[Jose Verde]

So, last night my computer decided it no longer wants to let me open the recycling bin:

Every time I open up the Recycling bin or have any part of Windows Explorer open for a period of longer than a few seconds, Windows Explorer crashes. This causes the computer to essentially reset. The desktop goes blank, and it reloads itself. Sometimes, I get an error that the Dr Watson Postmortem Debugger has crashed as well (drtwsn32.exe) and when this happens, my entire system locks down and the only way to get things back is by CTRL+ALT+DEL and log-off and log back in.

Everything else, as far as I can tell, is running properly. Here's what I've done so far:

1) Full scan of an updated McAfee Virusscan
2) Full system scan using AdAware
3) Full sysstem scan using Spybot
4) Full scan using Panda Active Scan
5) A CHKDSK on Drive c:\

These have yielded some spyware that has been removed but has seemingly revealed no devastating virus or worm...yet.

Im not sure what to do next, and Id love some help.

 

[onyblonx]

Any info on the spyware found?
A few (very few) malicious programs install a link into the explorer startup link making it so they run every time explorer is run, if the malicious exe is removed from the system the link can sometimes remain so that every time you run exploer without it it crashes. for some reason the desktop will load with this problem but then every time you try to open any window with explorer it crashes. This of course might not be your problem just something to check for. Also any info from the error diaglogs helps...

 

[Jose Verde]

Here's what I can gather from Spybot and Adaware:

Spybot reported a number of these:

HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)

and Adaware showed:

More tracking cookies as well as a ton of items that are similar to the following (with varying files and directories)

MRU LIST
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=MRU FileReference : C:\Documents and Settings\Jonathan Green\Application Data\microsoft\office\recent\06s0069.xls.LNK

I've also attached a screenshot of the error reported during the crash.

 

[freebird317]

If you have a windows xp cd you can try to restore system files. http://www.compphix.com/windowsfileprotection.html

 

[Jose Verde]

I ran that but the error still persists. I think that I have narrowed the issue down to something to do with AVI files.

Anytime that I now try and open an AVI file in windows the above error comes up. The Recycling Bin was crashing because there are a few AVI's inside and the view is set to Thumbnails.

 

[Jose Verde]

Another update. Scrolling around I have ran the following line:

Start->Run->regsvr32 /u shmedia.dll

Which fixed windows explorer from crashing. When I open AVI's however, they still crash leading me to believe that a codec issue is likely the culprit.

 

[onyblonx]

Good Job on the Reg catch. MRUs in Spybot SD are just recently used file lists and logs stored in the registry and files. You can almost always clear all of these with no ill effects. The only problem you may run into is it tells you some of the log files are still in use and it asks you if you want to have spysd clear them on the next restart. This usually has nothing to do with spyware and is just a special extra feature. As far as the cookies go, once again usually has nothing to do with "Spyware" in the software sense but is more of a only when browsing web sites using those companies cookies. A cookie is just a tag to identify you on many websites and can be used to track your browsing across all sites using a paticular advertising engine. Cookies can be safe and helpful but it always depends on the site and the intentions. Spybot simply removes the ones that are known to be used in questionable personal user tracking. Its always safe to remove all cookies.