Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
Hey everyone,
Here's the scoop:
When I boot up my computer (before I even get to the desktop), I recieve this error message:
"Explorer
An error has occured in your program. To keep working anyway, click Ignore and save your work in a new file. To quit this program, click Close. You will lose information you entered since your last Save."
When I try clicking Ignore nothing happens - the error message keeps popping up. When I click close, this error message appears:
"Explorer has caused an error in GDI.exe. Explorer will now close. If you continue to experience problems, try restarting your computer".
Then I click close, and it just hangs there. I still can't see the desktop or anything (just the background color of the desktop).
I have tried restarting and the same thing happens. When I restart in SafeMode, everything opens up just fine.
Any ideas? Thank you for your time!
-Katie ;)

http://support.microsoft.com/?kbid=146904
GDI is the Graphic Device Interface, which is the core Windows graphics engine responsible for representing graphical objects and transmitting them to output devices, such as monitors and printers. I don't know what kind of problem you might be having with GDI but you could try
a) backing up your computer,
b) using your Windows insatller CDs to repair your system.Sounds like a number of things really. NONE of them very good at all.
Leon Wisnensky
The Hot Dog Vending Pimp

Hi Katie:
What kind of AV are you running, are you running Spybot or Adaware?
What were you doing just before this problem started? Were you downloading something? Have you been to any sites like gambling or gaming or Kazaa, or anything like that?
Are you updated on IE and Me?
Your Me should be Me 4.90.3000, and your IE should be IE6 sp1 with updates.
Have you considered just uninstalling and re-installing IE?
Thresher

Hey Thresher!
I am running Spybot and Adaware (I have run them in SafeMode because that's the only way I can get onto the desktop to access the files) ... yeah I was downloading using WinMx ... I'm not sure how to get internet access on my computer now. When I boot up in safemode, my broadband internet service connection doesn't work (it just says that there is no connection).
Any ideas?
Thanks!
-K ;)

Hey Katie, below is a link to some advice I gave a while back to someone else:
http://www.computing.net/windowsme/wwwboard/forum/31518.html
Look at response number seven:
If you can make the changes to system.ini
and get IE to run, you'll have to find your way to it using the awkward progman.
C:\progra~1\intern~1\iexplore.exe
open up MS IE download site(just type microsoft.com/ie) reninstall IE. Shut down, change system.ini file back and restart. I bet this would fix you up.

http://computing.net/windowsme/wwwboard/forum/30687.html
has some advice too. The paragraph that starts with
Explorer.exe to Progman.exe
Walks you through the process I am talking about above, except starting IE and reinstalling.

Katie, it's important to know what you were doing just before this started happening...anything? Installing windows or IE? Visiting some weird site, just browsing?
You can reinstall IE by going to 'search files and folders' and enter 'EXPLORE.EXE' without the quote marks. That will give you the setup file and that will reinstall IE, then go immediately to the update site. Again if you are not updated on IE and Me you should do that as soon as you can.
On some Me versions you can re-install through add/remove. Click on the IE listing and if it gives you a repair or reinstall option, take it. Other wise go to the setup folder. If you did not save the setup folder, or you don't want to mess with add/remove-- there is an IE reinstall site at
http://support.microsoft.com/default.aspx?kbid=318378
Please post back what method and results you got, I use Me on one of my boxes so I am curious to see if mine or StevenW's solution worked.
Thresher

You'd also better tell them about the large volume of malware you had on your system too Katie, and whether you really did clear it ALL out.
If you don't follow up and respond to prior posts to finish up, it makes it impossible to give accurate help in any future problem you have.
As the old adage goes. You can't help those who don't help themselves.
See the iDiOt walk
See the idiot TaLkWaLk IdIoT WaLk

hey everyone,
I tried everything all you guys said ... but now when I go into Safemode, the computer doesn't even start up anymore. Now it just gives this error message in SafeMode:
"Error loading program.exe You must reinstall Windows". When I click OK, the computer just totally dies.
What should I do :(
Thanks,
-K

Hi Steven,
Sigh...yeah ...it's been a long week, and I read it wrong. I'm sorry.
Can I do something about it?
Katie

Try editing the shell= line back to how it was.
Shell=Explorer.exe
Failing that try, scanreg /restore at the A:\> prompt. Pick a date prior to your immediate circumstances.
Failing that, explorer.exe extraction. See what happens with the first two though.
See the iDiOt walk
See the idiot TaLkWaLk IdIoT WaLk

Hey Viking,
How can I edit that line? I can't get into edit it ... Using SafeMode to start the computer doesn't even work anymore. When I try to boot using SafeMode, I get this message: "Error loading program.exe You must reinstall Windows". When I click OK, the computer just totally dies. How can I edit the shell= line without SafeMode? Thanks!

Get your ME startup disk and boot with it. At the A:\> prompt, type either...
cd c:\windows
and enter
Or,
c:\
and enter, then type
c:\windows
and enter
Either way get to the c:\windows > prompt and type...Edit system.ini
and enter.
Blue screen (black border) comes up usually. Use the keyboards up and down keys to get to the appropriate line, and then edit the line back from there, making sure you save the changes.
If the line already reads Shell=Explorer.exe when you get there, exit Edit system.ini so that your back with a black screen and the c:\windows > prompt.
Then type.
A:\
and enter to get back to the A:\prompt, and then type.
scanreg /restore
and enter. Now pick a date prior to these circumstances happening.
If you do edit the line back though, save the changes and try rebooting into Windows again.
If that fails, then reboot and try the scanreg /restore line and pick a prior date.
Post back with an outcome to either.
So that's, Edit system.ini from DOS first and if it's already reading Shell=Explorer.exe, do the scanreg /restore line while your still in DOS.However, if it doesn't read Shell=Explorer.exe, and reads Shell=Progman.exe, then obviously edit it (as above), save the changes, and try rebooting to Windows.
It's too early to be typing here, so if what I've put seems a little convoluted, you will just have to pick the bones out of it. It's not hard really, honest.
See the iDiOt walk
See the idiot TaLkWaLk IdIoT WaLk

Read that article and apply the steps to you, to edit the line back.
See the iDiOt walk
See the idiot TaLkWaLk IdIoT WaLk

Hey Viking - I'll get started on that right now. I'm sorry for the delay, midterms! Ahh!!
-K ;)

Hey Viking,
Ok, I edited the line and now when I boot up, everything is back to normal ... wierd. That GDI.exe message is no longer there. Viking, I swear you must be some kinda genius!

Not really weird. Couple of things could have happened, or combination of them. I would put that down to "system jolt" and the "re-employing" of explorer.exe. Operating systems don't like heavy duty jolts, sometimes they can have a positive effect though.
Now post that GODAMN HijackThis log :), so we can finally see if your properly cleaned out, or not.
Delete the old HJT, if you haven't already, and unzip it (this time round) to your program files. Anywhere but the Temp folder (you did last time), or the desktop.
It won't take you two minutes, because you cleaned most of the crap last time round.
;)
See the iDiOt walk
See the idiot TaLkWaLk IdIoT WaLk

Hey Viking,
Here's the log:
Logfile of HijackThis v1.98.2
Scan saved at 9:12:49 PM, on 10/27/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.exe
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\BCMDMMSG.exe
C:\WINDOWS\SYSTEM\MPREXE.exe
C:\WINDOWS\EXPLORER.exe
C:\WINDOWS\WTUKBA.exe
C:\WINDOWS\RUNDLL32.exe
C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.exe
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.exe
C:\WINDOWS\SYSTEM\STIMON.exe
C:\PROGRAM FILES\AVANT BROWSER\AVANT.exe
C:\WINDOWS\SYSTEM\DDHELP.exe
C:\PROGRAM FILES\HIJACKTHIS.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tc.umn.edu/~chess
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tc.umn.edu/ chess
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.exe 1
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.exe" /0
O8 - Extra context menu item: Add to AD Black List - C:\PROGRAM FILES\AVANT BROWSER\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\PROGRAM FILES\AVANT BROWSER\AddAllToADBlackList.htm
O8 - Extra context menu item: Search - C:\PROGRAM FILES\AVANT BROWSER\Search.htm
O8 - Extra context menu item: Highlight - C:\PROGRAM FILES\AVANT BROWSER\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\PROGRAM FILES\AVANT BROWSER\OpenAllLinks.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.exe
O9 - Extra button: ComcastHSI - {F29EDB19-B705-4A3E-A241-DF72616BFB0C} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Help - {D275B8C9-0ABD-4C27-BD7B-51C14B0852B0} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {035F394A-F194-4AC4-938F-DC2E66A39EBF} - http://www.comcastsupport.com (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {562F499D-186B-42E7-B112-23D82883D542} (AxTaskList Class) - http://moneycentral.msn.com/cabs/webinst.exe
O16 - DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupdate.exe

Hey Katie
Like I said nothing much wrong there now. Apart from ...
C:\WINDOWS\WTUKBA.exe
So boot into safe mode, just double check your add and remove programs (again) - make sure your happy with what's there. If something looks bogus and could possibly be attributed to WTUKBA.EXE, then uninstall it.
You know the drill by now.
Anyways, likely it won't be there, so, open HJT and put a check mark next to ....
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tc.umn.edu/~chess(top one).
and
O9 - Extra button: Help - {D275B8C9-0ABD-4C27-BD7B-51C14B0852B0} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
and remove.
Now head for ...C:\WINDOWS\WTUKBA.exe
and delete it and reboot.
If you must use weatherbug you must know that's it's adware and considered adware, or at least the free version is.Personally I think you should stick your head out of the chess club building and see what the weather is doing, but that's just me.
Now you will be needing to post one last log after this. So as I can make sure that no sneaky crap has come back.
Don't forget now ;)
See the iDiOt walk
See the idiot TaLkWaLk IdIoT WaLk

Hey Viking!
Logfile of HijackThis v1.98.2
Scan saved at 9:05:04 PM, on 10/28/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.exe
C:\WINDOWS\SYSTEM\MPREXE.exe
C:\WINDOWS\BCMDMMSG.exe
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.exe
C:\WINDOWS\RUNDLL32.exe
C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.exe
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.exe
C:\PROGRAM FILES\AVANT BROWSER\AVANT.exe
C:\WINDOWS\SYSTEM\STIMON.exe
C:\WINDOWS\SYSTEM\DDHELP.exe
C:\PROGRAM FILES\WINMX\WINMX.exe
C:\PROGRAM FILES\HIJACKTHIS.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tc.umn.edu/~chess
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tc.umn.edu/~chess
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.exe 1
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.exe" /0
O8 - Extra context menu item: Add to AD Black List - C:\PROGRAM FILES\AVANT BROWSER\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\PROGRAM FILES\AVANT BROWSER\AddAllToADBlackList.htm
O8 - Extra context menu item: Search - C:\PROGRAM FILES\AVANT BROWSER\Search.htm
O8 - Extra context menu item: Highlight - C:\PROGRAM FILES\AVANT BROWSER\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\PROGRAM FILES\AVANT BROWSER\OpenAllLinks.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.exe
O9 - Extra button: ComcastHSI - {F29EDB19-B705-4A3E-A241-DF72616BFB0C} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Help - {D275B8C9-0ABD-4C27-BD7B-51C14B0852B0} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {562F499D-186B-42E7-B112-23D82883D542} (AxTaskList Class) - http://moneycentral.msn.com/cabs/webinst.exe
O16 - DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupdate.exe

Hey Katie - for all intents and purposes your clean now.
I'm assuming you still have that firewall installed. With spywareblaster and AV up to date.
If you don't, expect serious chess piece damage when you wake up in the morning.
If you've got WinMX you might wanna give eMule a try. A lot of my clients like it. It's open source, so clean and free and constantly updated.
HEY KATIE ...good luck in your exams ;)
See the iDiOt walk
See the idiot TaLkWaLk IdIoT WaLk

![]() |
browser windows
|
gif to jpg
|

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |