Explorer starts up twice at startup

[Inventive Software]

Kill me later for asking this, however it's been bugging me for a week or so. As is well documented on these forums, I run Windows 98SE, and know full well I should be upgrading to XP, and I plan to by the end of next month. However, this issue arised, and I don't know how to solve it. Please help!

Explorer is loaded twice at startup, or at least it appears to. In the task manager (when Ctrl+Alt+Del is pressed) there are 2 entries labelled "Explorer". The first is the de facto Explorer as I know and love it (to a certain extent). This I know because when I end the task, it asks me to shut down. Normal you might think.

The second "Explorer" however, doesn't do the same as the first, because when I try to end it, I just get a "ding" and Task Manager quits. The process is still running.

I've tried tracking this down, and have run 98 logged, to create "Bootlog.txt". I did have a good look through this, but couldn't find anything out of the ordinary. I then looked for .exe files modified after the Windows install date (24/6/06). Found nothing unusual.

However, I have noticed that when I go to, say "My Computer", it does create a .tmp file in C:\Windows\temp that starts with "~d" and has random numbers and letters in between. The file name is 10 characters long, including extension, and can't be deleted when My Computer or Explorer is open (complains of the file being in use by another application). After opening a copy of the file in VirtualDub's Hex Editor (I found a use for it!), I couldn't find anything, except "R o o t E n t r y" (as it's written, except with "00" in between the letters).

Lastly, msconfig doesn't list it in the startup entries, and I can't find anything in the registry's startup.

I have run Scandisk, Defrag, and AVG Antivirus, but they picked up nothing. Please help, as it's driving me mad!:thanks:

[setarip_old]

Hi!can't be deleted when My Computer or Explorer is openExit Windows to TRUE DOS mode...

[Inventive Software]

Did that. That's how I found out that it was the other Explorer's file.

[foxyshadis]

This might help:
http://www.sysinternals.com/Utilities/ProcessExplorer.html
Perhaps filemon and regmon might be of use also.

I don't even remember how the 98 shell worked anymore, I know you could split it in 2 processes (for stability) starting in 98, but this seems like odd behavior. Hard to say if it's a virus or just a broken system. >.>

[setarip_old]

Did that. That's how I found out that it was the other Explorer's file.When you're in "True DOS" you should be able to delete the file, if you're sure that's what you want to do...

[Inventive Software]

@setarip_old: Like I said earlier. Did that, that's how I found out it was the other Explorer's file.

OK, I think I have some more info.

ProcessExplorer just lists Explorer as loaded once, so I don't know what's making Explorer appear in Task Manager twice.

I may re-install Windows, just to refresh the system files, and see what happens then.

[unmei]

I know you could split it in 2 processes (for stability) starting in 98, but this seems like odd behavior.
At first i also thought he was seeing that, but in that case you can kill all of the explorer threads - the one that drives the desktop will just make the the desktop and taskbar vanish (in xp it often restarts itself automatically, rebuilding those two in 98 this might be different and end windows) while killing the other instances will just close the the associated explorer window (or search or whatever they were running). But none of them should kill task manager instead of the explorer instance itself.

As for the creation of the instance nowhere in a bootlog, it may be started by a infected or plain malicious DLL that gets autoloaded by the normal explorer (it loads a heapful of DLLs and i do have seen some getting infected).
For the weird file you see created, i don't know anything about that. 0x00 Bytes between the characters of text just mean you are looking at the file in ASCII mode and the string is Unicode (UTF-16 is 2 byte per character and for plain ASCII the high-byte of each character is zero) - NT-based notepad knows unicode, but 98-based may not know it.