delete it.

4. Restart.

(3) RESTORE A MISSING "EXPLORER.EXE" ENTRY IN THE REGISTRY

1. Copy below and paste into Notepad:

----------copy inside only----------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="explorer.exe"

----------copy inside only----------

2. Save-As WinLogon.reg (or any name + .reg).

3. Double-click or right-click and merge into the registry.

4. Restart.

(4) EXLORER.EXE IS MISSING

If explorer.exe is not in C:\WINDOWS\ then insert
your Windows CD and, using the 'Task Manager', run
the 'System File Checker' utility with this command:
sfc /scannow

If the 'System File Checker' didn't replace it, boot
to the Recovery Console with the Windows CD and copy
explorer.exe manually:

1. Insert the Windows CD and restart.

2. When setup begins, choose the "Repair or Recover"
option by pressing "R".

3. Once at the command prompt, enter:
copy D:\I386\EXPLORER.EX_ C:\WINDOWS\
(Change drive letters accordingly)

4. The file, "EXPLORER.EX_" is compressed and should be
automatically expanded on copy. If it doesn't just enter
this command:
expand C:\WINDOWS\EXPLORER.EX_ C:\WINDOWS\explorer.exe

5. To exit the Recovery Console, type: exit.

If the desktop still does not load then, from within the
Task Manager, run a new task to open the Registry Editor:
regedit.exe
and check the registry data from above, adding as neccessary,
if it is missing or incorrect.

Go here and download FixShell:
This script will fix the Explorer Shell.

Why answer a post which is over 5 months old?

Use my Remove-it software, it will remove that malware from your system.
Choose yes for all options when prompted.

PRESS ctrl+alt+delete > Task Manager > Applications tab > New Task > ENTER explorer.exe to load ur desktop > install Malwarebytes > run a virus scan > it should detect a trojan in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon2 (right above Winlogon).. removed the virus > reboot pc.

Copy explorer.exp from other computer c:\windows directory and peste it on your system in same location c:\windows.

When i got problem i try all other solution but not work listly i did it. now it's working perfectly.

Please explain me. Can u open c dirve by using task manager new task (run) or not?

[screwedblue]

after exhautive searches for a remidy i have found this easy simple step,, dowload malwarebytes and run.. for the past 3 days my explorer would not load, only a blank desktop,, running task manager i was able to get explorer to load infrequently. it would flash on then go away then come back, i tried to re-install windows xp home ( no avail) tried different virus scans ( i use avg free, and also use kapersky online scan and trend house call, only kapersky found 2 trojans)
after downloading malwarebytes and running a scan i found an additional 27 errors. run claener and then ran ccleaner to remove rest of wrong reg entries.
upon reboot, everything is back to as it should be,
will now try to add the log from malwarebytes scan.

Malwarebytes' Anti-Malware 1.33
Database version: 1698
Windows 5.1.2600 Service Pack 2

1/27/2009 8:19:30 AM
mbam-log-2009-01-27 (08-19-30).txt

Scan type: Quick Scan
Objects scanned: 67697
Time elapsed: 6 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 31
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 16
Files Infected: 31

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\iifGyVPF.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\khfCULbY.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90cc9550-c8c0-4588-b995-1de68652df4d} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{90cc9550-c8c0-4588-b995-1de68652df4d} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khfculby (Trojan.Vundo) -> Delete on reboot.

Running the Malwarbytes' got rid of the explorer.exe problem as well as 118 infections

By the way I also disabled the system restore before Running the Malwarbytes' then rebooted and renabled it again this was so the infections didnt get stored in system restore for the next time I do a scan.....

MBAM is (often) the bomb.

My case is probably a slightly serious than all the above.
I tried all the above measures, the problem still persist.

If I try to lunch explorer.exe or antivirus programs via Task Manager,
I get a "No permission to access the path, file, ..." error.

If I try to run the initial scan after installed Malwarebytes, it will
be terminated automatically and the whole GUI just disappears 5 sec
after the scan started. (same to all other antivirus scan)

Not sure if the virus evolved or anyboday had the same experience. I'm
really stranded now and doesn't know what to do. Fortunately I still
have a notebook to post this from home. Please advise. Thanks.

Did you try to run Malwarebytes in SafeMode??

You've been clearly exposed as a thief when you pirated code containing
a special marker enter by the real author, the file named
"obatssrsghde.exe" was a marker inserted into Stuarts batch file you
stole from him, it was a KEY that proves you're a thief:

For those that don't know, Stuart inserted the obatssrsghde.exe marker
into his batch file to prove, to the community, that PCBUTTS1 / The Real
Truth MVP is actually a lying thief, and PCBUTTS admitted in his own
post that he created the marker and claimed to know what it was - even
claimed to have submitted the malware to anti-virus vendors, but the
joke was on him, Stuart told everyone in the community about it BEFORE
it appeared in PCBUTTS1 download.... There is no actual file named
obatssrsghde.exe in the malware community, it was a ruse.

The key is in the spelling (shifted one character):

obatssrsghde.exe
pcbuttsthief

If you change (add) 1 character to each letter you will see that
"obatssrsghde" is actually the marker "pcbuttsthief" - proving that
PCBUTTS1 is a thief.

Are there other markers - YES, does PCBUTTS1 know about them - no,
they've been there for a long time, but this is the most obvious one.

Face it Chris/PCBUTTS1/TRT, you've exposed yourself in public.

Burn BitDefender, or another program listed at the link below, to a CD
(using a working machine) and test the infected machine with it.
BitDefender also has a Rootkit checker on the Linux Desktop; run it if
you think that's the problem

Download the executable rather than the .iso image, if one is
available.. it prompts you to insert a CD and burns the file, no problem.

Then run these:

Malwarebytes
SuperAntispyware

[03029174]

Im troubleshooting the same problem for my company. We have around 40 laptops and on average 1 or 2 machines fail to load explorer when they are rebooted every couple of days. We are currently using the launching explorer from the run command which works, but is not a long term solution.

Reading your posts has given me an idea which i will try testing today, but i just wanted to mention a few things.

A lot of people are saying this is a very intermittent problem, i.e. it only happens once in 10 reboots. Doesn't that rule out registry? I have checked the registry and all is fine, however id expect this otherwise explorer would fail to load every time.

There are no errors in my logs, so i am actively looking at ways to increase the logging of the process.

I would imagine it is a timing issue, maybe something is loading before explorer and blocking it access to something it needs to boot?

The network aspect is interesting. I have had one of the laptops on my desk and rebooted over 100 times, and haven’t seen the issue. In our lab they are connected in a Workgroup configuration so maybe this has something to do with it.

I would like to monitor the Windows API calls and confirm whether the process starts - runs and then crashes, or never actually starts successfully.

The problem here, is adding a kernel debugger slows up the process, hence removing the possible timing issue from occurring.

The laptops are custom machines running Windows embedded SP3. I agree this could open up the possibilities of missing dependant files etc, but must remember this is a very intermittent problem and there are machines with exactly the same load and config which have never experienced this problem.

I am looking at external sources as the culprit, maybe network traffic during the logon procedure causing a timing issue.

If anyone has any other ideas or knows any logging features or applications that might help, please feel free to post here and let us know.

[meuker1981]

its generic but block explorer.exe on taskmgr start explorer.exe in startup programs folder with a short cut or get a virtual machine and boot a os on it
go to the file and send it out to the main os via email or orb or w ever thean replace it. it works had to replace osk and explorer.exe & with file recovery checker

I have the same problem but doing this "Hit Ctrl-Alt-Del and load Task manager.

From Task Manager, execute EXPLORER.EXE from; File --> New Task (run)"

The desktop does not load. Is there another solution that anyone has come up with. I can get into Task manager even run Notepad from task manager but I still have no desktop. I would appreciate any help I can get. Thank you, PrinterDoc

[Stainlessman]

Here on my network, we are experiencing the same issue. Our current resolution (which is just to get users back in action) is to have them log off and back on with ctrl-alt-del, then explorer.exe loads and everything works. Here's the interesting part that was mentioned by user: 03029174. He/she mentioned that there must be a network component since it is not happening on the test machine in a WORKGROUP, and only on machines in the domain. I support this theory because this issue is not soley limited to desktop-loading at logon. It is also happening with the opening of network drives. Users are trying to open their network drives and are sporadically being prompted to choose a program to open it with. We have to prompt them through the steps of opening explorer.exe from the Windows folder. The interesting thing about this is that the checkbox to always use the program is grayed out and cannot be selected. I too am searching for a resolution and found this thread. I thought adding my piece might help with a clue.