Brian, (1) concerning your comments in Reply #11 (“The Symantec site indicated that definitions for this malware had been available for over a year”), are you saying that there is a problem with LiveUpdate not downloading or maintaining the most recent virus definitions?  Did you try to use Symantec’s Intelligent Updater rather than LiveUpdate?  How did you get the virus definition file that was successful in identifying the malware?

(2) Can you kindly provide information on the files which are indicative of the presence of the malware ("I looked back at images taken over the few weeks prior to our problem and the malware files were present but were not being detected by NAV on the weekly scans")?

(3) When using the WindowsShiftKey+E method to launch Windows Explorer, the delay occurs on the first as well as all subsequent attempts.  The delay also occurs whether or not a Windows Explorer window is already open.  However, using the “program shortcut” method to launch Windows Explorer (see Reply #8 ) seems to consistently result in Windows Explorer appearing quickly.

Ghost4me, concerning the clearing of MRU items, Microsoft has made available a registry script to do this task (see “ClearMRU.reg” in the article Customizing Your PC with the Windows XP Registry).  Ad-Aware SE Professional can also be used to detect and clear MRU items.

Please keep the ideas coming.  More “detective work” yet to be done . . . .

Quote:


I mainly use LiveUpdate and the definitions in my computers are always current. Occasionally I try Intelligent Updater. LiveUpdate would be responsible for the definitions that identified the malware.

Quote:


Sorry. This is now very relevant but I didn't record the names. I can't be certain that these agents caused the problem with two of my computers but it's very likely. Two computers with the same Windows Explorer problem and the same malware.

In the case of cmdow.exe, it had definitely been in my computer for over a year. In two places. Symantec claim definitions have been available since Jan 2004. I've submitted cmdow.exe to online scans and only a few companies regard it as malware.

Pleo, is your CPU on 100% while you are waiting for Windows Explorer to open? I think mine was.

Pleonasm

There seem to be some interesting *clues* here--but I'm not sure what to make of them.

You said you have a backup that pre-dates when the problem began--so you must have some good idea of when this started--what changes in the system occurred just before the problem started--install of some new program, Windows Update, other program updates......? ? ? ?

I wonder how the *WindowsShiftKey+E* keyboard shortcut differs from using the *“program shortcut” method*--is there a registry key that defines how the keyboard shortcut acts?

On my system the *WindowsShiftKey+E* opens *My Computer* with it's own view of the system, while the *program shortcut* for Windows Explorer has this command--*%SystemRoot%\explorer.exe*--and it opens Windows Explorer focused on *My Documents*--so the two commands are not exactly the same function call!

Pleonasm

Also found this on *Kelleys Korner's* website, across for the item #157 in the right column--*

Prevent Delay Opening My Computer/Explorer

*:

Registry Edits for Windows XP

If you

download

the registry *tweak*, and open it with *Notepad*, you see the following:

Quote:


Maybe this could help?!

NightOwl, the registry edits documented in Reply #23 are designed to (A) disable Autoplay on removable drives, (B) disable “net crawl” functionality (same as Windows Explorer -> Tools -> Folder Options –> View -> “Automatically search for network folder and printers”), and to (C) bypass possible problems with mapped network drives.  Since the issues I have described occur without removable media present in the floppy/optical drives and the PC is not on a network, I don’t see that the registry edits are applicable.  Nonetheless, it was good troubleshooting idea, and I appreciate the suggestion.

One idea to correct the “WindowKey+E” problem is to use the AutohotKey utility to explicitly “reprogram” that key combination to launch Windows Explorer as illustrated in the technique described here.

Concerning your comment in Reply #21 about “what changes in the system occurred just before the problem started”, I can’t be 100% sure, but I believe the most recent Windows XP updates (issued on July 11th and including several critical security updates for the Office 2003 applications) may be the instigating factor.  I also upgraded from Webroot Spy Sweeper 4.5 to version 5.0 and from Macromedia Flash Player 8 to version 9; however, these are probably fairly benign alternations.

Ghost4me, thanks again for the troubleshooting idea.  I have not used ShellExView (see Reply #16) , but will give it a try if some of the hypotheses I have yet to test prove to be false.

By way of an update, concerning “Problem #2” (see Reply #24) with Office 2003, I have tested the following (but with no positive impact).

• Running “CHKDSK /R” and "sfc /scannow" did not reveal any problems.
• Running "winword /unregserver" followed by "winword /regserver" (and the same for "excel" and "powerpnt") has not corrected the problem.
• Running "Detect and Repair" on the Help Menu from Word and from Excel did not correct the problem.
• Running "Start, Control Panel, Add or Remove Programs, Microsoft Office 2003, Change, Detect and Repair errors in my Office installation" did not correct the problem.

More information to follow . . . .

Golden Rule of Troubleshooting

"Whenever you have eliminated the impossible, whatever remains, however improbable, must be the truth.”
Arthur Conan Doyle
Much to my surprise and chagrin, the root source of the problems documented in this thread is the installation of a new sound card driver.  Reverting to the original driver solved both the difficulties (A) with the Windows+E keyboard shortcut and (B) with the launching of Office 2003 applications by clicking on a file name within Windows Explorer.  (Who would have guessed?)