Event ID 1002 is logged, and you have no desktop items after you log on to your Windows NT-based computer (891608)



The information in this article applies to:

  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Advanced Server 4.0
  • Microsoft Windows NT Workstation 4.0

SYMPTOMS

When you log on to your Microsoft Windows NT 4.0-based computer, you may receive an error message that is similar to the following:
Explorer.exe has generated errors and will be closed by Windows. You will need to restart the program. An error log is being created.
Additionally, the following error message may be logged in the Application event log:

Event Type: Error
Event Source: Winlogon
Event ID: 1002
Description:
The shell stopped unexpectedly and Explorer.exe was restarted.

After you receive these error messages, desktop items such as icons, the Start button, and the taskbar are missing.

CAUSE

This issue occurs when you apply the update that is described in Microsoft Knowledge Base article 841356. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

841356 MS04-037: Vulnerability in Windows shell could allow remote code execution

Update 841356 contains the correct version of the Windows shell (Shell32.dll). However, the update installs an Active Desktop version of the Shell32.dll file that is not correct.

Note This issue occurs with the version of the Shell32.dll file that has the following file information:

07/31/2004    12:41p     1,770,720   Shell32.dll

The Shell32.dll file is located in the %windir%\System32 folder.

RESOLUTION

To resolve this issue, replace the %windir%\System32\Shell32.dll file with the Osshell32.dll file that is included in update 841356. To do this, follow these steps:
  1. Extract the Osshell32.dll file from update 841356. To do this, follow these steps:
    1. Press CTRL+ALT+DEL, click Task Manager, and then click New Task.
    2. Extract the Osshell32.dll file from update 841356. For example, type the following in the Open dialog box, and then click OK:

      Drive:\UpdateFolder\UpdateFileName /c

    3. When you are prompted, type the location of the folder where you want to extract the update files. For example, type the following, and then click OK:

      Drive:\UpdateFolder\841356

  2. Switch to Task Manager, and then click New Task.
  3. Copy the Osshell32.dll file that you extracted earlier to the following folder with the following file name:

    Drive:\%windir%\System32\Shell32.dll

    For example, type the following in the Open dialog box, and then click OK:

    xcopy Drive:\updates\841356\Osshell32.dll Drive:\%windir%\System32\Shell32.dll


    Type f when you are prompted to determine whether Shell32.dll is a file or a folder.
  4. Restart your computer.

Modification Type:MajorLast Reviewed:3/10/2005
Keywords:kbtshoot kbprb KB891608 kbAudITPRO kbAudEndUser