Windows 8 fresh install. Explorer crashes and reloads every few minutes?
I have installed Windows 8 Pro x64 as a clean install. Every few minutes the explorer shell will crash and reload. The reliability report monitor is filled with "Windows Explorer has stopped working".
I'm definitely not the only one experiencing this issue. A quick search online shows other people reporting their Windows 8 explorer frequently crashes. Is there a solution?
November 2nd, 2012 1:49pm
Hi,
does this happen also with a new user account?
Best greetings from Germany
Olaf
November 2nd, 2012 5:30pm
please download this reg file from my SkyDrive:
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full.reg
and make a double click on the file to import it. If you can't do this, run regedit.exe and import the registry file there!
When the Windows Explorer crashes, Windows Error Reporting Service [1] creates a dmp file under C:\Localdumps. Please upload the ZIPPED dump file to your public Skydrive [2] folder and post the link here.
Andr
[1] http://msdn.microsoft.com/en-us/library/bb787181%28VS.85%29.aspx
[2] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
November 2nd, 2012 10:46pm
https://skydrive.live.com/redir?resid=48983623CE517F74!894
Thanks for responding to my problem!
November 2nd, 2012 11:23pm
The explroer crashes becasue of a visal issue (duser!TransitionVisual::PushOpacityToLeaves)
FAULTING_IP:
duser!TransitionVisual::PushOpacityToLeaves+121
000007fd`1f0efbe5 488b01 mov rax,qword ptr [rcx]
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fd1f0efbe5 (duser!TransitionVisual::PushOpacityToLeaves+0x0000000000000121)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
PROCESS_NAME: explorer.exe
Child-SP RetAddr Call Site
00000000`044ddfa0 000007fd`1f0efbb7 duser!TransitionVisual::PushOpacityToLeaves+0x121
00000000`044ddff0 000007fd`1f0efb49 duser!DuVisual::xdSetFlags+0x254
00000000`044de040 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xb1
00000000`044de070 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee
00000000`044de0a0 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee
00000000`044de0d0 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee
00000000`044de100 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee
00000000`044de130 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee
00000000`044de160 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee
00000000`044de190 000007fd`1f58fae7 duser!ClearPushedOpacitiesFromGadgetTree+0xee
00000000`044de1c0 000007fd`1f58f9f1 dui70!HandleLauncher+0x178
00000000`044de4c0 000007fd`1f5f35d4 dui70!AnimationTrap::_CheckNotifyStart+0x366
00000000`044de580 000007fd`1f571ef9 dui70!DirectUI::Element::OnEvent+0x12b
00000000`044de5f0 000007fd`1f0d58d4 dui70!DirectUI::Element::_DisplayNodeCallback+0x19b
00000000`044de9f0 000007fd`1f0d596a duser!GPCB::xwInvokeFull+0x1e4
00000000`044dead0 000007fd`1f5f50c4 duser!DUserSendEvent+0xc7
00000000`044deb10 000007fd`1f58f985 dui70!DirectUI::FireAnimationEvent+0xac
00000000`044deb60 000007fd`163785e8 dui70!DirectUI::PVLLauncherAnimationTriggers::TriggerLauncher+0x245
00000000`044debb0 000007fd`163bd9d2 twinui!CImmersiveLauncherApps::_TriggerLaunchDismissAnimation+0x3f6
00000000`044ded10 000007fd`163be309 twinui!CImmersiveLauncherApps::OnHidden+0x62
00000000`044ded40 000007fd`163789be twinui!CImmersiveLauncher::_Hide+0x207
00000000`044dedc0 000007fd`21222005 twinui!CImmersiveLauncher::ActiveZbandChanged+0x17d
00000000`044deea0 000007fd`21336221 rpcrt4!Invoke+0x65
00000000`044def00 000007fd`2123c455 rpcrt4!Ndr64StubWorker+0xc01
00000000`044df570 000007fd`214bb53f rpcrt4!NdrStubCall3+0xb5
00000000`044df5d0 000007fd`214bb451 combase!CStdStubBuffer_Invoke+0x67
00000000`044df600 000007fd`2136392b combase!SyncStubInvoke+0x131
00000000`044df720 000007fd`214bcc85 combase!CCtxComChnl::ContextInvoke+0x25b
00000000`044df940 000007fd`214bbc84 combase!AppInvoke+0x307
00000000`044dfa60 000007fd`21362bac combase!ComInvokeWithLockAndIPID+0x60a
00000000`044dfc50 000007fd`2156171e combase!ThreadWndProc+0x2da
00000000`044dfd30 000007fd`215614d7 user32!UserCallWinProcCheckWow+0x13a
00000000`044dfdf0 000007fd`1f041264 user32!DispatchMessageWorker+0x1a7
00000000`044dfe70 000007fd`1f0435c0 windows_immersiveshell_serviceprovider!CImmersiveShellController::_ImmersiveShellComponentsThreadProcInternal+0x2a6
00000000`044dff10 000007fd`22ee167e windows_immersiveshell_serviceprovider!CImmersiveShellController::s_ImmersiveShellComponentsThreadProc+0x75
00000000`044dff40 000007fd`23b93501 kernel32!BaseThreadInitThunk+0x1a
00000000`044dff70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
Contact the support:
November 3rd, 2012 5:23pm
I too have the same issue, searched all over the place.
Heres my dmp file. http://sdrv.ms/TpJIJF
November 3rd, 2012 5:30pm
you have exact the same output from the dump. So you also have the same bug. Call the MS Support, too.
November 4th, 2012 3:04pm
I solved this by using the new "Refresh My PC" feature in Windows 8.
Yes, it was a pain to re-install my programs and drivers. However, Windows is running great and explorer does not crash.
-
Proposed as answer by
Andre.ZieglerMicrosoft community contributor, Editor
Monday, November 05, 2012 7:40 AM
-
Marked as answer by
Nicholas LiModerator
Thursday, November 15, 2012 9:33 AM
November 4th, 2012 7:15pm
I solved this by using the new "Refresh My PC" feature in Windows 8.
Yes, it was a pain to re-install my programs and drivers. However, Windows is running great and explorer does not crash.
November 4th, 2012 10:15pm
ok, looks like some Windows files got damaged.
@Shivaram
check for damaged files, too:
http://blogs.technet.com/b/joscon/archive/2012/09/26/fixing-component-store-corruption-in-windows-8-and-windows-server-2012.aspx
November 5th, 2012 10:41am
One issue still remains; navigating folders in Windows 8 file explorer is slow.
On Windows 7 I could:
- Open My Computer
- Click
- Folder I want is open.
On Windows 8:
- Blue circle "waiting" cursor
- Waiting
- Waiting
- Folder I want is open.
Here is another post describing the same issue as mine. Microsoft
Community Why is Windows 8 File Explorer So Slow?
November 6th, 2012 6:34am
My explorer crashes aswell on three ocasions. 1. Randomly, without doing something, about 3-4 times a day. 2. When Starting a Chrome Application Shortcut. 3. When Starting Dropbox.
The dumps turn out to be huge, even if i zip them with 7-zip.
Since my explorer also crashes when i launch Dropbox and i don't have enough space on SkyDrive i chose to upload the splitted zip (webupload limitation) to box.net:
https://www.box.com/s/kj8jhoqrdypvx8uxx1tf
https://www.box.com/s/xuzezttoi8tozdctundx
https://www.box.com/s/0lmm83815rrf6npxj2re
https://www.box.com/s/xqzle6i0nrd6q4hk1j64
https://www.box.com/s/roqwt3sg5kq8h6rpvl3l
What tool do you use to analyse these dumps?
Thanks for your time!
November 6th, 2012 4:58pm
One issue still remains; navigating folders in Windows 8 file explorer is slow.
disable Windows Defender.
November 6th, 2012 5:37pm
My explorer crashes aswell on three ocasions.
What tool do you use to analyse these dumps?
I use WinDbg from the Debugging Tools for Windows. Looks like your Intel GPU driver causes the crashes:
STACK_TEXT:
00000000`00000000 00000000`00000000 igd10umd64.dll!Unknown+0x0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: igd10umd64.dll!Unknown
FOLLOWUP_NAME: igfx-gpu
MODULE_NAME: igd10umd64
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_igd10umd64.dll!Unknown
Followup: igfx-gpu
0x000007fce6295be5: verifier!AVrfpInitializeCriticalSectionCommon+0x115
0x000007fce33ac1ee: igd10umd64+0x13C1EE
0x000007fce33910cd: igd10umd64+0x1210CD
0x000007fce338f352: igd10umd64+0x11F352
0x000007fce38d68a2: igd10umd64+0x6668A2
0x000007fce38d7d35: igd10umd64+0x667D35
0x000007fce390393b: igd10umd64+0x69393B
0x000007fce3903afd: igd10umd64!OpenAdapter10_2+0x3D
0x000007fce4886d1d: atiuxp64!OpenAdapter10_2+0x4125
0x000007fce488276f: atiuxp64!XopEnumerateAdapters10+0xC7
0x000000006ff2a2a4: aticfx64!OpenAdapter10_2+0x91E4
0x000000006ff2a080: aticfx64!OpenAdapter10_2+0x8FC0
0x000000006ff210e9: aticfx64!OpenAdapter10_2+0x29
0x000007fce4c25757: dlumd64!SetDxHelperAppMode+0x43D7
0x000007fce4c21375: dlumd64!OpenAdapter10_2+0x65
0x000007fce5a09ef9: d3d11!NDXGI::CUMDAdapter::CUMDAdapter+0x175
0x000007fce5a09c5c: d3d11!CCreateDeviceCache::CUMDAdapterCache::Load+0xA0
0x000007fce5a09aa4: d3d11!CCreateDeviceCache::CAdapterCache::ResolveUMDAndVersion+0xD4
0x000007fce5a0989d: d3d11!D3D11CoreCreateDevice+0x3D5
0:009> lmvm igd10umd64
start end module name
000007fc`e3270000 000007fc`e3be4000 igd10umd64 (deferred)
Image path: C:\Windows\System32\igd10umd64.dll
Image name: igd10umd64.dll
Timestamp: Tue Jul 31 19:39:56 2012 (5018186C)
CheckSum: 00000000
ImageSize: 00974000
File version: 8.15.10.2827
Product version: 8.15.10.2827
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.8 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel Graphics Accelerator Drivers for Windows 7(R)
InternalName: igd10umd64.dll
OriginalFilename: igd10umd64.dll
ProductVersion: 8.15.10.2827
FileVersion: 8.15.10.2827
FileDescription: LDDM User Mode Driver for Intel(R) Graphics Technology
LegalCopyright: Copyright (c) 1998-2006 Intel Corporation.
000007fc`e4880000 000007fc`e4892000 atiuxp64 (export symbols) atiuxp64.dll
Loaded symbol image file: atiuxp64.dll
Image path: C:\Windows\System32\atiuxp64.dll
Image name: atiuxp64.dll
Timestamp: Fri Feb 17 04:39:05 2012 (4F3DCBD9)
CheckSum: 00015954
ImageSize: 00012000
File version: 8.14.1.6248
Product version: 8.14.1.6248
File flags: 0 (Mask 0)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: Advanced Micro Devices, Inc.
ProductName: Advanced Micro Devices, Inc PowerXpress Vista DX10 User Mode Driver
InternalName: atiuxpag.dll
OriginalFilename: atiuxpag.dll
ProductVersion: 8.14.01.6248
FileVersion: 8.14.01.6248
PrivateBuild: 4
SpecialBuild: DevStudio Build
FileDescription: atiuxpag.dll
LegalCopyright: Copyright (C) 2007 Advanced Micro Devices, Inc.
LegalTrademarks: PowerXpress (TM) is a Trademark of ATI Technologies Inc.
0:009> lmvm aticfx64
start end module name
00000000`6ff20000 00000000`70020000 aticfx64 C (export symbols) aticfx64.dll
Loaded symbol image file: aticfx64.dll
Image path: C:\Windows\System32\aticfx64.dll
Image name: aticfx64.dll
Timestamp: Fri Feb 17 05:53:58 2012 (4F3DDD66)
CheckSum: 00000000
ImageSize: 00100000
File version: 8.17.10.1114
Product version: 8.17.10.1114
File flags: 0 (Mask 0)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: Advanced Micro Devices, Inc.
ProductName: AMD Inc. Radeon DirectX 11 Driver
InternalName: aticfx64.dll
OriginalFilename: aticfx64.dll
ProductVersion: 8.17.10.1114
FileVersion: 8.17.10.1114
PrivateBuild: Built by swtools on CNABCD05 on 02/16/12 at 23:53
SpecialBuild: DevStudio Build
FileDescription: aticfx64.dll
LegalCopyright: Copyright (C) 1998-2012 AMD Inc.
LegalTrademarks: Radeon (TM) is a Trademark of AMD Inc.
Looks like your laptop switches between the GPU with is included in the Intel CPU and your AMD GPU which is used for 3D. So update both drivers and hope this fixes it.
November 6th, 2012 5:53pm
I forgot to tell you 1 thing:
After you updated the drivers, delete the created registry key. Appverifier slows down the Explorer too much.
November 6th, 2012 6:15pm
I was actually experiencing constant crashes of Explorer after an upgrade install from Windows 7. It usually happened when browsing folders with a lot of files or re-ordering the files (this would almost always cause a crash restart of explorer and shell.
Disabling Windows Defender Real Time Protection stopped this - re-enabled Real Time Protection and the crashes happened again. Thanks for the tip about disabling Windows Defender!
November 9th, 2012 5:57am
Hi Andre,
I am having the same irregular crashing issue with my clean install of Windows 8 on an originally Windows 7 Fujitsu TH700 Tablet PC. So far I have installed minimally everything else that is required and it works like a treat barring this particular
problem. I tried disabling Windows Defender also to no avail.
I have tried several different versions of the (Intel) Video Drivers including the original manufacturer's Windows 7 drivers which I am currently still running but still have the problem although arguably less often (it varies). Intel
doesn't explicitly support my older video hardware with Windows 8 and I noticed some visual artefacts with the Microsoft Intel driver that Windows 8 clean installs.
I am after some help or advice after trying your REG file to save some local dumps - very large BTW - and made my machine scream to a halt until I edited the registry again and rebooted. I am glad I limited the number of dumps to three
but I think I will make this one next time - it would nice if it is possible to make it a one shot and then delete/move/rename to get more than one if possible once my machine is up and running.
I can install WinDbg for myself with some tips and I would need Windows 8 symbols I guess which are also likely to be huge or I can post the dumps to my Skydrive and make then available to you. (iv'e deleted them but ill have no problem generating
more and I am tempted to go back and upgrade to the default drivers that get W8 installs. I am a developer but just haven't messed around with Windows Debugging and Symbols (to tell you the truth I don't particularly want to)....
-
Edited by
mattjs2
Wednesday, December 12, 2012 5:03 PM
-
Proposed as answer by
gabk
Tuesday, October 15, 2013 7:32 AM
December 12th, 2012 5:01pm
Hi Andre,
I am having the same irregular crashing issue with my clean install of Windows 8 on an originally Windows 7 Fujitsu TH700 Tablet PC. So far I have installed minimally everything else that is required and it works like a treat barring this particular
problem. I tried disabling Windows Defender also to no avail.
I have tried several different versions of the (Intel) Video Drivers including the original manufacturer's Windows 7 drivers which I am currently still running but still have the problem although arguably less often (it varies). Intel
doesn't explicitly support my older video hardware with Windows 8 and I noticed some visual artefacts with the Microsoft Intel driver that Windows 8 clean installs.
I am after some help or advice after trying your REG file to save some local dumps - very large BTW - and made my machine scream to a halt until I edited the registry again and rebooted. I am glad I limited the number of dumps to three
but I think I will make this one next time - it would nice if it is possible to make it a one shot and then delete/move/rename to get more than one if possible once my machine is up and running.
I can install WinDbg for myself with some tips and I would need Windows 8 symbols I guess which are also likely to be huge or I can post the dumps to my Skydrive and make then available to you. (iv'e deleted them but ill have no problem generating
more and I am tempted to go back and upgrade to the default drivers that get W8 installs. I am a developer but just haven't messed around with Windows Debugging and Symbols (to tell you the truth I don't particularly want to)....
December 12th, 2012 8:01pm
Compress the dumps as 7z (LZMA2 with Ultra compression) to dramatically reduce the size.
December 13th, 2012 8:34am
In essence, Windows 8 appears to be a bug-ridden disaster. Never in the history of Windows have I encountered an OS that crashes/bombs/hangs this much, and this Explorer crash issue takes things to new heights. Absolutely shocking.
I am running a Lenovo M92P Tiny with i5, 4G & 500GB HDD. It worked fantastically well on Windows 7 when I got it a month ago. I then went through the $18 upgrade process, and bingo. My machine has become a pig.
Disgusting. Are we asking too much for the simple file structure to work correctly? I am not asking for 5 year old devices to work as intended at purchase. I just want to be able to access, manage and use files.
December 23rd, 2012 2:38am
Andre,
Here's the link to my dump zip. I would be grateful if you would please verify it for me?
My dump file on my skydrive
I've been fighting this problem a lot for weeks now. I tried the DISM command you mentioned for corrupted files. This worked for a day or so, then the problem returned. So now I'm wondering if there is something else going on. I did
this command:
DISM /Online /Cleanup-Image /RestoreHealth
I also tried to use WinDbg to view the dmp myself. That didn't work out for me since I really didn't know what I was looking at at all. Here's what I got when I did that. Doesn't look like WinDbg is set up properly or something.
Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\LocalDumps\explorer.exe.2812.dmp]
User Mini Dump File with Full Memory: Only application data is available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
Windows 8 Version 9200 MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Built by: 6.2.9200.16384 (win8_rtm.120725-1247)
Machine Name:
Debug session time: Thu Dec 27 18:13:59.000 2012 (UTC - 7:00)
System Uptime: 0 days 0:04:47.467
Process Uptime: 0 days 0:02:28.000
................................................................
................................................................
................................................................
............................................................
Loading unloaded module list
.....................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(afc.d18): Unknown exception - code c000071f (first/second chance not available)
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for KERNELBASE.dll -
eax=00000000 ebx=00000002 ecx=00000001 edx=00000001 esi=00000002 edi=0e22f584
eip=77d66954 esp=0e22f348 ebp=0e22f36c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
77d66954 c3 ret
Thanks, Andre.
December 28th, 2012 4:57am
you get this error:
STATUS_CALLBACK_RETURNED_LANG
A threadpool worker thread enter a callback, which left
with preferred languages set.
This is unexpected, indicating that the callback missed
clearing them.
but I can't see anything useful. Disable 3rd party extensions like MozyHome (mozyshell.dll).
(Also remove my settings, this will slowdown the Explorer. go to the registry and delete both keys)
December 28th, 2012 9:22am
I finally did what YoloSwagBacon suggested. I had been avoiding it like the plague. It wasn't as painful as I was expecting, however. Many settings are maintained and, Windows 8 leaves right on your desktop a handy little HTML file containing
a list of uninstalled programs. I have to express that the process was really smooth, and
WOW, the system is running like a champ now!.
-
Edited by
adh80h
Saturday, December 29, 2012 5:04 PM
December 29th, 2012 5:03pm
I finally did what YoloSwagBacon suggested. I had been avoiding it like the plague. It wasn't as painful as I was expecting, however. Many settings are maintained and, Windows 8 leaves right on your desktop a handy little HTML file containing
a list of uninstalled programs. I have to express that the process was really smooth, and
WOW, the system is running like a champ now!.
December 29th, 2012 8:03pm
this is not a sensible approach for the solution.
we need solution for the same.
plz if any body have any solution of windows 8 explorer crash reply
Error shows.
The program explorer.exe version 6.2.9200.16384 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 54f4
Start Time: 01cde70e132f4749
Termination Time: 0
Application Path: C:\Windows\explorer.exe
Report Id: 72950975-531e-11e2-afae-0019d196c54d
Faulting package full name:
Faulting package-relative application ID:
December 31st, 2012 11:00am
@ amJad shafiq
I felt the same way about using "Refresh PC". I found that irksome at first just like you seem to. It's just a catch all solution for things that can't be solved a better way. However, If you're using Windows 8 and have not tried this yet,
you may want to consider it. It's really smooth. You really don't lose any data at all. I like the "list of uninstalled applications" HTML file on the desktop after the refresh completes. It makes things fairly easy to reinstall.
So I would urge you to not waste time on other solutions, but I understand that you're looking for something more sensible. There is one other thing I tried that gave me some success solving the problem.
First, pleas read all Andre.Ziegler's posts in this thread carefully. I had some luck with the solution he proposed to others in this thread, i.e., I did what is
described here. However, the next time my computer had to be reset do to hanging on shutdown the problem unfortunately returned. The short of it is this command (if memory serves):
DISM /Online /Cleanup-Image /RestoreHealth
Keep in mind this was only suggested to those who had shared .dmp files with Andre that showed "damaged files." So this solution may not work for you, but I'm not afraid to suggest it, because I don't think it can harm anything to try.
Please, if you solve this some other way, post your solution here.
Good luck! Best wishes, and Happy New Year!
-
Edited by
adh80h
Monday, December 31, 2012 6:38 PM
December 31st, 2012 6:36pm
@ amJad shafiq
I felt the same way about using "Refresh PC". I found that irksome at first just like you seem to. It's just a catch all solution for things that can't be solved a better way. However, If you're using Windows 8 and have not tried this yet,
you may want to consider it. It's really smooth. You really don't lose any data at all. I like the "list of uninstalled applications" HTML file on the desktop after the refresh completes. It makes things fairly easy to reinstall.
So I would urge you to not waste time on other solutions, but I understand that you're looking for something more sensible. There is one other thing I tried that gave me some success solving the problem.
First, pleas read all Andre.Ziegler's posts in this thread carefully. I had some luck with the solution he proposed to others in this thread, i.e., I did what is
described here. However, the next time my computer had to be reset do to hanging on shutdown the problem unfortunately returned. The short of it is this command (if memory serves):
DISM /Online /Cleanup-Image /RestoreHealth
Keep in mind this was only suggested to those who had shared .dmp files with Andre that showed "damaged files." So this solution may not work for you, but I'm not afraid to suggest it, because I don't think it can harm anything to try.
Please, if you solve this some other way, post your solution here.
Good luck! Best wishes, and Happy New Year!
December 31st, 2012 9:36pm
plz if any body have any solution of windows 8 explorer crash reply
also share the dumps.
January 1st, 2013 9:26am
I was having a similar problem after turning on Windows Defender. Any time I right clicked on a file or folder in file explorer, the explorer would stop responding. When I Disable Windows Defender right click works again.
-
Proposed as answer by
BoBeach
Friday, January 04, 2013 3:12 AM
January 4th, 2013 3:12am
I was having a similar problem after turning on Windows Defender. Any time I right clicked on a file or folder in file explorer, the explorer would stop responding. When I Disable Windows Defender right click works again.
January 4th, 2013 6:12am
@BoBeach,
This is not the same problem. This thread is about explorer crashing every few minutes. So, while this is a good solution to the problem you were experiencing, it is not the answer to the problem which spawned the creation of this thread.
Moreover, the explorer crashing problem could not have been cause by Defender since I, for one, did not have Defender enabled at that time. I currently am using Defender, however, and it's not causing any problem at all; In fact, it's working perfectly.
Just the same, thanks for taking the time to post.
January 4th, 2013 8:52am
I've been following this thread for a few weeks and based on my crash analysis there's a couple of things I want to point out.
In my situation I was experiencing crashes at in duser.dll @ TransitionVisual::PushOpacityToLeaves
+ 0x121
I looked at a few dumps then
realized that this is being called from the Animation being launched in the Immersive Shell (twinui). Awhile back
I applied one of the "nifty"
registry tweaks that you see to enable animations every time you go back to the start screen, like at login.
Well after disabling the
registry key I no longer get the crashes at PushOpacityToLeaves + 0x121 and would explain why folks who do a refresh
are *fixed*
The registry key is HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid\Launcher_SessionLoginAnimation_OnShow
set it to zero, that's what
I did in my case.
YMMV
-
Proposed as answer by
Andre.ZieglerMicrosoft community contributor, Editor
Monday, January 21, 2013 8:58 PM
January 21st, 2013 1:39am
I've been following this thread for a few weeks and based on my crash analysis there's a couple of things I want to point out.
In my situation I was experiencing crashes at in duser.dll @ TransitionVisual::PushOpacityToLeaves
+ 0x121
I looked at a few dumps then
realized that this is being called from the Animation being launched in the Immersive Shell (twinui). Awhile back
I applied one of the "nifty"
registry tweaks that you see to enable animations every time you go back to the start screen, like at login.
Well after disabling the
registry key I no longer get the crashes at PushOpacityToLeaves + 0x121 and would explain why folks who do a refresh
are *fixed*
The registry key is HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid\Launcher_SessionLoginAnimation_OnShow
set it to zero, that's what
I did in my case.
YMMV
January 21st, 2013 4:39am
nice find!
January 21st, 2013 11:59pm
I have created a 7z archive as requested: http://sdrv.ms/XT69M3
In deleting Andre's two keys, I hope I did the right thing. I:
(1) deleted the key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe] with everything under it, and
(2) kept [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe] but deleted the specific keys "GlobalFlag" and "PageHeapFlags".
Thank you.
<object height="0" id="plugin0" style=";z-index:1000;" type="application/x-dgnria" width="0"><param name="tabId" value="undefined" /><param name="counter"
value="123" /></object>
-
Edited by
Metamorphic Zircon
Tuesday, January 22, 2013 6:45 AM
edit out extraneous text
January 22nd, 2013 6:45am
I have created a 7z archive as requested: http://sdrv.ms/XT69M3
In deleting Andre's two keys, I hope I did the right thing. I:
(1) deleted the key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe] with everything under it, and
(2) kept [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe] but deleted the specific keys "GlobalFlag" and "PageHeapFlags".
Thank you.
<object height="0" id="plugin0" style=";z-index:1000;" type="application/x-dgnria" width="0"><param name="tabId" value="undefined" /><param name="counter"
value="123" /></object>
January 22nd, 2013 9:45am
The Explorer crashes because of a critical section issue:
APPLICATION_VERIFIER_LOCKS_EXIT_THREAD_OWNS_LOCK (200)
Thread cannot own a critical section.
This stop is generated if a thread (thread ID is parameter1) is terminated,
suspended or is in a state (worker thread finished a work item) in which it
cannot hold a critical section. The current thread is the culprit.
To debug this stop use the following debugger commands:
$ kb - to get the current stack trace. If the current thread is the owner of
the critical section it is probably calling ExitThread.
The current thread should have released the critical section before exiting.
If the current thread is calling TerminateThread or SuspendThread then it
should not do this for a thread holding a critical section.
$ !cs -s parameter2 - dump information about this critical section.
$ ln parameter2 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter4 - to dump the stack trace for this critical section initialization.
Arguments:
Arg1: 0000000000001b04, Thread ID.
Arg2: 000000001a496f50, Critical section address.
Arg3: 0000000013c9bee0, Critical section debug information address.
Arg4: 000000000106a8f0, Critical section initialization stack trace.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ComcastSecureBackupShareshell.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL -
Debugger Dbgportaldb Connection::Open failed 80004005
Database Dbgportaldb not connected
FAULTING_IP:
verifier!VerifierStopMessage+1fc
000007fb`cf37a088 cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fbcf37a088 (verifier!VerifierStopMessage+0x00000000000001fc)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000001b04
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007fbd4bb0aed to 000007fbcf37a088
STACK_TEXT:
ntdll!NtWaitForSingleObject
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!KiUserExceptionDispatch
verifier!VerifierStopMessage
ntdll!RtlApplicationVerifierStop
ntdll! ?? ::FNODOBFM::`string'
ntdll!RtlCheckForOrphanedCriticalSections
rpcrt4!DispatchToStubInCAvrf
rpcrt4!RPC_INTERFACE::DispatchToStubWorker
rpcrt4!LRPC_SCALL::DispatchRequest
rpcrt4!LRPC_SCALL::HandleRequest
rpcrt4!LRPC_ADDRESS::ProcessIO
rpcrt4!LrpcIoComplete
ntdll!TppAlpcpExecuteCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
Critical section = 0x000000001a496f50 (+0x1A496F50)
DebugInfo = 0x0000000013c9bee0
LOCKED
LockCount = 0x0
WaiterWoken = No
OwningThread = 0x0000000000001b04
RecursionCount = 0x1
LockSemaphore = 0x0
SpinCount = 0x00000000020007d0
Stack trace for DebugInfo = 0x0000000013c9bee0:
0x000007fbd4bf0410: ntdll! ?? ::FNODOBFM::`string'+0x7E91
0x000007fbcf385be5: verifier!AVrfpInitializeCriticalSectionCommon+0x115
0x000000018012f76b: ComcastSecureBackupShareshell!DllUnregisterServer+0x12C45B
0x0000000180002a7b: ComcastSecureBackupShareshell+0x2A7B
0x000000018000302a: ComcastSecureBackupShareshell+0x302A
0x00000001801a9b4b: ComcastSecureBackupShareshell!DllUnregisterServer+0x1A683B
0x000007fbcf383b2e: verifier!AVrfpStandardDllEntryPointRoutine+0xBE
0x000007fbd4afba0e: ntdll!LdrpCallInitRoutine+0x3E
0x000007fbd4b182dc: ntdll!LdrpInitializeNode+0x192
0x000007fbd4b1787f: ntdll!LdrpInitializeGraph+0x6F
0x000007fbd4b19202: ntdll!LdrpPrepareModuleForExecution+0x1A5
0x000007fbd4b19af2: ntdll!LdrpLoadDll+0x344
0x000007fbd4b0e08b: ntdll!LdrLoadDll+0xA7
0x000007fbcf383ff6: verifier!AVrfpLdrLoadDll+0x76
0x000007fbd1aef653: KERNELBASE!LoadLibraryExW+0xBF
0x000007fbd355296c: combase!LoadLibraryWithLogging+0x2C
0x000007fbd35528c4: combase!CClassCache::CDllPathEntry::LoadDll+0x70
0x000007fbd3552693: combase!CClassCache::CDllPathEntry::Create+0x43
0x000007fbd35522a0: combase!CClassCache::CClassEntry::CreateDllClassEntry+0x196
0x000007fbd3552238: combase!CClassCache::GetClassObjectActivator+0x932
The cause is the Program "C:\Program Files\SecureBackupShare":
Image path: C:\Program Files\SecureBackupShare\ComcastSecureBackupShareshell.dll
Image name: ComcastSecureBackupShareshell.dll
Timestamp: Mon Nov 08 23:47:33 2010 (4CD87E05)
CheckSum: 00426F0D
ImageSize: 00450000
File version: 2.4.3.0
Product version: 2.4.0.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 01CCBBA5.094B4C4D
Translations: 0009.04b0
CompanyName: Secure Backup and Share
ProductName: Secure Backup and Share
InternalName: x64_shell.dll
ProductVersion: 2.4.0.0
FileVersion: 2.4.3.0
FileDescription: Secure Backup and Share Shell Extensions
LegalCopyright: Copyright 2010
Look if there is an u
January 22nd, 2013 11:01pm
Hi,
I also have the same problem in Explorer.exe, random crashes referencing ntdll.dll and the taskbar and explorer restarting itself. Even more strange is that after installing the Windows SDK and its Debugging Tools I cannot use charms-bar Search and control-panel
anymore. Again it is explorer.exe breaking and now referencing verifier.dll.
I attached two dump files on my SkyDrive. Andre it would be great if you could take a look as my debugging environment isn't working anymore...
http://sdrv.ms/SBs2Ad (explorer.dll/verifier.dll crash when opening control panel/using search charm)
http://sdrv.ms/VrkDSW (explorer.dll random crash)
thanks
January 23rd, 2013 5:52pm
Hi,
I also have the same problem in Explorer.exe, random crashes referencing ntdll.dll and the taskbar and explorer restarting itself. Even more strange is that after installing the Windows SDK and its Debugging Tools I cannot use charms-bar Search and control-panel
anymore. Again it is explorer.exe breaking and now referencing verifier.dll.
yes my reg file activates Application verifieer to get better dumps. In your case the Intel driver is the cause:
00000000140542e0 0008 0000 [00] 0000000014054330 00004 - (busy)
7ffc62981ab verifier!AVrfDebugPageHeapAllocate+0x000000000000039f
7ffd7fad83c ntdll!RtlDebugAllocateHeap+0x0000000000000038
7ffd7fcaacb ntdll! ?? ::FNODOBFM::`string'+0x0000000000011407
7ffd7ec6426 ntdll!RtlAllocateHeap+0x00000000000001ae
7ffc62b06eb verifier!AVrfpRtlAllocateHeap+0x00000000000000d7
9f5addb hccutils!DllUnregisterServer+0x0000000000002f9f
9f5a217 hccutils!DllUnregisterServer+0x00000000000023db
9f51378 hccutils!GetCUICustomizationKey+0x0000000000000190
9f51936 hccutils!GetCUICustomizationKey+0x000000000000074e
9f5320b hccutils!CreateThisKey+0x00000000000003f3
9f535f8 hccutils!FindResources+0x0000000000000108
9f53a11 hccutils!LoadSTRING+0x00000000000002f1
9f53fe2 hccutils!SaveString+0x0000000000000152
9f542df hccutils!LoadICON+0x000000000000002b
9f543a6 hccutils!LoadIMAGE+0x000000000000004a
180001582 igfxcpl!CPlApplet+0x00000000000000b2
7ffd5ff9efa shell32!CPL_CallEntry+0x0000000000000052
7ffd5ff99f1 shell32!_InitializeControl+0x000000000000009d
7ffd619daa8 shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x0000000000053d8b
7ffd5b04192 shell32!CPL_LoadCPLModule+0x00000000000001c2
7ffd5b03fa7 shell32!_LoadCPLModuleAndAdd+0x000000000000001f
7ffd5b03f5d shell32!CPLD_InitModule+0x000000000000003d
7ffd5b03ef8 shell32!CControlPanelEnum::_NextNonCachedCpl+0x00000000000000c5
7ffd5b0dec5 shell32!CControlPanelEnum::Next+0x00000000000000b4
7ffd5c51213 shell32!CRegFolderEnum::Next+0x00000000000001fa
7ffd5b0f415 shell32!CControlPanelAppletList::_AddAppletsToCategories+0x0000000000000051
7ffd5b0f389 shell32!CControlPanelAppletList::EnsureLoaded+0x00000000000000a9
7ffd5c016a9 shell32!CTasksFolder::_EnsureLoadedLists+0x0000000000000131
7ffd5c01078 shell32!CTasksFolder::EnumObjects+0x0000000000000038
7ffc49f9258 twinui!CSettingsSearchApp::GetCountForQuery+0x00000000000001a8
7ffd7932005 rpcrt4!Invoke+0x0000000000000065
7ffd7a46221 rpcrt4!Ndr64StubWorker+0x0000000000000c01
Loaded symbol image file: hccutils.dll
Image path: C:\Windows\System32\hccutils.dll
Image name: hccutils.dll
Timestamp: Mon Sep 03 04:49:28 2012 (50441AB8)
CheckSum: 00023677
ImageSize: 0001F000
File version: 8.15.10.2849
Product version: 8.15.10.2849
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: HCCUTILS
OriginalFilename: HCCUTILS.DLL
ProductVersion: 8.15.10.2849
FileVersion: 8.15.10.2849
PrivateBuild: 8.15.10.2849
SpecialBuild: 8.15.10.2849
FileDescription: hccutils Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Loaded symbol image file: igfxcpl.cpl
Image path: C:\Windows\System32\igfxcpl.cpl
Image name: igfxcpl.cpl
Timestamp: Mon Sep 03 04:50:21 2012 (50441AED)
CheckSum: 00022721
ImageSize: 00025000
File version: 8.15.10.2849
Product version: 8.15.10.2849
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: IGFXCPL
OriginalFilename: IGFXCPL.DLL
ProductVersion: 8.15.10.2849
FileVersion: 8.15.10.2849
PrivateBuild: 8.15.10.2849
SpecialBuild: 8.15.10.2849
FileDescription: igfxcpl Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Update the Intel driver to version 9.17.10.2932 instead:
http://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=3498&DwnldID=22373&ProductFamily=Graphics&ProductLine=Desktop+graphics+drivers&ProductProduct=3rd+Generation+Intel%C2%AE+Core%E2%84%A2+Processors+with+Intel%C2%AE+HD+Graphics+4000%2f2500&lang=eng
http://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=3498&DwnldID=22375&ProductFamily=Graphics&ProductLine=Desktop+graphics+drivers&ProductProduct=3rd+Generation+Intel%c2%ae+Core%e2%84%a2+Processors+with+Intel%c2%ae+HD+Graphics+4000%2f2500&lang=eng
Run the uninstall.reg to disable the Appverifier and dump creation:
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full_uninstall.reg
January 23rd, 2013 11:58pm
I downloaded your registry key, Andre. I installed it and after the next explorer crash explorer wouldn't come up anymore and reboot resulted in total black screen. I did a system restore point restoration and now my Bitdefender security program has problems.
I think I have to go to image restore - been doing that almost every day after win 8 install. Would restoring to a system restore point before the reg edit completely restore the registry?
January 26th, 2013 9:46pm
Is there anybody out there that can help me with this issue? I need someone to verify my account so that I can post the link to my dump file in the c:\LocalDumps folder.
Any help with this issue would be greatly appreciated.
Thank you!
January 27th, 2013 10:45pm
Great Andre! Thanks a lot!
January 30th, 2013 10:23am
Is there anybody out there that can help me with this issue? My Windows explorer crashes whenever I browse folders with a large number of files.
Any help with this issue would be greatly appreciated.
Here is the skydrive link to my dumps file from the c:\LocalDumps folder
skydrive.live.com/redir?resid=FE1D35C944D0BF09!332&authkey=!APFNrS63Hjikt5k
Thank you!
January 30th, 2013 9:25pm
Installing the reg file from http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full.reg
may render your computer unusable without a system or register restoration. This is possibly malicious code. Beware and at least have restoration options prepared beforehand.
January 30th, 2013 11:08pm
I agree with Worm8, I had this problem and had to restore from a restore point.
Andre- if you could please have a look at my dump file when you get a chance, I would really appreciate it. Just copy the link below into a browser to access the dump file.
skydrive.live.com/redir?resid=FE1D35C944D0BF09!332&authkey=!APFNrS63Hjikt5k
Thank you!
January 30th, 2013 11:11pm
this is no malware. It simply activates AppVerifier and dump creation.
Use this file to stop it:
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full_uninstall.reg
@Pantonio3
Wuala is the cause. Disable the overlay icons:
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
APPLICATION_VERIFIER_HANDLES_INVALID_HANDLE (300)
Invalid handle exception for current stack trace.
This stop is generated if the function on the top of the stack passed an
invalid handle to system routines. Usually a simple kb command will reveal
what is the value of the handle passed (must be one of the parameters -
usually the first one). If the value is null then this is clearly wrong.
If the value looks ok you need to use !htrace debugger extension to get a
history of operations pertaining to this handle value. In most cases it
must be that the handle value is used after being closed.
Arguments:
Arg1: 00000000c0000008, Exception code.
Arg2: 000000001857eb50, Exception record. Use .exr to display it.
Arg3: 000000001857e520, Context record. Use .cxr to display it.
Arg4: 0000000000000000, Not used.
GetUrlPageData2 (WinHttp) failed: 12007.
Debugger WatsonDb Connection::Open failed 80004005
FAULTING_IP:
verifier!VerifierStopMessageEx+6d0
000007fa`0407a7fc cc int 3
EXCEPTION_RECORD: 000000001857eb50 -- (.exr 0x1857eb50)
ExceptionAddress: 000007fa08e54c39 (ntdll!KiRaiseUserExceptionDispatcher+0x000000000000003a)
ExceptionCode: c0000008 (Invalid handle)
ExceptionFlags: 00000000
NumberParameters: 0
Thread tried to close a handle that was invalid or illegal to close
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
CONTEXT: 000000001857e520 -- (.cxr 0x1857e520)
rax=0000000000000000 rbx=e0e0e0e0e0e0e0e0 rcx=0000000000000000
rdx=0000000000000000 rsi=000007fa061a1580 rdi=000007fa08e52cd0
rip=000007fa08e54c39 rsp=000000001857eb30 rbp=0000000020e75538
r8=0000000000000000 r9=00000000000002c8 r10=000007fa08e557c0
r11=000000001fe50000 r12=00203a616c617577 r13=000000000e39d0d0
r14=000007fa040959d1 r15=0000000000000001
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!KiRaiseUserExceptionDispatcher+0x3a:
000007fa`08e54c39 8b8424c0000000 mov eax,dword ptr [rsp+0C0h] ss:00000000`1857ebf0=080000c0
Resetting default scope
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000000c6c
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007fa04081e26 to 000007fa0407a7fc
STACK_TEXT:
ntdll!NtWaitForSingleObject
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!KiUserExceptionDispatch
verifier!VerifierStopMessageEx
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!RtlRaiseException
ntdll!KiRaiseUserExceptionDispatcher
verifier!AVrfpNtClose
KERNELBASE!CloseHandle
verifier!AVrfpCloseHandleCommon
verifier!AVrfpCloseHandleCommon
OverlayIcon!DllUnregisterServer
OverlayIcon!DllUnregisterServer
shell32!CFSIconOverlayManager::_GetFileOverlayInfo
shell32!CFSIconOverlayManager::GetFileOverlayInfo
shell32!CFSFolder::_GetOverlayInfo
shell32!CDesktopFolder::GetOverlayIndex
shell32!CRegFolder::GetOverlayIndex
shell32!CIconOverlayTask::InternalResumeRT
shell32!CRunnableTask::Run
shell32!CShellTask::TT_Run
shell32!CShellTaskThread::ThreadProc
shell32!CShellTaskThread::s_ThreadProc
SHCore!ExecuteWorkItemThreadProc
ntdll!RtlpTpWorkCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
IMAGE_NAME: OverlayIcon.dll
Loaded symbol image file: OverlayIcon.dll
Image path: C:\Program Files (x86)\Wuala OverlayIcons\OverlayIcon.dll
Image name: OverlayIcon.dll
Timestamp: Wed May 04 10:12:44 2011 (4DC10A7C)
CheckSum: 0009DC68
ImageSize: 00096000
File version: 1.0.0.0
Product version: 1.0.0.0
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: LaCie AG
ProductName: Wuala
InternalName: OverlayIcon.dll
OriginalFilename: OverlayIcon.dll
ProductVersion: 1.0.0.0
FileVersion: 1.0.0.0
FileDescription: Wuala OverlayIcons
LegalCopyright: LaCie AG. All rights reserved.
or try to update the tool. if the issue is fixed, also run the uninstall reg.
January 31st, 2013 12:06am
http://sdrv.ms/WWDUx0
Help, please.
February 5th, 2013 8:43am
you have a memory corruption:
APPLICATION_VERIFIER_FLAGS: 0
CHKIMG_EXTENSION: !chkimg -lo 50 -d !shell32
7fd6188b78e-7fd6188b78f 2 bytes - shell32!CShellUrl::_ParseNextSegment+2c6
[ 45 d7:33 c0 ]
7fd6188b887-7fd6188b888 2 bytes - shell32!ShStrW::_SetStr+37 (+0xf9)
[ eb 63:33 c0 ]
7fd619695d8-7fd619695dd 6 bytes - shell32!c_szShell32Dll+fd8 (+0xddd51)
[ 7c 36 80 61 fd 07:e0 56 06 05 00 00 ]
10 errors : !shell32 (7fd6188b78e-7fd619695dd)
APP: explorer.exe
FAULTING_THREAD: 00000000000010c8
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 000007fd6188f6d9 to 000007fd6188b78f
BUGCHECK_STR: APPLICATION_FAULT_MEMORY_CORRUPTION_INVALID_POINTER_WRITE_LARGE
our shell32.dll is damaged. Run sfc /scannow to repair the file.
February 5th, 2013 9:25am
I understand that the regcode is there to activate Appverifier. It's still possibly malicious, since it can make the whole system unbootable. Doing the unistall code wouldn't help if one had no means to restore the unusable system. This could end up in serious
trouble. So at least everyone should be prepared with restore points and restore dvds. Someone could verify the files, though. Would windows restore point remove all of your reg codes or would I stil need to use the uninstall to completely remove it.
Running sfc / scannow has helped my explorer crashes.
February 5th, 2013 1:22pm
Thank you very much Andre, it's working fine now.
February 5th, 2013 5:04pm
Thank you very much Andre, it's working fine now.
ok, run the uninstall.reg to disable AppVerifier and dump creation.
February 5th, 2013 10:43pm
Help! Same trouble here!
http://sdrv.ms/XmMh1m
February 6th, 2013 5:27am
Help! Same trouble here!
http://sdrv.ms/XmMh1m
You also have Explorer crash causes by the Intel GPU driver:
APPLICATION_VERIFIER_HEAPS_CORRUPTED_HEAP_BLOCK_SUFFIX (f)
Corrupted suffix pattern for heap block.
Most typically this happens for buffer overrun errors. Sometimes the application
verifier places non-accessible pages at the end of the allocation and buffer
overruns will cause an access violation and sometimes the heap block is
followed by a magic pattern. If this pattern is changed when the block gets
freed you will get this break. These breaks can be quite difficult to debug
because you do not have the actual moment when corruption happened.
You just have access to the free moment (stop happened here) and the
allocation stack trace (!heap -p -a HEAP_BLOCK_ADDRESS)
Arguments:
Arg1: 0000000021101000, Heap handle used in the call.
Arg2: 00000000150b4180, Heap block involved in the operation.
Arg3: 0000000000000004, Size of the heap block.
Arg4: 00000000150b4184, Corruption address.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
FAULTING_IP:
verifier!VerifierStopMessage+1fc
000007fe`a78da088 cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fea78da088 (verifier!VerifierStopMessage+0x00000000000001fc)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000000548
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000
STACK_TEXT:
ntdll!NtWaitForSingleObject
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!KiUserExceptionDispatch
verifier!VerifierStopMessage
verifier!AVrfpDphReportCorruptedBlock
verifier!AVrfpDphCheckNormalHeapBlock
verifier!VerifierCheckPageHeapAllocation
verifier!AVrfpHeapFree
hccutils!DllUnregisterServer
hccutils!GetCUICustomizationKey
hccutils!GetCUICustomizationKey
hccutils!GetCUICustomizationKey
hccutils!CreateThisKey
hccutils!FindResources
hccutils!LoadSTRING
hccutils!SaveString
hccutils!LoadICON
hccutils!LoadIMAGE
igfxcpl!CPlApplet
shell32!CPL_CallEntry
shell32!_InitializeControl
shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''
shell32!CPL_LoadCPLModule
shell32!_LoadCPLModuleAndAdd
shell32!CPLD_InitModule
shell32!CControlPanelEnum::_NextNonCachedCpl
shell32!CControlPanelEnum::Next
shell32!CRegFolderEnum::Next
shell32!CControlPanelAppletList::_AddAppletsToCategories
shell32!CControlPanelAppletList::EnsureLoaded
shell32!CTasksFolder::_EnsureLoadedLists
shell32!CTasksFolder::EnumObjects
twinui!CSettingsSearchApp::GetCountForQuery
rpcrt4!Invoke
rpcrt4!Ndr64StubWorker
rpcrt4!NdrStubCall3
combase!CStdStubBuffer_Invoke
combase!SyncStubInvoke
combase!CCtxComChnl::ContextInvoke
combase!AppInvoke
combase!ComInvokeWithLockAndIPID
combase!ThreadWndProc
user32!UserCallWinProcCheckWow
user32!DispatchMessageWorker
shell32!_LocalServerThread
SHCore!COplockFileHandle::v_GetHandlerCLSID
verifier!AVrfpStandardThreadFunction
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: explorer.exe!unknown_error_in_process
IMAGE_NAME: explorer.exe
0:016> !heap -p -a 00000000150b4180
address 00000000150b4180 found in
_HEAP @ 150b0000
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
00000000150b4130 0008 0000 [00] 00000000150b4180 00004 - (busy)
7fea78d81ab verifier!AVrfDebugPageHeapAllocate+0x000000000000039f
7fec035d83c ntdll!RtlDebugAllocateHeap+0x0000000000000038
7fec037aacb ntdll! ?? ::FNODOBFM::`string'+0x0000000000011407
7fec0276426 ntdll!RtlAllocateHeap+0x00000000000001ae
7fea78f06eb verifier!AVrfpRtlAllocateHeap+0x00000000000000d7
f13addb hccutils!DllUnregisterServer+0x0000000000002f9f
f13a217 hccutils!DllUnregisterServer+0x00000000000023db
f131378 hccutils!GetCUICustomizationKey+0x0000000000000190
f131936 hccutils!GetCUICustomizationKey+0x000000000000074e
f13320b hccutils!CreateThisKey+0x00000000000003f3
f1335f8 hccutils!FindResources+0x0000000000000108
f133a11 hccutils!LoadSTRING+0x00000000000002f1
f133fe2 hccutils!SaveString+0x0000000000000152
f1342df hccutils!LoadICON+0x000000000000002b
f1343a6 hccutils!LoadIMAGE+0x000000000000004a
180001582 igfxcpl!CPlApplet+0x00000000000000b2
7febecf9efa shell32!CPL_CallEntry+0x0000000000000052
7febecf99f1 shell32!_InitializeControl+0x000000000000009d
7febee9daa8 shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x0000000000053d8b
7febe804192 shell32!CPL_LoadCPLModule+0x00000000000001c2
7febe803fa7 shell32!_LoadCPLModuleAndAdd+0x000000000000001f
7febe803f5d shell32!CPLD_InitModule+0x000000000000003d
7febe803ef8 shell32!CControlPanelEnum::_NextNonCachedCpl+0x00000000000000c5
7febe80dec5 shell32!CControlPanelEnum::Next+0x00000000000000b4
7febe951213 shell32!CRegFolderEnum::Next+0x00000000000001fa
7febe80f415 shell32!CControlPanelAppletList::_AddAppletsToCategories+0x0000000000000051
7febe80f389 shell32!CControlPanelAppletList::EnsureLoaded+0x00000000000000a9
7febe9016a9 shell32!CTasksFolder::_EnsureLoadedLists+0x0000000000000131
7febe901078 shell32!CTasksFolder::EnumObjects+0x0000000000000038
7feac159258 twinui!CSettingsSearchApp::GetCountForQuery+0x00000000000001a8
7febd8b2005 rpcrt4!Invoke+0x0000000000000065
7febd9c6221 rpcrt4!Ndr64StubWorker+0x0000000000000c01
Image path: C:\Windows\System32\igfxcpl.cpl
Image name: igfxcpl.cpl
Timestamp: Thu Dec 13 01:42:36 2012 (50C9247C)
CheckSum: 000256A6
ImageSize: 00025000
File version: 8.15.10.2932
Product version: 8.15.10.2932
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: IGFXCPL
OriginalFilename: IGFXCPL.DLL
ProductVersion: 8.15.10.2932
FileVersion: 8.15.10.2932
PrivateBuild: 8.15.10.2932
SpecialBuild: 8.15.10.2932
FileDescription: igfxcpl Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Loaded symbol image file: hccutils.dll
Image path: C:\Windows\System32\hccutils.dll
Image name: hccutils.dll
Timestamp: Thu Dec 13 01:42:04 2012 (50C9245C)
CheckSum: 0001FA74
ImageSize: 0001F000
File version: 8.15.10.2932
Product version: 8.15.10.2932
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: HCCUTILS
OriginalFilename: HCCUTILS.DLL
ProductVersion: 8.15.10.2932
FileVersion: 8.15.10.2932
PrivateBuild: 8.15.10.2932
SpecialBuild: 8.15.10.2932
FileDescription: hccutils Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Go to the Intel downloadcenter and get the latest GPU driver. Also run the uninstall.reg to disable AppVeririfer and dump creation.
February 6th, 2013 8:52am
Hi, I have exactly the same issue. Please help have a look, thanks! http://sdrv.ms/YInRzT
March 4th, 2013 3:17am
Hi, I have exactly the same issue. Please help have a look, thanks! http://sdrv.ms/YInRzT
the Itel driver is also the cause:
address 00000000278b4310 found in
_HEAP @ 278b0000
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
00000000278b42c0 0008 0000 [00] 00000000278b4310 00004 - (busy)
7ff1ab481ab verifier!AVrfDebugPageHeapAllocate+0x000000000000039f
7ff2b13d83c ntdll!RtlDebugAllocateHeap+0x0000000000000038
7ff2b15aacb ntdll! ?? ::FNODOBFM::`string'+0x0000000000011407
7ff2b056426 ntdll!RtlAllocateHeap+0x00000000000001ae
7ff1ab606eb verifier!AVrfpRtlAllocateHeap+0x00000000000000d7
1f65addb hccutils!DllUnregisterServer+0x0000000000002f9f
1f65a217 hccutils!DllUnregisterServer+0x00000000000023db
1f651378 hccutils!GetCUICustomizationKey+0x0000000000000190
1f651936 hccutils!GetCUICustomizationKey+0x000000000000074e
1f65320b hccutils!CreateThisKey+0x00000000000003f3
1f6535f8 hccutils!FindResources+0x0000000000000108
1f653a11 hccutils!LoadSTRING+0x00000000000002f1
18000e9b1 igfxpph+0x000000000000e9b1
18000edaa igfxpph+0x000000000000edaa
7ff286cd5d7 shell32!IShellExtInit_Initialize+0x0000000000000047
7ff286cfb6d shell32!HDXA_QueryContextMenu+0x00000000000002dd
7ff286cea0f shell32!CDefFolderMenu::QueryContextMenu+0x000000000000041b
7ff28bf9d29 shell32!CContextMenuOnContextMenuArray::_QueryNthContextMenu+0x0000000000000035
7ff28bf9b94 shell32!CContextMenuOnContextMenuArray::QueryContextMenu+0x00000000000000b0
7ff28965a8f shell32!CDefView::_DoContextMenuPopup+0x00000000000001ab
7ff2896570f shell32!CDefView::OnBackgroundContextMenu+0x00000000000001ab
7ff28b3d7b5 shell32!CListViewHost::ShowContextMenu+0x000000000000022d
7ff289658c1 shell32!CDefView::_DoContextMenu+0x0000000000000081
7ff2895f4fd shell32!CDefView::_OnContextMenu+0x00000000000000e9
7ff28c94b37 shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x000000000001c262
7ff285c30e9 shell32!CDefView::s_WndProc+0x0000000000000071
7ff29d4171e user32!UserCallWinProcCheckWow+0x000000000000013a
7ff29d4432b user32!CallWindowProcW+0x0000000000000093
7ff25bd125d comctl32!CallOriginalWndProc+0x000000000000001d
7ff25bd11f6 comctl32!CallNextSubclassProc+0x0000000000000082
7ff25bd13d7 comctl32!DefSubclassProc+0x0000000000000077
7ff285c3465 shell32!CListViewHost::_ViewSubclassWndProc+0x000000000000006d
0:000> lmvm igfxpph
start end module name
00000001`80000000 00000001`80064000 igfxpph (export symbols) igfxpph.dll
Loaded symbol image file: igfxpph.dll
Image path: C:\Windows\System32\igfxpph.dll
Image name: igfxpph.dll
Timestamp: Thu Dec 13 01:42:45 2012 (50C92485)
CheckSum: 000642DF
ImageSize: 00064000
File version: 8.15.10.2932
Product version: 8.15.10.2932
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: IGFXPPH
OriginalFilename: IGFXPPH.DLL
ProductVersion: 8.15.10.2932
FileVersion: 8.15.10.2932
PrivateBuild: 8.15.10.2932
SpecialBuild: 8.15.10.2932
FileDescription: igfxpph Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Update the driver and use ShelExView to disable the Intel shellextension.
1 other crash is caused by Google drive:
STACK_TEXT:
000007ff`2b18fdc8 000007ff`2b15bf2f ntdll! ?? ::FNODOBFM::`string'+0x13981
000007ff`2b18fdd0 00000000`7666cabc msvcr90!free+0x1c
000007ff`2b18fdd8 000007ff`1b6b2dc8 googledrivesync64!DllCanUnloadNow+0xcd8
000007ff`2b18fde0 000007ff`287240b6 shell32!CFSIconOverlayManager::_GetFileOverlayInfo+0xca
000007ff`2b18fde8 000007ff`28678410 shell32!CFSIconOverlayManager::GetFileOverlayInfo+0x48
000007ff`2b18fdf0 000007ff`287246b7 shell32!CFSFolder::_GetOverlayInfo+0xdf
000007ff`2b18fdf8 000007ff`287277f2 shell32!CIconOverlayTask::InternalResumeRT+0x14a
000007ff`2b18fe00 000007ff`286e8324 shell32!CRunnableTask::Run+0x98
000007ff`2b18fe08 000007ff`286df388 shell32!CShellTask::TT_Run+0x3c
000007ff`2b18fe10 000007ff`285b18df shell32!CShellTaskThread::ThreadProc+0xd7
000007ff`2b18fe18 000007ff`285b19e7 shell32!CShellTaskThread::s_ThreadProc+0x33
000007ff`2b18fe20 000007ff`261a157f shcore!ExecuteWorkItemThreadProc+0xf
000007ff`2b18fe28 000007ff`2b067f59 ntdll!RtlpTpWorkCallback+0x189
000007ff`2b18fe30 000007ff`2b058842 ntdll!TppWorkerThread+0x604
000007ff`2b18fe38 000007ff`2a9a167e kernel32!BaseThreadInitThunk+0x1a
000007ff`2b18fe40 000007ff`2b073501 ntdll!RtlUserThreadStart+0x1d
FOLLOWUP_IP:
googledrivesync64!DllCanUnloadNow+cd8
000007ff`1b6b2dc8 488d542430 lea rdx,[rsp+30h]
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: googledrivesync64!DllCanUnloadNow+cd8
FOLLOWUP_NAME: wintriag
MODULE_NAME: googledrivesync64
IMAGE_NAME: googledrivesync64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 50cfe78c
STACK_COMMAND: dps 7ff2b18fdc8 ; kb
FAILURE_BUCKET_ID: INVALID_POINTER_READ_AFTER_CALL_c0000374_googledrivesync64.dll!DllCanUnloadNow
BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_AFTER_CALL_googledrivesync64!DllCanUnloadNow+cd8
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/6_2_9200_16433/50763312/ntdll_dll/6_2_9200_16420/505ab405/c0000374/000ea485.htm?Retriage=1
Followup: wintriag
---------
0:071> lmvm googledrivesync64
start end module name
000007ff`1b6b0000 000007ff`1b76b000 googledrivesync64 (export symbols) googledrivesync64.dll
Loaded symbol image file: googledrivesync64.dll
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Timestamp: Tue Dec 18 04:48:28 2012 (50CFE78C)
CheckSum: 000BE686
ImageSize: 000BB000
File version: 1.7.4018.3496
Product version: 1.7.4018.3496
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Google
ProductName: Google Drive
ProductVersion: 1.7.4018.3496
FileVersion: 1.7.4018.3496
FileDescription: Google Drive shell extension
LegalCopyright: Google
Disable the sync icons in the google drive options to fix this crash.
Also make sure you run the uninstall reg to disable AppVerifer and cump creation:
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full_uninstall.reg
March 4th, 2013 9:23am
Hi, Andre, thank you so much!
March 4th, 2013 9:41am
Hi... I'm having this problem, and I think it happens when I install the nvidia drivers.
Heres my dump file: http://sdrv.ms/WHDsEI
March 20th, 2013 5:19pm
I had the following problems with Windows 8 Pro, this was on a new Lenovo X1 Carbon Touch, that came with Windows 8 Pro pre-installed:
The desktop would delay, go to a white screen, go to a blue screen, then reload. Right clicking the desktop, then clicking personalize did not work. The task manager would show CPU usage for Windows Explorer at 13% right after a crash-restart then after
about 15 seconds the CPU would go to 26%, then if you clicked the desktop it would go through the loop, white screen, blue screen, restart. I could not change the desktop background image or the theme. The Image it is stuck on is the Sand picture from the
Earth theme.
I saw a lot of posts recommending doing a Windows Refresh, which I tried, and it did fix the problem. The problem with a Windows Refresh is that all the programs I need are gone and I would need to put them back, and I suspect at some point the same problem
would return. So I set out to determine what was causing the problem.
When I re-installed Windows 8 the problem would go away, when I re-installed my image the problem would return. I tried removing programs and patches I had installed just before the problems started, but nothing would stop the issue. Then I tried logging
in as a different user and the issue was not there.
I saw where there was a patch to fix the early version of Windows 8 that was showing these symptoms, caused by the live tiles, but I had all the patches or the replacement patches.
Once, after installing my image when I "turned off the Live Tiles" feature of all the Tiles I had running the problem stopped, when I turned the "Live Tiles" feature back on the problem still did not return. But when I re-installed my
image again, just turning off the live tiles did not correct the problem this time.
The one thing that consistently stops the crashing cycle is the following Registry change:
HKEY_CURRENT_USER\Control Panel\Desktop
Change the string for the Wallpaper to the location of some other picture, like for Windows 8;
C:\Windows\Web\Wallpaper\Windows
Then restart Windows.
I hope this helps someone else trying to resolve this issue.
-
Edited by
c64us
Monday, March 25, 2013 7:27 PM
March 25th, 2013 7:25pm
I had the following problems with Windows 8 Pro, this was on a new Lenovo X1 Carbon Touch, that came with Windows 8 Pro pre-installed:
The desktop would delay, go to a white screen, go to a blue screen, then reload. Right clicking the desktop, then clicking personalize did not work. The task manager would show CPU usage for Windows Explorer at 13% right after a crash-restart then after
about 15 seconds the CPU would go to 26%, then if you clicked the desktop it would go through the loop, white screen, blue screen, restart. I could not change the desktop background image or the theme. The Image it is stuck on is the Sand picture from the
Earth theme.
I saw a lot of posts recommending doing a Windows Refresh, which I tried, and it did fix the problem. The problem with a Windows Refresh is that all the programs I need are gone and I would need to put them back, and I suspect at some point the same problem
would return. So I set out to determine what was causing the problem.
When I re-installed Windows 8 the problem would go away, when I re-installed my image the problem would return. I tried removing programs and patches I had installed just before the problems started, but nothing would stop the issue. Then I tried logging
in as a different user and the issue was not there.
I saw where there was a patch to fix the early version of Windows 8 that was showing these symptoms, caused by the live tiles, but I had all the patches or the replacement patches.
Once, after installing my image when I "turned off the Live Tiles" feature of all the Tiles I had running the problem stopped, when I turned the "Live Tiles" feature back on the problem still did not return. But when I re-installed my
image again, just turning off the live tiles did not correct the problem this time.
The one thing that consistently stops the crashing cycle is the following Registry change:
HKEY_CURRENT_USER\Control Panel\Desktop
Change the string for the Wallpaper to the location of some other picture, like for Windows 8;
C:\Windows\Web\Wallpaper\Windows
Then restart Windows.
I hope this helps someone else trying to resolve this issue.
March 25th, 2013 10:25pm
Andre, could you please look into my crash dump: http://sdrv.ms/Zv84rQ
There's a history in this. This is a month old Win8 64 Pro and earlier the Intel graphics driver crashed explorer whenever I tried to do anything. After rolling the driver back 4 versions (!), it finally stopped crashing. Then the NVidia extensions
started crashing explorer since there's dual GPU. That was fixed by disabling NVidia from BIOS and all the shell extensions. Then Intel driver auto-updated itself to a crashing version every day until I found some obscure admin panel where to disable auto
updates for given driver ids. But now the desktop crashes 10 times a day and easily 5 times every boot before stabilizing and there is no clear reason.
I'm just totally fed up with this, after 7 years with linux I thought that Windows 8 actually looked pretty functional. It might actually work for me if it just were more reliable than a worse-than-average indie DOS game.
Thanks for any help.
March 27th, 2013 1:26pm
Andre, could you please look into my crash dump
google drive is causing the crash:
0x000007fd18e40410: ntdll! ?? ::FNODOBFM::`string'+0x7E91
0x000007fd103a5be5: verifier!AVrfpInitializeCriticalSectionCommon+0x115
0x000007fd071d6e59: contextmenu64!DllInstall+0x5769
0x000007fd0721731e: contextmenu64!DllInstall+0x45C2E
0x000007fd0722e534: contextmenu64!DllInstall+0x5CE44
0x000007fd071d5aeb: contextmenu64!DllInstall+0x43FB
0x000007fd071d36c0: contextmenu64!DllInstall+0x1FD0
0x000007fd071d3a5f: contextmenu64!DllInstall+0x236F
0x000007fd175fd5d7: shell32!IShellExtInit_Initialize+0x47
0x000007fd175ffb6d: shell32!HDXA_QueryContextMenu+0x2DD
0x000007fd175fea0f: shell32!CDefFolderMenu::QueryContextMenu+0x41B
0x000007fd175294ce: shell32!CShellLink::CTargetContextMenu::QueryContextMenu+0x1E
0x000007fd17529471: shell32!CShellLink::QueryContextMenu+0x7D
0x000007fd175ffcb6: shell32!HDXA_QueryContextMenu+0x426
0x000007fd175fea0f: shell32!CDefFolderMenu::QueryContextMenu+0x41B
0x000007fd175bcd15: shell32!CShellExecute::_InvokeInProcExec+0xA1
0x000007fd175bcc47: shell32!CShellExecute::_InvokeCtxMenu+0x4B
0x000007fd175bcbdb: shell32!CShellExecute::_DoExecute+0x153
0x000007fd175d0ae6: shell32!CSetShellForeground::SetShellForeground+0x6A
0x000007fd13d740bc: SHCore!COplockFileHandle::v_GetHandlerCLSID+0x12C
0:059> lmvm contextmenu64
start end module name
000007fd`071d0000 000007fd`0728a000 contextmenu64 (export symbols) contextmenu64.dll
Loaded symbol image file: contextmenu64.dll
Image path: C:\Program Files (x86)\Google\Drive\contextmenu64.dll
Image name: contextmenu64.dll
Timestamp: Fri Mar 08 01:30:26 2013 (51393122)
CheckSum: 000C27D8
ImageSize: 000BA000
File version: 1.0.0.1
Product version: 1.0.0.1
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: Google
ProductName: Google Drive
InternalName: contextmenu.dll
OriginalFilename: contextmenu.dll
ProductVersion: 1.8.4357.4863
FileVersion: 1.8.4357.4863
FileDescription: Google Drive shell extension
LegalCopyright: Google
March 27th, 2013 11:36pm
Thanks! Just a follow-up on teaching how to fish: how did you get the stack trace? The debugger also found the dll symbols apparently.
I loaded the dump to WinDbg (X64), used MSDL symbol server and gave "!analyze -v". That didn't give any meaningful info, neither stack trace or symbols, and my Windows debugging skills ended there...
-
Edited by
vuakko
Thursday, March 28, 2013 6:41 PM
Added note for MSDL
March 28th, 2013 6:38pm
Thanks! Just a follow-up on teaching how to fish: how did you get the stack trace? The debugger also found the dll symbols apparently.
I loaded the dump to WinDbg (X64), used MSDL symbol server and gave "!analyze -v". That didn't give any meaningful info, neither stack trace or symbols, and my Windows debugging skills ended there...
March 28th, 2013 9:38pm
Wing tells you what to do:
!cs -s parameter1 - dump information about this critical section.
So run the !cs command with the value from parameter 1.
March 28th, 2013 11:51pm
My Fujitsu Lifebook T900 laptop crashes reproducable in Windows 8, if I have an active Internet connection with built in UMTS modem and send it to Hibernate in that state.
Best greetings from Germany
Olaf
March 30th, 2013 1:16am
Olaf, does the Explorer crash or your complete system (BSOD)?
March 30th, 2013 9:27am
I get the Windows needs to restart sad face ...
March 30th, 2013 11:53am
I get the Windows needs to restart sad face ...
this is bugcheck. Zip and upload the file
C:\WindowsMemory.dmp to your skydirve and post a link here
March 30th, 2013 12:17pm
Andre,
Would you mind taking a look at my crash dump file? My Windows Explorer is crashing/hanging as well.
http://sdrv.ms/14wN7kW
Thanks
March 31st, 2013 4:28am
Andre,
Would you mind taking a look at my crash dump file? My Windows Explorer is crashing/hanging as well.
Avast causes a stackoverflow in explorer. Contact their support about the issue. Run the linked install.reg to disable app verifier and dump creation.
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify checksum for snxhk64.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for snxhk64.dll -
FAULTING_IP:
verifier!AVrfpRegOpenKeyExW+8c
000007fa`f9292f0c 8bd8 mov ebx,eax
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fb014113de (advapi32!RegOpenKeyExWStub+0x000000000000000e)
ExceptionCode: c00000fd (Stack overflow)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000eb3ff8
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc00000fd - Eine neue Schutzseite f r den Stapel kann nicht erstellt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc00000fd - Eine neue Schutzseite f r den Stapel kann nicht erstellt werden.
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000eb3ff8
RECURRING_STACK: From frames 0x1 to 0x2
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 00000000000016c4
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 000007faf9292f0c to 000007fb014113de
DEFAULT_BUCKET_ID: STACK_CORRUPTION_CALL
PRIMARY_PROBLEM_CLASS: STACK_CORRUPTION_CALL
BUGCHECK_STR: APPLICATION_FAULT_STACK_CORRUPTION_STACK_OVERFLOW_CALL
STACK_TEXT:
00000000`00eb22f8 000007fb`021fea72 ntdll!EtwEventWriteNoRegistration+0x8e
00000000`00eb23a8 000007fb`02241d0e ntdll!WerpAllocateAndInitializeSid+0xa2
00000000`00eb23d8 000007fb`02241d91 ntdll!WerpFreeSid+0x41
00000000`00eb2408 000007fb`0222eda9 ntdll!SendMessageToWERService+0x75
00000000`00eb24d8 000007fb`022816e0 ntdll! ?? ::FNODOBFM::`string'+0x0
00000000`00eb2568 000007fb`0222ed19 ntdll!ReportExceptionInternal+0xb9
00000000`00eb2f18 000007fb`02241ba4 ntdll!RtlReportExceptionEx+0x22c
00000000`00eb3048 000007fb`02241f5b ntdll!RtlReportException+0xbb
00000000`00eb3068 000007fb`021e46fd ntdll!RtlWalkFrameChain+0x29
00000000`00eb30d8 000007fb`0223b92a ntdll!LdrpCalloutExceptionFilter+0x16
00000000`00eb30e0 000007fb`022a8e78 ntdll!crc64Map32_+0x3d54
00000000`00eb3108 000007fb`02278fe9 ntdll! ?? ::FNODOBFM::`string'+0x818
00000000`00eb3118 000007fb`0218b4f7 ntdll!RtlDecodePointer+0x27
00000000`00eb3148 000007fb`021a4fea ntdll!_C_specific_handler+0x8e
00000000`00eb3158 000007fb`021fe057 ntdll!RtlpCallVectoredHandlers+0x103
00000000`00eb31b8 000007fb`021a464d ntdll!RtlpExecuteHandlerForException+0xd
00000000`00eb31e8 000007fb`021a567c ntdll!RtlDispatchException+0x392
00000000`00eb32c0 000007fb`022c7668 ntdll!__PchSym_ <PERF> +0x0
00000000`00eb32e0 000007fb`021a4f5c ntdll!_C_specific_handler+0x0
00000000`00eb32e8 000007fb`022a8e5c ntdll!crc64Map32_+0x3d38
00000000`00eb37d8 000007fa`f9292e80 verifier!AVrfpRegOpenKeyExW+0x0
00000000`00eb37e0 000007fb`014113f0 advapi32!RegQueryValueExWStub+0x0
00000000`00eb3888 000007fb`01410000 advapi32!_sz_CRYPTSP_dll <PERF> +0x0
00000000`00eb3890 000007fb`014ac06c advapi32!RestrictedMachineHandle <PERF> +0x0
00000000`00eb38a0 000007fa`f92c23f8 verifier!__PchSym_ <PERF> +0x0
00000000`00eb38f8 000007fb`02184bba ntdll!KiUserExceptionDispatch+0x2e
00000000`00eb3ab0 000007fa`f92785e8 verifier!AVrfDebugPageHeapReAllocate+0x300
00000000`00eb3e90 000007fb`014113de advapi32!RegOpenKeyExWStub+0xe
00000000`00f2c6a8 000007fb`011eb700 sechost!SetServiceObjectSecurity+0x2c
00000000`00f2c8e8 00000000`6a61ab83 snxhk64!SnxHk_UninstallHook+0x2153
00000000`00f2c938 000007fb`00d82152 user32!GetWindowLongPtrW+0x12
00000000`00f2c9b8 000007fa`f92939d8 verifier!AVrfpHandleSanityChecks+0x44
00000000`00f2ca48 000007fa`f9294b2b verifier!AVrfpNtProtectVirtualMemory+0x9f
00000000`00f2ca98 000007fa`ff527e91 kernelbase!VirtualProtect+0x35
00000000`00f2cae8 00000000`6a60313f snxhk64+0x313f
00000000`00f2ddf8 000007fb`021e38cf ntdll!RtlpLookupFunctionEntryForStackWalks+0x43
00000000`00f2de98 000007fb`000232d0 shell32!tls_end <PERF> +0x0
00000000`00f2e0d8 000007fb`02199eab ntdll!RtlpExtendHeap+0x5b
00000000`00f2e1b8 000007fb`021c0b98 ntdll!RtlpAllocateHeap+0x1527
00000000`00f2e398 000007fb`021b20ba ntdll!RtlpxLookupFunctionTable+0x188
00000000`00f2e420 000007fb`01eeb084 combase!__objectFactory__CExtensionCatalog <PERF> +0x0
00000000`00f2e4c8 000007fb`021e4624 ntdll!RtlpWalkFrameChain+0xedf
00000000`00f2e540 000007fb`00000005 shell32!api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA+0x5
00000000`00f2e5a8 000007fb`022c70c8 ntdll!__PchSym_ <PERF> +0x0
00000000`00f2e8a8 000007fb`021911cf ntdll!RtlpFindUnicodeStringInSection+0x1db
00000000`00f2ea58 000007fb`02191907 ntdll!RtlDosApplyFileIsolationRedirection_Ustr+0x833
00000000`00f2ebd8 000007fa`f9290b2a verifier!AVrfpRtlReAllocateHeap+0x1ae
00000000`00f2ec00 000007fb`01d90000 combase!CObjServer::CreateInstance+0x130
00000000`00f2ec68 000007fb`0219214b ntdll!LdrpFindLoadedDll+0x1ae
00000000`00f2ec98 000007fb`02262070 ntdll!RtlReleaseStackTrace+0x18
00000000`00f2ecf8 000007fa`f92795af verifier!AVrfpDphNormalHeapFree+0x8f
00000000`00f2ed78 000007fb`0226c522 ntdll!RtlpValidateHeap+0x32
00000000`00f2edc8 000007fb`0226bb1f ntdll!RtlDebugReAllocateHeap+0x3f
00000000`00f2ee08 000007fb`0226d791 ntdll!RtlDebugSizeHeap+0x119
00000000`00f2ee40 000007fb`021f8f40 ntdll!LdrpDefaultExtension+0x0
00000000`00f2ee48 000007fb`02191a96 ntdll!LdrpApplyFileNameRedirection+0x9e
00000000`00f2eea8 000007fa`f92700f0 verifier!`string' <PERF> +0x0
00000000`00f2eed8 000007fb`02191f9c ntdll!LdrGetDllHandleEx+0x4af
00000000`00f2ef38 000007fb`02197b52 ntdll!LdrGetProcedureAddressForCaller+0x3af
00000000`00f2ef78 000007fb`01ea0068 combase!`string'+0x0
00000000`00f2f048 000007fb`02229ffa ntdll! ?? ::FNODOBFM::`string'+0x133e9
00000000`00f2f088 000007fa`f92907a0 verifier!AVrfpRtlAllocateHeap+0x18c
00000000`00f2f098 000007fa`f927873d verifier!AVrfDebugPageHeapSize+0x89
00000000`00f2f0a0 000007fb`014113d0 advapi32!RegOpenKeyExWStub+0x0
00000000`00f2f0b8 000007fb`014113e4 advapi32!RegOpenKeyExWStub+0x14
00000000`00f2f0e8 000007fa`f9270000 verifier!`string' <PERF> +0x0
00000000`00f2f0f8 000007fa`f9292f0c verifier!AVrfpRegOpenKeyExW+0x8c
00000000`00f2f108 000007fb`01e211d0 combase!`string'+0x0
00000000`00f2f118 000007fa`f92861fc verifier!AVrfpIncrementOwnedCriticalSections+0x30
00000000`00f2f128 000007fb`01e9fce5 combase!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<1> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x1b705
00000000`00f2f148 000007fb`01d994b6 combase!ComVerifierSettings::ComVerifierSettings+0x76
00000000`00f2f168 000007fb`022293ca ntdll! ?? ::FNODOBFM::`string'+0x11379
00000000`00f2f178 000007fa`f9285aa5 verifier!AVrfpRtlLeaveCriticalSection+0xcd
00000000`00f2f1a8 000007fb`01d99169 combase!onexit+0x7d
00000000`00f2f1b0 000007fb`01de5608 combase!_chkstk+0x15c8
00000000`00f2f1d8 000007fb`01d99425 combase!_chkstk+0xf35
00000000`00f2f1e0 000007fb`01e203b0 combase!_xc_a+0x190
00000000`00f2f1e8 000007fb`01e204b8 combase!_xc_z+0x0
00000000`00f2f1f8 000007fb`022617cb ntdll!RtlpStdGetRecordedStackTraceIndex+0xab
00000000`00f2f200 000007fb`01e204c8 combase!_xi_a+0x8
00000000`00f2f208 000007fb`014f3cef msvcrt!initterm+0x1f
00000000`00f2f228 000007fb`02293d61 ntdll! ?? ::FNODOBFM::`string'+0x1d051
00000000`00f2f230 000007fb`01e204d0 combase!_xi_z+0x0
00000000`00f2f238 000007fb`01d99209 combase!CRT_INIT+0x1c3
00000000`00f2f250 000007fb`01b6d4b0 rpcrt4!NdrOle_CS+0x0
00000000`00f2f258 000007fb`021bc0c7 ntdll!RtlpAddDebugInfoToCriticalSection+0xb3
00000000`00f2f278 000007fb`01d713b0 combase!CRT_INIT+0x2d4
00000000`00f2f2c8 000007fa`f9284ff7 verifier!AVrfpInsertCritSectInSplayTree+0xa3
00000000`00f2f2e8 000007fa`f92b42a0 verifier!CriticalSectionLock+0x0
00000000`00f2f328 000007fb`01a6746c rpcrt4!SafeAllocaInitialize+0x1c
00000000`00f2f358 000007fb`021853aa ntdll!RtlDeactivateActivationContextUnsafeFast+0xf6
00000000`00f2f378 000007fb`014f11bc msvcrt!free+0x1c
00000000`00f2f380 000007fb`014f0000 msvcrt!_xc_a <PERF> +0x0
00000000`00f2f388 000007fb`0218545f ntdll!RtlActivateActivationContextUnsafeFast+0x93
00000000`00f2f3a8 000007fb`01d99276 combase!DllMainCRTStartup+0x21
00000000`00f2f3d8 000007fa`f9283b2e verifier!AVrfpStandardDllEntryPointRoutine+0xbe
00000000`00f2f418 000007fa`f92b10a0 verifier!AVrfpFirstThreadTlsStruct+0x0
00000000`00f2f420 000007fb`01a50000 rpcrt4!_sz_api_ms_win_security_lsalookup_l1_1_1_dll <PERF> +0x0
00000000`00f2f468 000007fb`00000001 shell32!api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA+0x1
00000000`00f2f498 000007fb`0218ba0e ntdll!LdrpCallInitRoutine+0x3e
00000000`00f2f4a8 000007fb`021a82dc ntdll!LdrpInitializeNode+0x192
00000000`00f2f4b8 000007fb`01d70000 combase!_xc_a <PERF> +0x0
00000000`00f2f4f0 000007fa`f9283a70 verifier!AVrfpStandardDllEntryPointRoutine+0x0
00000000`00f2f548 000007fb`021a82a1 ntdll!LdrpInitializeNode+0x157
00000000`00f2f5a8 000007fb`021a787f ntdll!LdrpInitializeGraph+0x6f
00000000`00f2f5c8 000007fb`021fa3a0 ntdll! ?? ::FNODOBFM::`string'+0x0
00000000`00f2f608 000007fb`021a2592 ntdll!RtlImageNtHeader+0x1e
00000000`00f2f628 000007fb`021ab64e ntdll!LdrpInitializeGraph+0x8d
00000000`00f2f668 000007fb`021b319c ntdll!LdrpInitializeProcess+0x1a1b
00000000`00f2f690 000007fb`00000000 shell32!api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA+0x0
00000000`00f2f6f8 000007f6`772200e8 explorer!_xc_a <PERF> +0x0
00000000`00f2f748 000007fb`016e0000 kernel32!c_PmapEntries_api_ms_win_core_bicltapi_l1_1_0 <PERF> +0x0
00000000`00f2f780 000007fb`021fa090 ntdll!RtlNtdllName+0x18
00000000`00f2f7b8 000007fb`016e2bd0 kernel32!TermsrvGetWindowsDirectoryW+0x0
00000000`00f2f808 000007fb`022bf2e0 ntdll!AvrfpLoaderEntry+0x0
00000000`00f2f850 000007fb`021800d8 ntdll!NtDllUserStubs <PERF> +0x0
00000000`00f2f950 000007fb`02180000 ntdll!NtDllUserStubs <PERF> +0x0
00000000`00f2f968 000007fb`021b216a ntdll! ?? ::FNODOBFM::`string'+0x5766
00000000`00f2f978 000007fb`021b4647 ntdll!InitSecurityCookie+0x2f
00000000`00f2f9a8 000007fb`021b4605 ntdll! ?? ::FNODOBFM::`string'+0x598d
00000000`00f2f9d8 000007fb`021a32ae ntdll!LdrInitializeThunk+0xe
00000000`00f2fab0 000007f6`7725b6d4 explorer!wWinMainCRTStartup+0x0
00000000`00f2fb28 000007fb`021a34e0 ntdll!RtlUserThreadStart+0x0
IMAGE_NAME: snxhk64.dll
FAILURE_BUCKET_ID: STACK_CORRUPTION_CALL_c00000fd_snxhk64.dll!Unknown
BUCKET_ID: APPLICATION_FAULT_STACK_CORRUPTION_STACK_OVERFLOW_CALL_snxhk64+313f
Loaded symbol image file: snxhk64.dll
Image path: C:\Program Files\AVAST Software\Avast\snxhk64.dll
Image name: snxhk64.dll
Timestamp: Thu Mar 07 00:27:21 2013 (5137D0D9)
CheckSum: 00000000
ImageSize: 0004D000
File version: 8.0.1483.72
Product version: 8.0.1483.72
File flags: 0 (Mask 17)
File OS: 4 Unknown Win32
File type: 0.0 Unknown
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: AVAST Software
ProductName: avast! Antivirus
InternalName: snxhk
OriginalFilename: snxhk.dll
ProductVersion: 8.0.1483.72
FileVersion: 8.0.1483.72
FileDescription: avast! snxhk
LegalCopyright: Copyright (c) 2013 AVAST Software
March 31st, 2013 8:48am
You're a life saver! I uninstalled Avast & my machine works again!
Thank you!
March 31st, 2013 3:09pm
Andre, could you please look into my crash dump also: http : // sdrv . ms / 14PLJdu
I have this issue on my computer and my girlfriend's computer which barely has anything on it. mine was a windows 8 upgrade and hers was a fresh install of windows 8, both 64bit. the files explorer.exe.4908.dmp and explorer.exe.22792.dmp were created when
explorer.exe crashed which are the most important to me. the other 3 dumps were unexpected as they were created just logging in which I don't notice anything weird during this time. please have a look its driving us crazy. every time we do a lot of folder
navigating it crashes explorer. thanks in advance.
April 4th, 2013 1:54pm
Is there anybody out there that can help me with this issue? My Windows explorer crashes whenever I browse folders with a large number of files.
Any help with this issue would be greatly appreciated.
COMODO Internet Security caused 1 crash:
APPLICATION_VERIFIER_HANDLES_NULL_HANDLE (303)
NULL handle passed as parameter. A valid handle must be used.
This stop is generated if the function on the top of the stack passed a
NULL handle to system routines.
Arguments:
Arg1: 0000000000000000, Not used.
Arg2: 0000000000000000, Not used.
Arg3: 0000000000000000, Not used.
Arg4: 0000000000000000, Not used.
FAULTING_IP:
verifier!VerifierStopMessageEx+6d0
000007ff`8f1da7fc cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007ff8f1da7fc (verifier!VerifierStopMessageEx+0x00000000000006d0)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000001368
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007ff8f1f39ce to 000007ff8f1da7fc
STACK_TEXT:
00000000`0bd8f240 000007ff`8f1f39ce : 000007ff`aa0d88d0 000007ff`8f1dcbc0 000007f7`99017000 000007ff`8f1dcbc0 : verifier!VerifierStopMessageEx+0x6d0
00000000`0bd8f5c0 000007ff`8f1f40f2 : 00000000`02c42940 00000000`00000000 0000b054`4ef29b0c 000007ff`a9fb40dd : verifier!AVrfpHandleSanityChecks+0x3a
00000000`0bd8f610 00000001`80021059 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : verifier!AVrfpNtQueryInformationThread+0x46
00000000`0bd8f650 00000001`8000fae0 : 00000000`08e50bf0 00000000`00000000 00000000`00000016 000007ff`8f1e209a : guard64!Exported+0x1b5a9
00000000`0bd8f6d0 000007ff`aa640052 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : guard64!Exported+0xa030
00000000`0bd8f730 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007ff`aa640052
STACK_COMMAND: ~8s; .ecxr ; kb
FOLLOWUP_IP:
guard64!Exported+1b5a9
00000001`80021059 85c0 test eax,eax
IMAGE_NAME: guard64.dll
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_guard64.dll!Exported
Loaded symbol image file: guard64.dll
Image path: C:\Windows\System32\guard64.dll
Image name: guard64.dll
Timestamp: Thu Jan 24 22:51:52 2013 (5101ACF8)
CheckSum: 00072F57
ImageSize: 00076000
File version: 6.0.2566.2708
Product version: 6.0.2566.2708
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: COMODO
ProductName: COMODO Internet Security
ProductVersion: 6, 0, 264710, 2708
FileVersion: 6, 0, 264710, 2708
FileDescription: COMODO Internet Security
LegalCopyright: 2005-2012 COMODO. All rights reserved.
the other crash is caused by Google Drive shell extension:
FAULTING_IP:
ntdll!RtlReportCriticalFailure+89
000007fb`1eaba485 eb00 jmp ntdll!RtlReportCriticalFailure+0x8b (000007fb`1eaba487)
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fb1eaba485 (ntdll!RtlReportCriticalFailure+0x0000000000000089)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000007fb1eb0fd60
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_PARAMETER1: 000007fb1eb0fd60
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
LAST_CONTROL_TRANSFER: from 000007fb1eabf2a0 to 000007fb1eaba485
FAULTING_THREAD: ffffffffffffffff
BUGCHECK_STR: APPLICATION_FAULT_STATUS_HEAP_CORRUPTION_AFTER_CALL
PRIMARY_PROBLEM_CLASS: STATUS_HEAP_CORRUPTION_AFTER_CALL
DEFAULT_BUCKET_ID: STATUS_HEAP_CORRUPTION_AFTER_CALL
STACK_TEXT:
000007fb`1eb0fdc8 000007fb`1eadbf2f ntdll! ?? ::FNODOBFM::`string'+0x13981
000007fb`1eb0fdd0 00000000`77cbcabc msvcr90!free+0x1c
000007fb`1eb0fdd8 00000000`775c9f71 msvcp90!std::basic_string<unsigned short,std::char_traits<unsigned short>,std::allocator<unsigned short> >::~basic_string<unsigned short,std::char_traits<unsigned short>,std::allocator<unsigned short> >+0x19
000007fb`1eb0fde0 000007fb`004e2e7a googledrivesync64!DllCanUnloadNow+0xd2a
000007fb`1eb0fde8 000007fb`1cd240b6 shell32!CFSIconOverlayManager::_GetFileOverlayInfo+0xca
000007fb`1eb0fdf0 000007fb`1cc78410 shell32!CFSIconOverlayManager::GetFileOverlayInfo+0x48
000007fb`1eb0fdf8 000007fb`1cd246b7 shell32!CFSFolder::_GetOverlayInfo+0xdf
000007fb`1eb0fe00 000007fb`1cd277f2 shell32!CIconOverlayTask::InternalResumeRT+0x14a
000007fb`1eb0fe08 000007fb`1cce8324 shell32!CRunnableTask::Run+0x98
000007fb`1eb0fe10 000007fb`1ccdf388 shell32!CShellTask::TT_Run+0x3c
000007fb`1eb0fe18 000007fb`1cbb18df shell32!CShellTaskThread::ThreadProc+0xd7
000007fb`1eb0fe20 000007fb`1cbb19e7 shell32!CShellTaskThread::s_ThreadProc+0x33
000007fb`1eb0fe28 000007fb`1aa4157f shcore!ExecuteWorkItemThreadProc+0xf
000007fb`1eb0fe30 000007fb`1e9e7f59 ntdll!RtlpTpWorkCallback+0x189
000007fb`1eb0fe38 000007fb`1e9d8842 ntdll!TppWorkerThread+0x604
000007fb`1eb0fe40 000007fb`1dea167e kernel32!BaseThreadInitThunk+0x1a
000007fb`1eb0fe48 000007fb`1e9f3501 ntdll!RtlUserThreadStart+0x1d
FOLLOWUP_IP:
googledrivesync64!DllCanUnloadNow+d2a
000007fb`004e2e7a 418bc5 mov eax,r13d
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: googledrivesync64!DllCanUnloadNow+d2a
FOLLOWUP_NAME: wintriag
MODULE_NAME: googledrivesync64
IMAGE_NAME: googledrivesync64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 513930fc
STACK_COMMAND: dps 7fb1eb0fdc8 ; kb
FAILURE_BUCKET_ID: STATUS_HEAP_CORRUPTION_AFTER_CALL_c0000374_googledrivesync64.dll!DllCanUnloadNow
BUCKET_ID: APPLICATION_FAULT_STATUS_HEAP_CORRUPTION_AFTER_CALL_googledrivesync64!DllCanUnloadNow+d2a
Loaded symbol image file: googledrivesync64.dll
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Timestamp: Fri Mar 08 01:29:48 2013 (513930FC)
CheckSum: 000BDD33
ImageSize: 000C0000
File version: 1.8.4357.4863
Product version: 1.8.4357.4863
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Google
ProductName: Google Drive
ProductVersion: 1.8.4357.4863
FileVersion: 1.8.4357.4863
FileDescription: Google Drive shell extension
LegalCopyright: Google
Disable the
sync icons in the google drive options.
April 4th, 2013 10:36pm
Thanks for your help. This is probably a dumb question, but what software is giving you those nice read outs of the dumps? DebugDiag 1.2 gives something similar, but not like that. Also I tried to install the symbols pack for win 8 64bit....retail, but
after it loaded didn't really give me much even after running !Analyze -v. If you can explain this we could try checking ourselves to learn a bit more, I know I am interested.
April 5th, 2013 1:07am
I use WinDbg. Read here how to get the correct symbols:
http://support.microsoft.com/kb/311503
If you install updates you need the updated PDB files. So use the symbol server and don't install the symbol package
April 5th, 2013 8:47am
Great was able to achieve the same output as you. the google drive shell extension took a few moments longer, but finally figured out the missing command, "lmvm googledrivesync64". Thanks for all your help.
April 6th, 2013 3:14am
Andre, I am having th explorer crash on some new Dell Inspiron 14 laptops. I ran the reg file which has created dump files, but they are all over 200 MB in size. Is there a way to trim them? Skydrive only allows 100 MB I think.
The one thing we recently discovered is that on one of the laptops, right clicking on the touchpad seems to cause Explorer to crash. But this isn't consistent.
-
Edited by
J Ronning
Monday, April 08, 2013 8:42 AM
April 8th, 2013 8:42am
Andre, I am having th explorer crash on some new Dell Inspiron 14 laptops. I ran the reg file which has created dump files, but they are all over 200 MB in size. Is there a way to trim them? Skydrive only allows 100 MB I think.
The one thing we recently discovered is that on one of the laptops, right clicking on the touchpad seems to cause Explorer to crash. But this isn't consistent.
April 8th, 2013 11:42am
SkyDrive has a 1GB file limit now. You could also zip up the files to compress them.
April 8th, 2013 3:03pm
Is there a way to trim them?
compress them with 7-zip to 7z files (LZMA2, ULTRA)
http://7-zip.org/
April 8th, 2013 9:58pm
Sir Andre, please help me also with my explorer crash problem. Here's my dump file:
http://sdrv.ms/ZKhDkM
I just recently uninstalled several programs which I think affects this problem, although I don't know how to read dump files. I manage to uninstall programs such as Stardock, Rainmeter and Xwidget but still no effect. I already performed registry clean-up
using Tune-up Utilities 2012.
April 23rd, 2013 6:21pm
I am not Andre and I didn't look at your file, but do not run registry cleaners. They are snake oil and will do nothing to solve whatever problem you have. In fact, they may cause additional problems.
April 23rd, 2013 6:22pm
Sir Andre, please help me also with my explorer crash problem. Here's my dump file:
http://sdrv.ms/ZKhDkM
the following file seams to cause the crash:
Mega Codec Pack\Filters\Haali\mmdinfo.dll
APPLICATION_VERIFIER_LOCKS_LOCK_IN_FREED_HEAP (202)
Freeing heap block containing an active critical section.
This stop is generated if a heap allocation contains a critical section,
the allocation is freed and the critical section has not been deleted.
To debug this stop use the following debugger commands:
$ !cs -s parameter1 - dump information about this critical section.
$ ln parameter1 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter2 - to dump the stack trace for this critical section initialization.
$ parameter3 and parameter4 might help understand where this heap block was
allocated (the size of the allocation is probably significant).
Arguments:
Arg1: 0ec591f4, Critical section address.
Arg2: 01563e14, Critical section initialization stack trace.
Arg3: 0ec591c0, Heap block address.
Arg4: 0000004c, Heap block size.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for duser.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for uxtheme.dll -
FAULTING_IP:
verifier!VerifierStopMessageEx+701
66d6c121 cc int 3
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 66d6c121 (verifier!VerifierStopMessageEx+0x00000701)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 84db8600
Parameter[2]: 059b6ca0
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
CRITICAL_SECTION: 0ec591f4 -- (!cs -s 0ec591f4)
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 84db8600
EXCEPTION_PARAMETER3: 059b6ca0
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 00000aa8
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 66d76598 to 66d6c121
STACK_TEXT:
0b50ec7c 66d76598 66d85488 00000202 0ec591f4 verifier!VerifierStopMessageEx+0x701
0b50eca8 66d74531 00000000 0000004c 00000000 verifier!AVrfpFreeMemLockChecks+0xc5
0b50ecc8 66d7ef52 00000000 0000004c 00000000 verifier!AVrfpFreeMemNotify+0x2a
0b50ece0 77a0fffa 0ec591c0 0000004c 0ea60000 verifier!AVrfpNtdllHeapFreeCallback+0x15
0b50ed00 66d686ee 0ec591c0 0000004c 0ec50000 ntdll!AVrfInternalHeapFreeNotification+0x4a
0b50ed2c 779c6c8e 0ea60000 7798c0fa 66d94600 verifier!AVrfDebugPageHeapDestroy+0x16e
0b50ed40 66d7f026 0ea60000 00000000 00000000 ntdll!RtlDestroyHeap+0x74
0b50ed54 75292c7c 0ea60000 0b50ed98 6a5dcd37 verifier!AVrfpRtlDestroyHeap+0x33
0b50ed60 6a5dcd37 0ea60000 6a5da935 f803d02b KERNELBASE!HeapDestroy+0xe
WARNING: Stack unwind information not available. Following frames may be wrong.
0b50ed98 6a5daa7c 6a5c0000 00000000 00000000 mmdinfo!DllUnregisterServer+0x823e
0b50edd8 6a5daae7 6a5c0000 0b50ee38 66d752f1 mmdinfo!DllUnregisterServer+0x5f83
0b50ede4 66d752f1 6a5c0000 00000000 00000000 mmdinfo!DllUnregisterServer+0x5fee
0b50ee38 7794ed9a 6a5c0000 00000000 00000000 verifier!AVrfpStandardDllEntryPointRoutine+0x9f
0b50ee58 7794ee10 66d75252 6a5c0000 00000000 ntdll!LdrxCallInitRoutine+0x16
0b50eea0 7798b996 66d75252 6a5c0000 00000000 ntdll!LdrpCallInitRoutine+0x63
0b50ef0c 7798b746 094fe360 09516650 094fe360 ntdll!LdrpProcessDetachNode+0x10f
0b50ef48 779556e1 094fe360 12631328 09516650 ntdll!LdrpUnloadNode+0x51
0b50ef80 77951b15 014fe360 12631360 779519c1 ntdll!LdrpDecrementNodeLoadCount+0x17d
0b50efc8 66d7573f 6a5c0000 0b50f4b8 09500406 ntdll!LdrUnloadDll+0x12b
0b50efdc 7528ce33 6a5c0000 00000001 0b50eff8 verifier!AVrfpLdrUnloadDll+0x61
0b50efec 774c1fae 6a5c0000 0b50f00c 774c2013 KERNELBASE!FreeLibrary+0x15
0b50eff8 774c2013 00000006 6a5c0000 00000000 combase!FreeLibraryWithLogging+0x21
0b50f00c 7748f730 0b50f3f8 774742f0 00000000 combase!CClassCache::CDllPathEntry::CFinishObject::Finish+0x28
0b50f4d0 7748e8e1 127f3c56 00000001 0b50f558 combase!CClassCache::CleanUpDllsForApartment+0x2a0
0b50f528 7748e6c6 0b50f598 66d76927 00000000 combase!FinishShutdown+0x13b
0b50f564 7748f08d 00000000 08c75ca0 00000000 combase!ApartmentUninitialize+0xb4
0b50f57c 774896ff 00000000 0059a214 094df968 combase!wCoUninitialize+0x163
0b50f5a4 66d7a1e7 0b50f5b8 76396400 05314e68 combase!CoUninitialize+0x9d
0b50f5ac 76396400 05314e68 0b50f5c8 75473678 verifier!AVrfpCoUninitialize+0x17
0b50f5b8 75473678 094df968 05b54f00 0b50f708 shell32!CShellTaskThread::s_ThreadProc+0x30
0b50f5c8 77988ab2 05314e68 12630ba0 005081f0 SHCore!DllCanUnloadNow+0x36
0b50f708 7794a35e 0b50f758 05b54f00 12630430 ntdll!RtlpTpWorkCallback+0x27f
0b50f898 76091866 005081f0 0b50f8e8 779668f1 ntdll!TppWorkerThread+0x538
0b50f8a4 779668f1 005081f0 12630440 00000000 kernel32!BaseThreadInitThunk+0xe
0b50f8e8 7796689d ffffffff 779f5ae2 00000000 ntdll!__RtlUserThreadStart+0x4a
0b50f8f8 00000000 7796704d 005081f0 00000000 ntdll!_RtlUserThreadStart+0x1c
FOLLOWUP_IP:
mmdinfo!DllUnregisterServer+823e
6a5dcd37 8325583c5f6a00 and dword ptr [mmdinfo!DllUnregisterServer+0x1f15f (6a5f3c58)],0
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: mmdinfo!DllUnregisterServer+823e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: mmdinfo
IMAGE_NAME: mmdinfo.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 50c45e1c
STACK_COMMAND: ~30s; .ecxr ; kb
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_mmdinfo.dll!DllUnregisterServer
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_mmdinfo!DllUnregisterServer+823e
Loaded symbol image file: mmdinfo.dll
Image path: C:\Program Files\Mega Codec Pack\Filters\Haali\mmdinfo.dll
Image name: mmdinfo.dll
Timestamp: Sun Dec 09 10:47:08 2012
remove those codec packs.
April 23rd, 2013 9:12pm
Thank you. I uninstalled the K-Lite Codec as well as the Mega codec, too. The latter one is uninstalled in Safe Mode. Removed all my media players that uses those codecs, then left with one dump file. I rebooted once, and it works fine now. The thing is
that the Music in the Metro keeps closing/restarting. But anyway, thanks for the help.
April 24th, 2013 11:12am
run the uninstall.reg from my skydrive and create a new topic about the music app issue.
April 24th, 2013 9:17pm
Hi,
Can you see my dump file ?
https://59mpgw.dm1.livefilestore.com/y1pS9HPxU-y8IVz_n2H8uBaZz5h60i61lC9PP-GUJqhkpj9auFOX0ikx6oAfqlNiLAm/explorer.exe.1556.rar?download&psid=1
Thank you very much.
-
Edited by
cavara
Sunday, April 28, 2013 3:46 PM
April 28th, 2013 3:40pm
Hi,
Can you see my dump file ?
https://59mpgw.dm1.livefilestore.com/y1pS9HPxU-y8IVz_n2H8uBaZz5h60i61lC9PP-GUJqhkpj9auFOX0ikx6oAfqlNiLAm/explorer.exe.1556.rar?download&psid=1
Thank you very much.
April 28th, 2013 6:40pm
Hi,
Can you see my dump file ?
https://59mpgw.dm1.livefilestore.com/y1pS9HPxU-y8IVz_n2H8uBaZz5h60i61lC9PP-GUJqhkpj9auFOX0ikx6oAfqlNiLAm/explorer.exe.1556.rar?download&psid=1
Hi, you are having issues with QT runtime. Please try updating to the latest stable version of QT runtime with major version 4:
http://qt-project.org/downloads
For some reason, the QT runtime is causing an
NX bit bit issue when attempting a system call. Do you have some QT-based software (like, say, AutoCAD) integrated into your shell? The runtime is trying to access a protected memory area (a protected memory page) and run the code at that address,
and the Execute Disable bit technology (in Intel CPU) is preventing it (because some process has marked that page as protected and disabled execution of the code from that address; this is typically done to protect from code injections and buffer overflow
attacks.)
Seems like some software based on the QT runtime is trying to inject its code into Windows Explorer process, and since latter has Data Execution Prevention turned on by default (can be checked on the Details tab of your Task Manager, this causes a crash).
April 28th, 2013 8:18pm
Hi Exotic Hadron,
I have Autodesk Products.
I try to update QT Runtime.
I'll let you know
Regards.
April 28th, 2013 9:08pm
Hi Exotic Hadron,
I have Autodesk Products.
I try to update QT Runtime.
I'll let you know
Regards.
Hi,
If you're using Maya, make sure you use the modified QT runtime
called PyQT, which is downloaded at http://www.riverbankcomputing.com/static/Downloads/PyQt4/
Read here for more details on how you could build the Qt runtime for your Autodesk products:
If you're using Autodesk, I would also check to see your registry settings and probably set its options to allow the registry database to grow unlimited and remove the limit of 4 Gbytes:
http://forums.esri.com/thread.asp?t=287391&f=1148&c=93#902480
I'm quoting on this:
1) If you are receiving the "Low Registry Space" error, set the Registry Size Limit to "unlimited":
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control
Key: RegistrySizeLimit
Type: REG_DWORD
Value: 0xffffff (4294967295)
2) Reboot
Additionally, make sure to check DEP protection is enabled on your PC:
http://support.microsoft.com/kb/912923
If nothing helps you, add Autodesk software to the exclusion list and disable Data Execution Prevention (DEP) for it:
http://windows.microsoft.com/en-US/windows-vista/Change-Data-Execution-Prevention-settings
If nothing helps you, you can disable the DEP and turn off support for XD/NX bit in OS by setting the corresponding bit in the boot record.
To turn DEP/NX bit off:
1. In the elevated command prompt run:
bcdedit.exe /set {current} nx AlwaysOff
To turn DEP/NX bit off:
1. In the elevated command prompt run:
bcdedit.exe /set {current} nx AlwaysOn
You can even create a separate boot entry in the Boot Manager and be able to boot into a system configuration where DEP is turned off.
To create a new boot entry and turn off DEP for it (all commands must be executed in an elevated command prompt; hold Ctrl+Shift pressed when clicking Command prompt icon on the Start screen to open it with elevated permissions, confirm elevation when asked):
1. Copy your current boot entry (the one you used to boot into OS) to a new entry and name the new entry as "Data Execution Prevention Off". This is how you will see the new entry displayed in the Boot Manager next time you boot into Windows.
C:\Windows\system32>bcdedit /copy {current} /d "Data Execution Prevention Off"
2. Once ran, the command will return a GUID like: {8ed69d9a-4741-4307-a4f3-4a95326d4af4}
This GUID will be used as a unique identifier of a newly created boot record in the boot manager's menu. This new boot entry will hold all the settings of its master record from which it is copied (your current settings where NX bit is turned on).
3. Now modify the settings for this new boot record and execute:
C:\Windows\system32>bcdedit /set {8ed69d9a-4741-4307-a4f3-4a95326d4af4} nx AlwaysOff
NOTE: put your actual GUID returned to you after you've executed command in step 1 instead of {8ed69d9a-4741-4307-a4f3-4a95326d4af4}, the latter is fictitious and used for the sake of example
only.
4. Restart the PC; now you will have your new Data Execution Prevention Off shown to you in the Boot Manager, choose this record to start the PC without support for NX bit.
WARNING!
I HIGLY RECOMMEND YOU DO NOT DISABLE DEP PROTECTION BECAUSE DISABLING NX BIT POSES HIGH SECURITY RISKS AND OPENS WAYS FOR MALWARE TO IMPLEMENT BUFFER OVERFLOW ATTACKS ON YOUR PC.
Still if you think there is little chance you get a malware running locally on your PC, you may opt for turning DEP and run that, eh, faulty Autodesk product.
April 29th, 2013 12:57am
Thank you Exotic Hadron !!
April 29th, 2013 7:00pm
Hi, cavara,
So it did help you somehow, right? Glad to hear if it did. You are welcome.
April 29th, 2013 10:00pm
This is mine : https://skydrive.live.com/redir?resid=9F0DA8F031098F3!121
My laptop is lenovo y500 with original win 8
May 18th, 2013 8:49am
This is mine
My laptop is lenovo y500 with original win 8
Comodo Internet security causes the crash:
APPLICATION_VERIFIER_HANDLES_NULL_HANDLE (303)
NULL handle passed as parameter. A valid handle must be used.
This stop is generated if the function on the top of the stack passed a
NULL handle to system routines.
Arguments:
Arg1: 0000000000000000, Not used.
Arg2: 0000000000000000, Not used.
Arg3: 0000000000000000, Not used.
Arg4: 0000000000000000, Not used.
FAULTING_IP:
verifier!VerifierStopMessageEx+6d0
000007ff`ec8ea7fc cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007ffec8ea7fc (verifier!VerifierStopMessageEx+0x00000000000006d0)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000000734
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007ffec9039ce to 000007ffec8ea7fc
STACK_TEXT:
00000000`0103f2c0 000007ff`ec9039ce : 00000000`00000708 00000000`0103f880 00000000`09a70000 00000000`00000734 : verifier!VerifierStopMessageEx+0x6d0
00000000`0103f640 000007ff`ec904536 : 00000000`00000000 00000000`00000000 00000000`00000000 000007ff`f15563e4 : verifier!AVrfpHandleSanityChecks+0x3a
00000000`0103f690 00000001`8001fa49 : 00000000`00000000 00000000`0103f880 00000000`00000000 00000000`00000000 : verifier!AVrfpNtQueryInformationProcess+0x46
00000000`0103f6d0 00000001`8000f0fd : 00000000`08870870 00000000`00000000 000007f7`3625d2c8 00000000`00000005 : guard64!Exported+0x1e379
00000000`0103f750 000007ff`f17e0052 : 00000000`00000000 ffffffff`00000001 00000000`00000005 ffffffff`ffffffff : guard64!Exported+0xda2d
00000000`0103f7a0 00000000`00000000 : ffffffff`00000001 00000000`00000005 ffffffff`ffffffff 000007ff`00140012 : 0x000007ff`f17e0052
STACK_COMMAND: ~0s; .ecxr ; kb
FOLLOWUP_IP:
guard64!Exported+1e379
00000001`8001fa49 85c0 test eax,eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: guard64!Exported+1e379
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: guard64
IMAGE_NAME: guard64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 51766998
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_guard64.dll!Exported
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_guard64!Exported+1e379
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/6_2_9200_16433/50763312/verifier_dll/6_2_9200_16384/5010ac29/80000003/0000a7fc.htm?Retriage=1
Followup: MachineOwner
---------
0:000> lmvm guard64
start end module name
00000001`80000000 00000001`80070000 guard64 (export symbols) guard64.dll
Loaded symbol image file: guard64.dll
Image path: C:\Windows\System32\guard64.dll
Image name: guard64.dll
Timestamp: Tue Apr 23 12:59:36 2013 (51766998)
CheckSum: 0006D040
ImageSize: 00070000
File version: 6.1.14060.2807
Product version: 6.1.14060.2807
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: COMODO
ProductName: COMODO Internet Security
ProductVersion: 6, 1, 276204, 2807
FileVersion: 6, 1, 276204, 2807
FileDescription: COMODO Internet Security
LegalCopyright: 2005-2013 COMODO. All rights reserved.
May 18th, 2013 9:18am
Hi everyone, I have windows 8 pro installed on my PC. I started to have this explorer crashes around 15-20 days ago. So I wanted to give my skydrive link to my dump file. But my account needs to be verified.
Someone please verify my account.
June 30th, 2013 6:02pm
Hi everyone, I have windows 8 pro installed on my PC. I started to have this explorer crashes around 15-20 days ago. I had installed 3 file sharing applications during the past 1 month - Wuala, Dropbox and Google Drive. Before I installed these applications,
the file explorer was slow( it used to take few seconds to load the contents of folders with too many files) but it wouldn't crash. But now it crashes frequently, so I came through this thread and I read it. So I imported the registry file and uploaded the
dump file in my skydrive account-
https://skydrive.live.com/#cid=87FC245AC121EB92&id=87FC245AC121EB92%21109
Please help.
Thanks a lot.
June 30th, 2013 6:35pm
Please help.
Thanks a lot.
google drive seams to cause it. Disable the sync overlay icons in the Google Drive options.
ntdll!NtWaitForSingleObject
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
ntdll!RtlReportCriticalFailure$filt$0
ntdll!_C_specific_handler
ntdll!_GSHandlerCheck_SEH
ntdll!RtlpExecuteHandlerForException
ntdll!RtlDispatchException
ntdll!RtlRaiseException
ntdll!RtlReportCriticalFailure
ntdll!RtlpLogHeapFailure
ntdll!RtlFreeHeap
msvcr90!free
googledrivesync64!DllCanUnloadNow
shell32!CFSIconOverlayManager::_GetFileOverlayInfo
shell32!CFSIconOverlayManager::GetFileOverlayInfo
shell32!CFSFolder::_GetOverlayInfo
shell32!CKnownFoldersFolder::_GetOverlayIndex
shell32!CRegFolder::GetOverlayIndex
explorerframe!CNscOverlayTask::InternalResumeRT
explorerframe!CRunnableTask::Run
shell32!CShellTask::TT_Run
shell32!CShellTaskThread::ThreadProc
shell32!CShellTaskThread::s_ThreadProc
SHCore!ExecuteWorkItemThreadProc
ntdll!RtlpTpWorkCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
Loaded symbol image file: googledrivesync64.dll
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Timestamp: Fri Jun 07 08:55:22 2013 (51B183DA)
CheckSum: 000CAC91
ImageSize: 000C0000
File version: 1.10.4769.632
Product version: 1.10.4769.632
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Google
ProductName: Google Drive
ProductVersion: 1.10.4769.0632
FileVersion: 1.10.4769.0632
FileDescription: Google Drive shell extension
LegalCopyright: Google
June 30th, 2013 10:09pm
Thanks a lot, Andre. I have disabled the sync status icons and the file explorer seems to work fine now.
July 1st, 2013 12:21am
I have the same problem too, and here is my dmp file, http://sdrv.ms/13rvkvw
I appreciate your work. :)
July 3rd, 2013 8:21am
I have the same problem too, and here is my dmp file, http://sdrv.ms/13rvkvw
I appreciate your work. :)
a files called MenuEx.dll causes the crash.
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for SogouPY.ime -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for 360UDiskGuard64.dll -
FAULTING_IP:
MenuEx!unloaded+18385
00000001`80018385 ?? ???
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0000000180018385 (<Unloaded_MenuEx.dll>+0x0000000000018385)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000008
Parameter[1]: 0000000180018385
Attempt to execute non-executable address 0000000180018385
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000113
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=0000000180018385 rsp=000000002048fea0 rbp=0000000000000000
r8=000000002048fe68 r9=0000000000000000 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010204
<Unloaded_MenuEx.dll>+0x18385:
00000001`80018385 ?? ???
DEFAULT_BUCKET_ID: BAD_INSTRUCTION_PTR
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_PARAMETER1: 0000000000000008
EXCEPTION_PARAMETER2: 0000000180018385
WRITE_ADDRESS: 0000000180018385
FOLLOWUP_IP:
MenuEx!unloaded+18385
00000001`80018385 ?? ???
FAILED_INSTRUCTION_ADDRESS:
MenuEx!unloaded+18385
00000001`80018385 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
IP_MODULE_UNLOADED:
MenuEx!unloaded+18385
00000001`80018385 ?? ???
FAULTING_THREAD: 0000000000001158
PRIMARY_PROBLEM_CLASS: BAD_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_BAD_INSTRUCTION_PTR_SOFTWARE_NX_FAULT
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000180018385
STACK_TEXT:
<Unloaded_MenuEx.dll>+0x18385
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: menuex!unloaded+18385
IMAGE_NAME: MenuEx.dll
FAILURE_BUCKET_ID: BAD_INSTRUCTION_PTR_c0000005_MenuEx.dll!unloaded
BUCKET_ID: APPLICATION_FAULT_BAD_INSTRUCTION_PTR_SOFTWARE_NX_FAULT_UNLOADED_IP_menuex!unloaded+18385
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:bad_instruction_ptr_c0000005_menuex.dll!unloaded
FAILURE_ID_HASH: {29050b42-f687-ecb2-0087-871ffdeb7f31}
But I can't see any details about the file. Search for it on your HDD, look at the file properties and look for the manufacture. Go to site and get an updated version of the tool.
July 3rd, 2013 3:09pm
explorer crashes when copy a file over the explorer
please can you analyze my files?
https://www.dropbox.com/sh/771aae1mgzbmiul/mq2uFVaZ9X
dave
July 5th, 2013 7:44am
explorer crashes when copy a file over the explorer
please can you analyze my files?
https://www.dropbox.com/sh/771aae1mgzbmiul/mq2uFVaZ9X
dave
Hi Dave,
I don't like that Mpk64.dll library that is popping up here and there in your Windows Blue 8.3 dumps.
I would recommend scanning your PC for malware, at least I'd do that for %appdata% and %systemroot%. Free tool
from Kaspersky would do the trick. Or you could use any antimalware tool of your like.
Google traces this library to the KGB keyboard tracer/keylogger that spies for everything you type. Running a quick scan is a no big deal, so I would go and do this.
July 5th, 2013 8:57am
Hi, my explorer crashes and reloads.. what should i do? and there's no dmp files
but there is a dmp file in C:\Local dump Files
July 7th, 2013 7:47am
Hi, my explorer crashes and reloads.. what should i do? and there's no dmp files
but there is a dmp file in C:\Local dump Files
-
Edited by
dave0819
Sunday, July 07, 2013 12:03 PM
my reply is cut
July 7th, 2013 11:42am
have you imported the .reg file?
July 7th, 2013 3:15pm
yes, i tried to import the .reg file. and it still crashes and reloads..
July 8th, 2013 1:21am
yes, i tried to import the .reg file. and it still crashes and reloads..
which one? The first? Also make sure the Windows Error reporting Service runs. This Service is needed to generate dumps.
July 8th, 2013 2:14am
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full.reg
this is the .reg file that i used. and the Windows Error reporting Service is running
July 8th, 2013 2:27am
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full.reg
this is the .reg file that i used. and the Windows Error reporting Service is running
this is the correct file. Open the file with Notepad to see which values it sets, open regedit.exe and navigate to the keys. Are the entries correctly imported?
July 8th, 2013 2:44am
hi andre, i found this .dmp file in C:\local dump files https://skydrive.live.com/#cid=A5E572BF5C5325A5&id=A5E572BF5C5325A5%21103
July 8th, 2013 2:46am
yes, it is correctly imported.
July 8th, 2013 4:36am
Hi,
Same problem here for some reason. Tried to view the debug information myself, but I don't understand how to use it.
https://drive.google.com/folderview?id=0ByKen41yqyXeRDJMTnYxbzl6bkk&usp=sharing
Thanks in advance!
July 8th, 2013 4:50am
hi andre, i found this .dmp file in C:\local dump files https://skydrive.live.com/#cid=A5E572BF5C5325A5&id=A5E572BF5C5325A5%21103
-
Edited by
dave0819
Monday, July 08, 2013 6:46 AM
it is wrong
July 8th, 2013 6:41am
hi andre, i found this .dmp file in C:\local dump files
https://skydrive.live.com/#cid=A5E572BF5C5325A5&id=A5E572BF5C5325A5%21103
ok, I got the dump. Looks like the OverlayIcons from the MS SkyDrive app causes it. use ShellExView to disable the sync icons.
APPLICATION_VERIFIER_LOCKS_LOCK_IN_FREED_HEAP (202)
Freeing heap block containing an active critical section.
This stop is generated if a heap allocation contains a critical section,
the allocation is freed and the critical section has not been deleted.
To debug this stop use the following debugger commands:
$ !cs -s parameter1 - dump information about this critical section.
$ ln parameter1 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter2 - to dump the stack trace for this critical section initialization.
$ parameter3 and parameter4 might help understand where this heap block was
allocated (the size of the allocation is probably significant).
Arguments:
Arg1: 07c4a724, Critical section address. Run !cs -s <address> to get more information.
Arg2: 008365b4, Critical section initialization stack trace. Run dps <address> to dump the stack trace.
Arg3: 07c4a6f0, Heap block address.
Arg4: 0000004c, Heap block size.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL -
FAULTING_IP:
verifier!VerifierStopMessageEx+701
7401c121 cc int 3
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7401c121 (verifier!VerifierStopMessageEx+0x00000701)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 86641d40
Parameter[2]: 0500b670
CONTEXT: 00000000 -- (.cxr 0x0;r)
eax=00000000 ebx=04fc0000 ecx=00000400 edx=00000000 esi=00000000 edi=00000000
eip=77ce6954 esp=09b1e5ac ebp=09b1e658 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!KiFastSystemCallRet:
77ce6954 c3 ret
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
CRITICAL_SECTION: 07c4a724 -- (!cs -s 07c4a724)
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 86641d40
EXCEPTION_PARAMETER3: 0500b670
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
FAULTING_THREAD: 00001504
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 74026598 to 7401c121
STACK_TEXT:
09b1ecec 74026598 74035488 00000202 07c4a724 verifier!VerifierStopMessageEx+0x701
09b1ed18 74024531 00000000 0000004c 00000000 verifier!AVrfpFreeMemLockChecks+0xc5
09b1ed38 7402ef52 00000000 0000004c 00000000 verifier!AVrfpFreeMemNotify+0x2a
09b1ed50 77dafffa 07c4a6f0 0000004c 07950000 verifier!AVrfpNtdllHeapFreeCallback+0x15
09b1ed70 740186ee 07c4a6f0 0000004c 07c40000 ntdll!AVrfInternalHeapFreeNotification+0x4a
09b1ed9c 77d66c8e 07950000 77d2c0fa 74044600 verifier!AVrfDebugPageHeapDestroy+0x16e
09b1edb0 7402f026 07950000 00000000 00000000 ntdll!RtlDestroyHeap+0x74
09b1edc4 753e2c7c 07950000 09b1ee08 6a17cd87 verifier!AVrfpRtlDestroyHeap+0x33
09b1edd0 6a17cd87 07950000 6a17a985 478c855a KERNELBASE!HeapDestroy+0xe
WARNING: Stack unwind information not available. Following frames may be wrong.
09b1ee08 6a17aacc 6a160000 00000000 00000000 MediaIconsOverlays!DllUnregisterServer+0x8f26
09b1ee48 6a17ab37 6a160000 09b1eea8 740252f1 MediaIconsOverlays!DllUnregisterServer+0x6c6b
09b1ee54 740252f1 6a160000 00000000 00000000 MediaIconsOverlays!DllUnregisterServer+0x6cd6
09b1eea8 77ceed9a 6a160000 00000000 00000000 verifier!AVrfpStandardDllEntryPointRoutine+0x9f
09b1eec8 77ceee10 74025252 6a160000 00000000 ntdll!LdrxCallInitRoutine+0x16
09b1ef10 77d2b996 74025252 6a160000 00000000 ntdll!LdrpCallInitRoutine+0x63
09b1ef7c 77d2b746 08181798 081f7750 08181798 ntdll!LdrpProcessDetachNode+0x10f
09b1efb8 77cf56e1 08181798 573b2e4f 081f7750 ntdll!LdrpUnloadNode+0x51
09b1eff0 77cf1b15 01181798 573b3187 77cf19c1 ntdll!LdrpDecrementNodeLoadCount+0x17d
09b1f038 7402573f 6a160000 09b1f638 06f254a2 ntdll!LdrUnloadDll+0x12b
09b1f04c 753dce33 6a160000 00000001 09b1f068 verifier!AVrfpLdrUnloadDll+0x61
09b1f05c 75711fae 6a160000 09b1f07c 75712013 KERNELBASE!FreeLibrary+0x15
09b1f068 75712013 00000006 6a160000 00000000 combase!FreeLibraryWithLogging+0x21
09b1f07c 756df730 09b1f458 756c42f0 00000000 combase!CClassCache::CDllPathEntry::CFinishObject::Finish+0x28
09b1f650 756de8e1 55823919 00000001 09b1f6d8 combase!CClassCache::CleanUpDllsForApartment+0x2a0
09b1f6a8 756de6c6 09b1f718 74026927 00000000 combase!FinishShutdown+0x13b
09b1f6e4 756df08d 00000000 070bff88 00000000 combase!ApartmentUninitialize+0xb4
09b1f6fc 756d96ff 00000000 01906f1c 0817e468 combase!wCoUninitialize+0x163
09b1f724 7402a1e7 09b1f738 76646454 04db72e0 combase!CoUninitialize+0x9d
09b1f72c 76646454 04db72e0 09b1f748 760e3678 verifier!AVrfpCoUninitialize+0x17
09b1f738 760e3678 0817e468 081c3d48 09b1f888 shell32!CShellTaskThread::s_ThreadProc+0x30
09b1f748 77d28ab2 04db72e0 573b3937 0188be10 SHCore!ExecuteWorkItemThreadProc+0x10
09b1f888 77cea35e 09b1f8d8 081c3d48 573b3ba7 ntdll!RtlpTpWorkCallback+0x27f
09b1fa18 75ed173e 0188be10 09b1fa68 77d068f1 ntdll!TppWorkerThread+0x538
09b1fa24 77d068f1 0188be10 573b3bd7 00000000 kernel32!BaseThreadInitThunk+0xe
09b1fa68 77d0689d ffffffff 77d95ae2 00000000 ntdll!__RtlUserThreadStart+0x4a
09b1fa78 00000000 77d0704d 0188be10 00000000 ntdll!_RtlUserThreadStart+0x1c
FOLLOWUP_IP:
MediaIconsOverlays!DllUnregisterServer+8f26
6a17cd87 83253840196a00 and dword ptr [MediaIconsOverlays!DllUnregisterServer+0x201d7 (6a194038)],0
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: mediaiconsoverlays!DllUnregisterServer+8f26
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: MediaIconsOverlays
IMAGE_NAME: MediaIconsOverlays.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5180006a
STACK_COMMAND: ~35s; .ecxr ; kb
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_MediaIconsOverlays.dll!DllUnregisterServer
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_mediaiconsoverlays!DllUnregisterServer+8f26
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_mediaiconsoverlays.dll!dllunregisterserver
FAILURE_ID_HASH: {5c7ce48a-f647-b9dc-5aab-cb3d581bdccf}
Followup: MachineOwner
---------
0:035> lmvm MediaIconsOverlays
start end module name
6a160000 6a19b000 MediaIconsOverlays (export symbols) MediaIconsOverlays.dll
Loaded symbol image file: MediaIconsOverlays.dll
Image path: C:\ProgramData\Microsoft\Media Tools\MediaIconsOverlays.dll
Image name: MediaIconsOverlays.dll
Timestamp: Tue Apr 30 19:33:30 2013 (5180006A)
CheckSum: 000411AD
ImageSize: 0003B000
File version: 1.0.0.1
Product version: 1.0.0.1
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: Microsoft
ProductName: Online files icon's overlay
ProductVersion: 1.0.2.3
FileVersion: 1.0.2.5
FileDescription: Online files icon's overlay
LegalCopyright: Microsoft
LegalTrademarks: Microsoft
Comments: Online files icon's overlay
July 8th, 2013 3:41pm
Hi,
Same problem here for some reason. Tried to view the debug information myself, but I don't understand how to use it.
https://drive.google.com/folderview?id=0ByKen41yqyXeRDJMTnYxbzl6bkk&usp=sharing
Thanks in advance!
this Apple DLL crashes your Explorer: ShellStreams64.dll
APPLICATION_VERIFIER_HANDLES_NULL_HANDLE (303)
NULL handle passed as parameter. A valid handle must be used.
This stop is generated if the function on the top of the stack passed a
NULL handle to system routines.
Arguments:
Arg1: 0000000000000000, Not used.
Arg2: 0000000000000000, Not used.
Arg3: 0000000000000000, Not used.
Arg4: 0000000000000000, Not used.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ClassicStartMenuDLL.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL -
FAULTING_IP:
verifier!VerifierStopMessageEx+6d0
000007fd`8551a7fc cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fd8551a7fc (verifier!VerifierStopMessageEx+0x00000000000006d0)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000000ab8
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007fd855339ce to 000007fd8551a7fc
STACK_TEXT:
00 ntdll!NtWaitForSingleObject
01 ntdll!RtlReportExceptionEx
02 ntdll!RtlReportException
03 verifier!AVrfpVectoredExceptionHandler
04 ntdll!RtlpCallVectoredHandlers
05 ntdll!RtlDispatchException
06 ntdll!KiUserExceptionDispatch
07 verifier!VerifierStopMessageEx
08 verifier!AVrfpHandleSanityChecks
09 verifier!AVrfpNtSetEvent
0a KERNELBASE!SetEvent
0b ShellStreams64!DllCanUnloadNow
0c ShellStreams64
0d ShellStreams64
0e shell32!CRegFolder::_CreateCachedRegFolder
0f shell32!CRegFolder::BindToObject
10 shell32!CShellItem::BindToHandler
11 shell32!CShellItem::_GetPropertyStoreWorker
12 shell32!CShellItem::GetPropertyStoreForKeys
13 shell32!CShellItem::GetProperty
14 explorerframe!CNscEnumTask::InternalResumeRT
15 explorerframe!CRunnableTask::Run
16 shell32!CShellTask::TT_Run
17 shell32!CShellTaskThread::ThreadProc
18 shell32!CShellTaskThread::s_ThreadProc
19 SHCore!ExecuteWorkItemThreadProc
1a ntdll!RtlpTpWorkCallback
1b ntdll!TppWorkerThread
1c kernel32!BaseThreadInitThunk
1d ntdll!RtlUserThreadStart
0x0000000013ead738 : 0x0000000013eade50 : 0x000007fd8551a7fc : verifier!VerifierStopMessageEx+0x6d0
0x0000000013ead758 : 0x000007fd9a43dfe0 : ntdll!RtlpWalkFrameChain+0xed7
0x0000000013ead768 : 0x0000000013ead7b0 : 0x000007fd9a400000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x0000000013ead7b0 : 0x000007fd9a400000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x0000000013ead7f0 : 0x000007fd9a45d609 : ntdll!RtlUserThreadStart+0x1d
0x0000000013ead8b8 : 0x000007fd9a404bba : ntdll!KiUserExceptionDispatch+0x2e
0x0000000013ead8d0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013ead950 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013ead958 : 0x0000000013eadfd0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013ead980 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013ead9b8 : 0x000007fd8551a7fc : verifier!VerifierStopMessageEx+0x6d0
0x0000000013eada60 : 0x000007fd9a400000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x0000000013eadbc8 : 0x000007fd9a44e511 : ntdll!vsnprintf+0x11
0x0000000013eadbd8 : 0x000007fd9a485722 : ntdll!vsnprintf_l+0x98
0x0000000013eadbe8 : 0x000007fd9a44e767 : ntdll!write_string+0x48
0x0000000013eadbf0 : 0x0000000013eadfe8 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013eadc08 : 0x000007fd9a4c93bc : ntdll!RtlStringVPrintfWorkerA+0x20
0x0000000013eadc18 : 0x0000000013eadc60 : !da ""..=======================================.VERIFIER STOP 0000000000000303: pid 0x...""
0x0000000013eadc38 : 0x000007fd9a41ad81 : ntdll!vDbgPrintExWithPrefixInternal+0x89
0x0000000013eadc60 : 0x3d3d3d3d3d3d0a0a : !da ""..=======================================.VERIFIER STOP 0000000000000303: pid 0x...""
0x0000000013eadc68 : 0x3d3d3d3d3d3d3d3d : !da ""=================================.VERIFIER STOP 0000000000000303: pid 0x1D0: NUL...""
0x0000000013eadc70 : 0x3d3d3d3d3d3d3d3d : !da ""=========================.VERIFIER STOP 0000000000000303: pid 0x1D0: NULL handle...""
0x0000000013eadc78 : 0x3d3d3d3d3d3d3d3d : !da ""=================.VERIFIER STOP 0000000000000303: pid 0x1D0: NULL handle passed ...""
0x0000000013eadc80 : 0x3d3d3d3d3d3d3d3d : !da ""=========.VERIFIER STOP 0000000000000303: pid 0x1D0: NULL handle passed as param...""
0x0000000013eadc88 : 0x4946495245560a3d : !da ""=.VERIFIER STOP 0000000000000303: pid 0x1D0: NULL handle passed as parameter. A ...""
0x0000000013eadc90 : 0x20504f5453205245 : !da ""ER STOP 0000000000000303: pid 0x1D0: NULL handle passed as parameter. A valid ha...""
0x0000000013eadc98 : 0x3030303030303030 : !da ""0000000000000303: pid 0x1D0: NULL handle passed as parameter. A valid handle mus...""
0x0000000013eadca0 : 0x3330333030303030 : !da ""00000303: pid 0x1D0: NULL handle passed as parameter. A valid handle must be use...""
0x0000000013eadca8 : 0x783020646970203a : !da "": pid 0x1D0: NULL handle passed as parameter. A valid handle must be used. ...00...""
0x0000000013eadcb0 : 0x4c554e203a304431 : !da ""1D0: NULL handle passed as parameter. A valid handle must be used. ...0000000000...""
0x0000000013eadcb8 : 0x656c646e6168204c : !da ""L handle passed as parameter. A valid handle must be used. ...0000000000000000 :...""
0x0000000013eadcc0 : 0x2064657373617020 : !da "" passed as parameter. A valid handle must be used. ...0000000000000000 : Not use...""
0x0000000013eadcc8 : 0x6d61726170207361 : !da ""as parameter. A valid handle must be used. ...0000000000000000 : Not used...0000...""
0x0000000013eadcd0 : 0x2041202e72657465 : !da ""eter. A valid handle must be used. ...0000000000000000 : Not used...000000000000...""
0x0000000013eadcd8 : 0x61682064696c6176 : !da ""valid handle must be used. ...0000000000000000 : Not used...0000000000000000 : N...""
0x0000000013eadce0 : 0x73756d20656c646e : !da ""ndle must be used. ...0000000000000000 : Not used...0000000000000000 : Not used....""
0x0000000013eadce8 : 0x6573752065622074 : !da ""t be used. ...0000000000000000 : Not used...0000000000000000 : Not used...000000...""
0x0000000013eadcf0 : 0x3030090a0a202e64 : !da ""d. ...0000000000000000 : Not used...0000000000000000 : Not used...00000000000000...""
0x0000000013eadcf8 : 0x3030303030303030 : !da ""00000000000000 : Not used...0000000000000000 : Not used...0000000000000000 : Not...""
0x0000000013eadd00 : 0x3a20303030303030 : !da ""000000 : Not used...0000000000000000 : Not used...0000000000000000 : Not used......""
0x0000000013eadd08 : 0x65737520746f4e20 : !da "" Not used...0000000000000000 : Not used...0000000000000000 : Not used...00000000...""
0x0000000013eadd10 : 0x30303030090a2e64 : !da ""d...0000000000000000 : Not used...0000000000000000 : Not used...0000000000000000...""
0x0000000013eadd18 : 0x3030303030303030 : !da ""000000000000 : Not used...0000000000000000 : Not used...0000000000000000 : Not u...""
0x0000000013eadd20 : 0x4e203a2030303030 : !da ""0000 : Not used...0000000000000000 : Not used...0000000000000000 : Not used....=...""
0x0000000013eadd28 : 0x2e6465737520746f : !da ""ot used...0000000000000000 : Not used...0000000000000000 : Not used....=""
0x0000000013eadd30 : 0x303030303030090a : !da ""..0000000000000000 : Not used...0000000000000000 : Not used....=""
0x0000000013eadd38 : 0x3030303030303030 : !da ""0000000000 : Not used...0000000000000000 : Not used....=""
0x0000000013eadd40 : 0x746f4e203a203030 : !da ""00 : Not used...0000000000000000 : Not used....=""
0x0000000013eadd48 : 0x090a2e6465737520 : !da "" used...0000000000000000 : Not used....=""
0x0000000013eadd50 : 0x3030303030303030 : !da ""0000000000000000 : Not used....=""
0x0000000013eadd58 : 0x3030303030303030 : !da ""00000000 : Not used....=""
0x0000000013eadd60 : 0x7520746f4e203a20 : !da "" : Not used....=""
0x0000000013eadd68 : 0x3d0a0a0a2e646573 : !da "sed....="
0x0000000013eadda8 : 0x6e6f632073692070 : !da ""p is con""
0x0000000013eaddc0 : 0x000007fd8551a7fc : verifier!VerifierStopMessageEx+0x6d0
0x0000000013eade48 : 0x6573752074692067 : !da ""g it use""
0x0000000013eade50 : 0x000007fd8551a7fc : verifier!VerifierStopMessageEx+0x6d0
0x0000000013eade68 : 0x0000000013eadfd0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadec8 : 0x0000000013eadc60 : !da ""..=======================================.VERIFIER STOP 0000000000000303: pid 0x...""
0x0000000013eaded8 : 0x000007fd9a44e57f : ntdll!vsnprintf_l+0x75
0x0000000013eadf08 : 0x000007fd8553a940 : verifier!VfProviderHandlesLayerDescriptor
0x0000000013eadf10 : 0x000007fd8555568d : verifier!VrfDbgOutputBuffer+0x1ad
0x0000000013eadf20 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013eadf30 : 0x000007fd8554fb78 : verifier!AVrfpLogEntryMessageEx+0x258
0x0000000013eadf48 : 0x000007fd9a44e511 : ntdll!vsnprintf+0x11
0x0000000013eadf78 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadf88 : 0x000007fd9a4407a4 : ntdll!DbgPrintEx+0x30
0x0000000013eadf90 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadfb0 : 0x0000000013eadfe8 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013eadfc0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadfc8 : 0x000007fd8551a7e7 : verifier!VerifierStopMessageEx+0x6bb
0x0000000013eadfd0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadfe8 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013eadff8 : 0x0000000004153df0 : !du ""NULL handle passed as parameter. A valid handle must be used.""
0x0000000013eae008 : 0x0000000004153ee0 : !du ""Not used.""
0x0000000013eae018 : 0x0000000004153f70 : !du ""Not used.""
0x0000000013eae028 : 0x0000000004154010 : !du ""Not used.""
0x0000000013eae038 : 0x00000000041540a0 : !du ""Not used.""
0x0000000013eae040 : 0x000007fd8554fb78 : verifier!AVrfpLogEntryMessageEx+0x258
0x0000000013eae048 : 0x0000000004183820 : !du ""This verifier stop is continuable..After debugging it use `go' to continue..""
0x0000000013eae098 : 0x0000000004183820 : !du ""This verifier stop is continuable..After debugging it use `go' to continue..""
0x0000000013eae0a0 : 0x000007fd8555568d : verifier!VrfDbgOutputBuffer+0x1ad
0x0000000013eae0b8 : 0x000007fd8554fb78 : verifier!AVrfpLogEntryMessageEx+0x258
0x0000000013eae100 : 0x000007fd8553205c : verifier!AVrfpHeapFree+0xf4
0x0000000013eae118 : 0x000007fd85515f90 : verifier!AVrfSetHeapPathCaller+0xc
0x0000000013eae138 : 0x000007fd9a4054c0 : ntdll!RtlFreeHeap
0x0000000013eae148 : 0x000007fd855305fc : verifier!AVrfpLeaveHeapCall+0x14
0x0000000013eae150 : 0x000007fd994e1330 : kernel32!HeapFreeStub
0x0000000013eae168 : 0x000007fd9a4eddee : ntdll!RtlpValidateHeap+0x32
0x0000000013eae1a8 : 0x000007fd855261fc : verifier!AVrfpIncrementOwnedCriticalSections+0x30
0x0000000013eae1b8 : 0x000007fd85525394 : verifier!AVrfpVerifyInitializedCriticalSection+0xfc
0x0000000013eae1f8 : 0x000007fd9a4ef051 : ntdll!RtlDebugSizeHeap+0x119
0x0000000013eae228 : 0x000007fd8552c6e6 : verifier!AVrfpSRWLockFreeMemoryChecks+0x16a
0x0000000013eae280 : 0x0000000013eae298 : 0x000007fd8551873d : verifier!AVrfDebugPageHeapSize+0x89
0x0000000013eae298 : 0x000007fd8551873d : verifier!AVrfDebugPageHeapSize+0x89
0x0000000013eae2a8 : 0x0000000002048ba8 : 0x000007fd985405f4 : shell32!CUserFilesDescriptionEnum::Next+0x3c
0x0000000013eae2c8 : 0x000007fd9a43e915 : ntdll!RtlWalkFrameChain+0x29
0x0000000013eae2f8 : 0x000007fd9a43e8a8 : ntdll!RtlCaptureStackBackTrace+0x44
0x0000000013eae340 : 0x000007fd9a402cc0 : ntdll!NtSetEvent
0x0000000013eae348 : 0x000007fd855339ce : verifier!AVrfpHandleSanityChecks+0x3a
0x0000000013eae350 : 0x000007fd9a4054c0 : ntdll!RtlFreeHeap
0x0000000013eae398 : 0x000007fd85533d58 : verifier!AVrfpNtSetEvent+0x34
0x0000000013eae3b0 : 0x000007fd99d41172 : combase!CoTaskMemFree+0x36
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ShellStreams64.dll -
0x0000000013eae3c8 : 0x000007fd9749152c : KERNELBASE!SetEvent+0xc
0x0000000013eae3e8 : 0x000007fd9a4054c0 : ntdll!RtlFreeHeap
0x0000000013eae3f8 : 0x0000000180013241 : ShellStreams64!DllCanUnloadNow+0x541
Loaded symbol image file: ShellStreams64.dll
Image path: C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
Image name: ShellStreams64.dll
Browse all global symbols functions data
Timestamp: Tue Dec 18 01:38:54 2012
July 8th, 2013 3:58pm
this Apple DLL crashes your Explorer: ShellStreams64.dll
Thanks for the help!
July 8th, 2013 5:41pm
hi andre, i found this .dmp file in C:\local dump files https://skydrive.live.com/#cid=A5E572BF5C5325A5&id=A5E572BF5C5325A5%21103
ok, I got the dump. Looks like the OverlayIcons from the MS SkyDrive app causes it. use ShellExView to disable the sync icons.
APPLICATION_VERIFIER_LOCKS_LOCK_IN_FREED_HEAP (202)
Freeing heap block containing an active critical section.
This stop is generated if a heap allocation contains a critical section,
the allocation is freed and the critical section has not been deleted.
To debug this stop use the following debugger commands:
$ !cs -s parameter1 - dump information about this critical section.
$ ln parameter1 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter2 - to dump the stack trace for this critical section initialization.
$ parameter3 and parameter4 might help understand where this heap block was
allocated (the size of the allocation is probably significant).
Arguments:
Arg1: 07c4a724, Critical section address. Run !cs -s <address> to get more information.
Arg2: 008365b4, Critical section initialization stack trace. Run dps <address> to dump the stack trace.
Arg3: 07c4a6f0, Heap block address.
Arg4: 0000004c, Heap block size.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL -
FAULTING_IP:
verifier!VerifierStopMessageEx+701
7401c121 cc int 3
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7401c121 (verifier!VerifierStopMessageEx+0x00000701)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 86641d40
Parameter[2]: 0500b670
CONTEXT: 00000000 -- (.cxr 0x0;r)
eax=00000000 ebx=04fc0000 ecx=00000400 edx=00000000 esi=00000000 edi=00000000
eip=77ce6954 esp=09b1e5ac ebp=09b1e658 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!KiFastSystemCallRet:
77ce6954 c3 ret
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
CRITICAL_SECTION: 07c4a724 -- (!cs -s 07c4a724)
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 86641d40
EXCEPTION_PARAMETER3: 0500b670
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
FAULTING_THREAD: 00001504
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 74026598 to 7401c121
STACK_TEXT:
09b1ecec 74026598 74035488 00000202 07c4a724 verifier!VerifierStopMessageEx+0x701
09b1ed18 74024531 00000000 0000004c 00000000 verifier!AVrfpFreeMemLockChecks+0xc5
09b1ed38 7402ef52 00000000 0000004c 00000000 verifier!AVrfpFreeMemNotify+0x2a
09b1ed50 77dafffa 07c4a6f0 0000004c 07950000 verifier!AVrfpNtdllHeapFreeCallback+0x15
09b1ed70 740186ee 07c4a6f0 0000004c 07c40000 ntdll!AVrfInternalHeapFreeNotification+0x4a
09b1ed9c 77d66c8e 07950000 77d2c0fa 74044600 verifier!AVrfDebugPageHeapDestroy+0x16e
09b1edb0 7402f026 07950000 00000000 00000000 ntdll!RtlDestroyHeap+0x74
09b1edc4 753e2c7c 07950000 09b1ee08 6a17cd87 verifier!AVrfpRtlDestroyHeap+0x33
09b1edd0 6a17cd87 07950000 6a17a985 478c855a KERNELBASE!HeapDestroy+0xe
WARNING: Stack unwind information not available. Following frames may be wrong.
09b1ee08 6a17aacc 6a160000 00000000 00000000 MediaIconsOverlays!DllUnregisterServer+0x8f26
09b1ee48 6a17ab37 6a160000 09b1eea8 740252f1 MediaIconsOverlays!DllUnregisterServer+0x6c6b
09b1ee54 740252f1 6a160000 00000000 00000000 MediaIconsOverlays!DllUnregisterServer+0x6cd6
09b1eea8 77ceed9a 6a160000 00000000 00000000 verifier!AVrfpStandardDllEntryPointRoutine+0x9f
09b1eec8 77ceee10 74025252 6a160000 00000000 ntdll!LdrxCallInitRoutine+0x16
09b1ef10 77d2b996 74025252 6a160000 00000000 ntdll!LdrpCallInitRoutine+0x63
09b1ef7c 77d2b746 08181798 081f7750 08181798 ntdll!LdrpProcessDetachNode+0x10f
09b1efb8 77cf56e1 08181798 573b2e4f 081f7750 ntdll!LdrpUnloadNode+0x51
09b1eff0 77cf1b15 01181798 573b3187 77cf19c1 ntdll!LdrpDecrementNodeLoadCount+0x17d
09b1f038 7402573f 6a160000 09b1f638 06f254a2 ntdll!LdrUnloadDll+0x12b
09b1f04c 753dce33 6a160000 00000001 09b1f068 verifier!AVrfpLdrUnloadDll+0x61
09b1f05c 75711fae 6a160000 09b1f07c 75712013 KERNELBASE!FreeLibrary+0x15
09b1f068 75712013 00000006 6a160000 00000000 combase!FreeLibraryWithLogging+0x21
09b1f07c 756df730 09b1f458 756c42f0 00000000 combase!CClassCache::CDllPathEntry::CFinishObject::Finish+0x28
09b1f650 756de8e1 55823919 00000001 09b1f6d8 combase!CClassCache::CleanUpDllsForApartment+0x2a0
09b1f6a8 756de6c6 09b1f718 74026927 00000000 combase!FinishShutdown+0x13b
09b1f6e4 756df08d 00000000 070bff88 00000000 combase!ApartmentUninitialize+0xb4
09b1f6fc 756d96ff 00000000 01906f1c 0817e468 combase!wCoUninitialize+0x163
09b1f724 7402a1e7 09b1f738 76646454 04db72e0 combase!CoUninitialize+0x9d
09b1f72c 76646454 04db72e0 09b1f748 760e3678 verifier!AVrfpCoUninitialize+0x17
09b1f738 760e3678 0817e468 081c3d48 09b1f888 shell32!CShellTaskThread::s_ThreadProc+0x30
09b1f748 77d28ab2 04db72e0 573b3937 0188be10 SHCore!ExecuteWorkItemThreadProc+0x10
09b1f888 77cea35e 09b1f8d8 081c3d48 573b3ba7 ntdll!RtlpTpWorkCallback+0x27f
09b1fa18 75ed173e 0188be10 09b1fa68 77d068f1 ntdll!TppWorkerThread+0x538
09b1fa24 77d068f1 0188be10 573b3bd7 00000000 kernel32!BaseThreadInitThunk+0xe
09b1fa68 77d0689d ffffffff 77d95ae2 00000000 ntdll!__RtlUserThreadStart+0x4a
09b1fa78 00000000 77d0704d 0188be10 00000000 ntdll!_RtlUserThreadStart+0x1c
FOLLOWUP_IP:
MediaIconsOverlays!DllUnregisterServer+8f26
6a17cd87 83253840196a00 and dword ptr [MediaIconsOverlays!DllUnregisterServer+0x201d7 (6a194038)],0
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: mediaiconsoverlays!DllUnregisterServer+8f26
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: MediaIconsOverlays
IMAGE_NAME: MediaIconsOverlays.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5180006a
STACK_COMMAND: ~35s; .ecxr ; kb
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_MediaIconsOverlays.dll!DllUnregisterServer
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_mediaiconsoverlays!DllUnregisterServer+8f26
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_mediaiconsoverlays.dll!dllunregisterserver
FAILURE_ID_HASH: {5c7ce48a-f647-b9dc-5aab-cb3d581bdccf}
Followup: MachineOwner
---------
0:035> lmvm MediaIconsOverlays
start end module name
6a160000 6a19b000 MediaIconsOverlays (export symbols) MediaIconsOverlays.dll
Loaded symbol image file: MediaIconsOverlays.dll
Image path: C:\ProgramData\Microsoft\Media Tools\MediaIconsOverlays.dll
Image name: MediaIconsOverlays.dll
Timestamp: Tue Apr 30 19:33:30 2013 (5180006A)
CheckSum: 000411AD
ImageSize: 0003B000
File version: 1.0.0.1
Product version: 1.0.0.1
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: Microsoft
ProductName: Online files icon's overlay
ProductVersion: 1.0.2.3
FileVersion: 1.0.2.5
FileDescription: Online files icon's overlay
LegalCopyright: Microsoft
LegalTrademarks: Microsoft
Comments: Online files icon's overlay
July 9th, 2013 2:37am
i uninstalled skydrive but the problem still exist....
upload the new dumps
July 9th, 2013 3:12am
i dont know which .dmp file to choose because every minute its crashing
this is in my event viewer
Faulting application name: explorer.exe, version: 6.2.9200.16433, time stamp: 0x50763130
Faulting module name: verifier.dll, version: 6.2.9200.16384, time stamp: 0x5010ae19
Exception code: 0x80000003
Fault offset: 0x0000c121
Faulting process id: 0xf50
Faulting application start time: 0x01ce7c8b0464b1bc
Faulting application path: C:\WINDOWS\explorer.exe
Faulting module path: C:\WINDOWS\system32\verifier.dll
Report Id: 83641f3c-e87e-11e2-afbb-047d7b56f9ae
Faulting package full name:
Faulting package-relative application ID:
July 9th, 2013 5:25am
is there any way to makethe zip smaller files because each dump is 200 mb and above
July 9th, 2013 7:09am
is there any way to makethe zip smaller files because each dump is 200 mb and above
you can use 7z file Format (LZMA2 and ULTRA compression ratio). This reduces the size more compared to zip.
July 9th, 2013 7:46am
i dont know which .dmp file to choose because every minute its crashing
this is in my event viewer
Faulting application name: explorer.exe, version: 6.2.9200.16433, time stamp: 0x50763130
Faulting module name: verifier.dll, version: 6.2.9200.16384, time stamp: 0x5010ae19
Exception code: 0x80000003
Fault offset: 0x0000c121
Faulting process id: 0xf50
Faulting application start time: 0x01ce7c8b0464b1bc
Faulting application path: C:\WINDOWS\explorer.exe
Faulting module path: C:\WINDOWS\system32\verifier.dll
Report Id: 83641f3c-e87e-11e2-afbb-047d7b56f9ae
Faulting package full name:
Faulting package-relative application ID:
-
Edited by
dave0819
Tuesday, July 09, 2013 10:07 AM
it is not complete
July 9th, 2013 9:21am
I am having the exact same problem. I added the dump creator registry edit, and this by itself (!?) made the problem even worse, for no sooner Explorer would start than it would crash again! I uninstalled the dump creator and zipped the last five .dmp files
into a single zip file, which you can access at
https://skydrive.live.com/redir?resid=1F5A053A208BFF69!728&authkey=!AEowqWxKPSdllcY
Thank you very much in advance for your help!
July 12th, 2013 1:05pm
I uninstalled the dump creator and zipped the last five .dmp files into a single zip file, which you can access at
https://skydrive.live.com/redir?resid=1F5A053A208BFF69!728&authkey=!AEowqWxKPSdllcY
Thank you very much in advance for your help!
the 3D Shellextension from nVIDIA causes the crashes:
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
APPLICATION_VERIFIER_LOCKS_LOCK_IN_UNLOADED_DLL (201)
Unloading DLL containing an active critical section.
This stop is generated if a DLL has a global variable containing a critical section
and the DLL is unloaded but the critical section has not been deleted. To debug
this stop use the following debugger commands:
$ du parameter3 - to dump the name of the culprit DLL.
$ .reload dllname or .reload dllname = parameter4 - to reload the symbols for that DLL.
$ !cs -s parameter1 - dump information about this critical section.
$ ln parameter1 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter2 - to dump the stack trace for this critical section initialization.
Arguments:
Arg1: 000007fc3a8c4db0, Critical section address. Run !cs -s <address> to get more information.
Arg2: 0000000000d73f30, Critical section initialization stack trace. Run dps <address> to dump the stack trace.
Arg3: 00000000176fd8f8, DLL name address.
Arg4: 000007fc3a7d0000, DLL base address.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fc4301a7fc (verifier!VerifierStopMessageEx+0x00000000000006d0)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
CRITICAL_SECTION: 000007fc3a8c4db0 -- (!cs -s 000007fc3a8c4db0)
IMAGE_NAME: nv3dappshext.dll
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
FAULTING_THREAD: ffffffffffffffff
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
STACK_TEXT:
00000000`00000000 00000000`00000000 nv3dappshext.dll!Unknown+0x0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nv3dappshext.dll!Unknown
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nv3dappshext
DEBUG_FLR_IMAGE_TIMESTAMP: 51c41b68
STACK_COMMAND: ** Pseudo Context ** ; kb
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_nv3dappshext.dll!Unknown
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_nv3dappshext.dll!unknown
FAILURE_ID_HASH: {3725e68e-35d6-912a-5613-c20eefdd7ebf}
Followup: MachineOwner
---------
0:059> !cs -s 000007fc3a8c4db0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for nv3dappshext.dll -
-----------------------------------------
Critical section = 0x000007fc3a8c4db0 (nv3dappshext!DllInstall+0xE9354)
DebugInfo = 0x00000000176f30f0
NOT LOCKED
LockSemaphore = 0x0
SpinCount = 0x00000000020007d0
Stack trace for DebugInfo = 0x00000000176f30f0:
0x000007fc535715d0: ntdll!RtlInitializeCriticalSectionAndSpinCount+0xEFBC0
0x000007fc43025be5: verifier!AVrfpInitializeCriticalSectionCommon+0x115
0x000007fc3a7e032c: nv3dappshext!DllInstall+0x48D0
0x000007fc3a7e0653: nv3dappshext!DllInstall+0x4BF7
0x000007fc3a7e02ce: nv3dappshext!DllInstall+0x4872
0x000007fc3a7df927: nv3dappshext!DllInstall+0x3ECB
0x000007fc3a7defb6: nv3dappshext!DllInstall+0x355A
0x000007fc516e9077: shell32!IShellExtInit_Initialize+0x47
0x000007fc516eb3ed: shell32!HDXA_QueryContextMenu+0x2DD
0x000007fc516ea56f: shell32!CDefFolderMenu::QueryContextMenu+0x41B
0x000007fc50867531: shlwapi!SHInvokeCommandOnContextMenu2+0xE5
0x000007fc5087a639: shlwapi!SHInvokeCommandWithFlagsAndSite+0xA9
0x000007f71443936a: explorer!LaunchNewInstanceWithOptionalElevate+0xE6
0x000007f71446bbb3: explorer!CTaskBand::CLauncherTask::_Launch+0x137
0x000007f71446bc37: explorer!CTaskBand::CLauncherTask::_ThreadProc+0x17
0x000007f71446eee6: explorer!CTaskBand::CLauncherTask::s_ThreadProc+0xE
0x000007fc4f3840bc: SHCore!COplockFileHandle::v_GetHandlerCLSID+0x12C
0x000007fc4303653d: verifier!AVrfpStandardThreadFunction+0x3D
0x000007fc51331832: kernel32!BaseThreadInitThunk+0x1A
0x000007fc534cd609: ntdll!RtlUserThreadStart+0x1D
0:059> dps 0000000000d73f30
00000000`00d73f30 00000000`00b07680
00000000`00d73f38 00140d55`00009801
00000000`00d73f40 000007fc`535715d0 ntdll!RtlInitializeCriticalSectionAndSpinCount+0xefbc0
00000000`00d73f48 000007fc`43025be5 verifier!AVrfpInitializeCriticalSectionCommon+0x115
00000000`00d73f50 000007fc`3a7e032c nv3dappshext!DllInstall+0x48d0
00000000`00d73f58 000007fc`3a7e0653 nv3dappshext!DllInstall+0x4bf7
00000000`00d73f60 000007fc`3a7e02ce nv3dappshext!DllInstall+0x4872
00000000`00d73f68 000007fc`3a7df927 nv3dappshext!DllInstall+0x3ecb
00000000`00d73f70 000007fc`3a7defb6 nv3dappshext!DllInstall+0x355a
00000000`00d73f78 000007fc`516e9077 shell32!IShellExtInit_Initialize+0x47
00000000`00d73f80 000007fc`516eb3ed shell32!HDXA_QueryContextMenu+0x2dd
00000000`00d73f88 000007fc`516ea56f shell32!CDefFolderMenu::QueryContextMenu+0x41b
00000000`00d73f90 000007fc`50867531 shlwapi!SHInvokeCommandOnContextMenu2+0xe5
00000000`00d73f98 000007fc`5087a639 shlwapi!SHInvokeCommandWithFlagsAndSite+0xa9
00000000`00d73fa0 000007f7`1443936a explorer!LaunchNewInstanceWithOptionalElevate+0xe6
00000000`00d73fa8 000007f7`1446bbb3 explorer!CTaskBand::CLauncherTask::_Launch+0x137
0:059> lmvm nv3dappshext
start end module name
000007fc`3a7d0000 000007fc`3a8df000 nv3dappshext (export symbols) nv3dappshext.dll
Loaded symbol image file: nv3dappshext.dll
Image path: C:\Windows\System32\nv3dappshext.dll
Image name: nv3dappshext.dll
Timestamp: Fri Jun 21 11:22:48 2013 (51C41B68)
CheckSum: 0010733B
ImageSize: 0010F000
File version: 8.17.13.2049
Product version: 8.17.13.2049
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: NVIDIA Corporation
ProductName: NVIDIA Shell Extensions
InternalName: Nv3DAppShExt.dll
OriginalFilename: Nv3DAppShExt.dll
ProductVersion: 8.17.13.2049
FileVersion: 8.17.13.2049
FileDescription: NVIDIA Shell Extensions
LegalCopyright: (C) 2013 NVIDIA Corporation. All rights reserved.
July 12th, 2013 3:53pm
Thank you very much for your prompt response! Following your posting, I removed the NVIDIA drivers from my system, and then uninstalled the NVIDIA card from the Device Manager; when prompted if I wanted to delete the driver, I responded "yes". Unfortunately,
and to my surprise, explorer is still crashing all the time, just as it did before. An example of the dump file created can be found in http://sdrv.ms/1duCOOi. Once again, many thanks for your feedback!
July 13th, 2013 12:34pm
this time you get a crash causes by Google Drive. This is a known issue. Disable the sync icons in the Google drive options, this fixes the issue.
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for googledrivesync64.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for inffv1.dll -
FAULTING_IP:
ntdll!RtlReportCriticalFailure+89
000007fd`3951bd59 eb00 jmp ntdll!RtlReportCriticalFailure+0x8b (000007fd`3951bd5b)
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fd3951bd59 (ntdll!RtlReportCriticalFailure+0x0000000000000089)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000007fd395705f0
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=0000000003b10000 rbx=0000000000000000 rcx=0000000003b10000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000003aa0000
rip=000007fd39432c2a rsp=00000000048dd8f8 rbp=00000000048de4a0
r8=0000000000000000 r9=0000000000000040 r10=0000000000000000
r11=0000000000000286 r12=0000000000000000 r13=0000000000000000
r14=0000000003aa0000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!NtWaitForSingleObject+0xa:
000007fd`39432c2a c3 ret
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_PARAMETER1: 000007fd395705f0
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
LAST_CONTROL_TRANSFER: from 000007fd39520b74 to 000007fd3951bd59
FAULTING_THREAD: ffffffffffffffff
BUGCHECK_STR: APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy
PRIMARY_PROBLEM_CLASS: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy
DEFAULT_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy
STACK_TEXT:
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
ntdll!RtlReportCriticalFailure$filt$0
ntdll!_C_specific_handler
ntdll!_GSHandlerCheck_SEH
ntdll!RtlpExecuteHandlerForException
ntdll!RtlDispatchException
ntdll!RtlRaiseException
ntdll!RtlReportCriticalFailure
ntdll!RtlpLogHeapFailure
ntdll!RtlFreeHeap
msvcr90!free
googledrivesync64!DllCanUnloadNow
shell32!CFSIconOverlayManager::_GetFileOverlayInfo
shell32!CFSIconOverlayManager::GetFileOverlayInfo
shell32!CFSFolder::_GetOverlayInfo
shell32!CIconOverlayTask::InternalResumeRT
shell32!CRunnableTask::Run
shell32!CShellTask::TT_Run
shell32!CShellTaskThread::ThreadProc
shell32!CShellTaskThread::s_ThreadProc
SHCore!ExecuteWorkItemThreadProc
ntdll!RtlpTpWorkCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
FAILURE_ID_HASH_STRING: um:actionable_heap_corruption_heap_failure_block_not_busy_c0000374_googledrivesync64.dll!dllcanunloadnow
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Timestamp: Fri Jun 07 08:55:22 2013 (51B183DA)
CheckSum: 000CAC91
ImageSize: 000C0000
File version: 1.10.4769.632
Product version: 1.10.4769.632
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Google
ProductName: Google Drive
ProductVersion: 1.10.4769.0632
FileVersion: 1.10.4769.0632
FileDescription: Google Drive shell extension
LegalCopyright: Google
July 13th, 2013 4:06pm
Yes, indeed, that did do the trick -- I was even able to reinstall the NVIDIA card and drivers without any problems, and the system is working just fine now! Thank you very much once again!
July 13th, 2013 7:02pm
I have been reading this forum trying to find why my explorer is crashing. I followed the directions and have zipped three dump files. I would really appreciate it if you could tell me what is causing it to crash.
for you google Drive is also the cause. Disable the sync icons:
0:060> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for googledrivesync64.dll -
*** WARNING: Unable to verify checksum for mscorlib.ni.dll
Cannot find frame 0xf, previous scope unchanged
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
FAULTING_IP:
ntdll!RtlReportCriticalFailure+89
000007fc`7b7dbd59 eb00 jmp ntdll!RtlReportCriticalFailure+0x8b (000007fc`7b7dbd5b)
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fc7b7dbd59 (ntdll!RtlReportCriticalFailure+0x0000000000000089)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000007fc7b8305f0
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_PARAMETER1: 000007fc7b8305f0
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0x7dc (60)
Current frame:
Child-SP RetAddr Caller, Callee
PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS
BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS
LAST_CONTROL_TRANSFER: from 000007fc7b7e0b74 to 000007fc7b7dbd59
STACK_TEXT:
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
ntdll!RtlReportCriticalFailure$filt$0
ntdll!_C_specific_handler
ntdll!_GSHandlerCheck_SEH
ntdll!RtlpExecuteHandlerForException
ntdll!RtlDispatchException
ntdll!RtlRaiseException
ntdll!RtlReportCriticalFailure
ntdll!RtlpLogHeapFailure
ntdll!RtlFreeHeap
msvcr90!free
googledrivesync64!DllCanUnloadNow
shell32!CFSIconOverlayManager::_GetFileOverlayInfo
shell32!CFSIconOverlayManager::GetFileOverlayInfo
shell32!CFSFolder::_GetOverlayInfo
SearchFolder!CDBFolder::GetOverlayIndex
shell32!CLibraryFolder::GetOverlayIndex
shell32!CIconOverlayTask::InternalResumeRT
shell32!CRunnableTask::Run
shell32!CShellTask::TT_Run
shell32!CShellTaskThread::ThreadProc
shell32!CShellTaskThread::s_ThreadProc
SHCore!ExecuteWorkItemThreadProc
ntdll!RtlpTpWorkCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
FOLLOWUP_IP:
googledrivesync64!DllCanUnloadNow+dc0
000007fc`695c30e0 488d542430 lea rdx,[rsp+30h]
IMAGE_NAME: googledrivesync64.dll
FAILURE_BUCKET_ID: WRONG_SYMBOLS_c0000374_googledrivesync64.dll!DllCanUnloadNow
BUCKET_ID: APPLICATION_FAULT_WRONG_SYMBOLS_googledrivesync64!DllCanUnloadNow+dc0
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/6_2_9200_16628/51a94434/ntdll_dll/6_2_9200_16579/51637f77/c0000374/000ebd59.htm?Retriage=1
Loaded symbol image file: googledrivesync64.dll
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Timestamp: Fri Jun 07 08:55:22 2013 (51B183DA)
CheckSum: 000CAC91
ImageSize: 000C0000
File version: 1.10.4769.632
Product version: 1.10.4769.632
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Google
ProductName: Google Drive
ProductVersion: 1.10.4769.0632
FileVersion: 1.10.4769.0632
FileDescription: Google Drive shell extension
LegalCopyright: Google
July 14th, 2013 2:53am
I'm having the same problem, I analyzed the dump, I had problem with the nvidia drive, the problem has changed, but now I do not know what to do to solve.
Follows the last dump
https://skydrive.live.com/redir?resid=C27B86A8E7E38C87!422&authkey=!ANsXQaa0vOAgeuM
Regards
July 19th, 2013 1:14am
I'm having the same problem, I analyzed the dump, I had problem with the nvidia drive, the problem has changed, but now I do not know what to do to solve.
Follows the last dump
https://skydrive.live.com/redir?resid=C27B86A8E7E38C87!422&authkey=!ANsXQaa0vOAgeuM
Regards
it is again the nVIDIA DLL (nv3dappshext.dll). Use ShellExView to disable the ShellExtension:
http://www.nirsoft.net/utils/shexview.html
July 19th, 2013 1:33am
I encountered this problem when PC Google Drive was running in background.
There are 2 options to bypass this bug (see also in Google Drive Forum):
1. Remove the "System file" and "Hidden File" attributes from the desktop.ini file in "My documents" folder.
This is usually the folder (when C is system disk) "C:\Users\<username>\Documents".
Accomplish this by:
a. Click <Windows Key>/x and in the popup select: "Command Prompt (Admin)"
(or on win 8 Start Screen type "cmd" then right click on "Command Prompt" and select "Run As Administrator")
b. Type: CD %USERPROFILE%
c. click Enter
d. Type: CD DOCUMENTS
e. Click Enter
(Then by command DIR yo don't see desktop.ini, but only by command DIR /A)
f. Type ATTRIB -S -H DESKTOP.INI
g. Click Enter
(Then by command DIR you see desktop.ini)
2. Disable Google Drive option that indicates sync status on all file icons.
You will notice if all files are synced
by moving mouse over Google Drive System Tray icon
and seeing "Sync Complete".
Accomplish this by:
a. Right-click on the "Google drive" system tray icon
b. Select "Preferences..."
c. Turn off the option "Show file sync status icons"
July 21st, 2013 11:50am
Andre, I had difficulty creating the dump file ... does this link provide the appropriate info to diagnose the explorer crash problem.
https://www.dropbox.com/s/nszx360x8hm9ih9/explorer.7z
Thank you in advance
August 12th, 2013 3:30pm
Andre, I had difficulty creating the dump file ... does this link provide the appropriate info to diagnose the explorer crash problem.
https://www.dropbox.com/s/nszx360x8hm9ih9/explorer.7z
Thank you in advance
Try disabling SugarSync Explorer Shell Extensions,
here is how.
August 12th, 2013 3:51pm
Hi,
I'm having the same problem - explorer.exe crashing frequently. I hope Andre can help me nail the cause.
I'm using Windows 8 Pro, couldn't find a localdumps folder, but found several explorer.exe.dmp files in Crashdumps folder inside Local folder inside AppData. Is this the same as Localdumps?
Anyway, I zipped several of the most recent explorer dump files and posted them here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!440&authkey=!AB5n-s_bcHzGArc
Thanks in advance.
Jeremy Angel
August 15th, 2013 8:21am
Hi,
I'm having the same problem - explorer.exe crashing frequently. I hope Andre can help me nail the cause.
disable the sync icons of google drive:
STACK_TEXT:
000007fa`be6e0658 000007fa`be640f09 ntdll!RtlFreeHeap+0x87
000007fa`be6e0660 00000000`6213cabc msvcr90!free+0x1c
000007fa`be6e0668 000007fa`a7af30e0 googledrivesync64+0x30e0
000007fa`be6e0670 000007fa`bc35f44a shell32!CFSIconOverlayManager::_GetFileOverlayInfo+0xca
000007fa`be6e0678 000007fa`bc41e958 shell32!CFSIconOverlayManager::GetFileOverlayInfo+0x48
000007fa`be6e0680 000007fa`bc35fa17 shell32!CFSFolder::_GetOverlayInfo+0xdf
000007fa`be6e0688 000007fa`bc41e9d1 shell32!CRegFolder::_GetOverlayInfo+0xed
000007fa`be6e0690 000007fa`bc35f863 shell32!CRegFolder::GetOverlayIndex+0x47
000007fa`be6e0698 000007fa`ac531236 explorerframe!CNscOverlayTask::InternalResumeRT+0xa0
000007fa`be6e06a0 000007fa`ac50a6d4 explorerframe!CRunnableTask::Run+0x102
000007fa`be6e06a8 000007fa`bc28194c shell32!CShellTask::TT_Run+0x3c
000007fa`be6e06b0 000007fa`bc28154c shell32!CShellTaskThread::ThreadProc+0xd7
000007fa`be6e06b8 000007fa`bc281753 shell32!CShellTaskThread::s_ThreadProc+0x33
000007fa`be6e06c0 000007fa`b9de157f shcore!ExecuteWorkItemThreadProc+0xf
000007fa`be6e06c8 000007fa`be5b5639 ntdll!RtlpTpWorkCallback+0x189
000007fa`be6e06d0 000007fa`be5a8552 ntdll!TppWorkerThread+0x604
000007fa`be6e06d8 000007fa`bd6b1832 kernel32!BaseThreadInitThunk+0x1a
000007fa`be6e06e0 000007fa`be5fd609 ntdll!RtlUserThreadStart+0x1d
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Browse all global symbols functions data
Timestamp: Fri Jun 28 01:09:04 2013
August 15th, 2013 7:38pm
I encountered this problem when PC Google Drive was running in background.
There are 2 options to bypass this bug (see also in Google Drive Forum)
I PREFER THE 2ND WAY:
1. Remove the "System file" and "Hidden File" attributes from the desktop.ini file in "My documents" folder.
This is usually the folder (when C is system disk) "C:\Users\<username>\Documents".
Accomplish this by:
a. Click <Windows Key>/x and in the popup select: "Command Prompt (Admin)"
(or on win 8 Start Screen type "cmd" then right click on "Command Prompt" and select
"Run As Administrator")
b. Type: CD %USERPROFILE%
c. click Enter
d. Type: CD DOCUMENTS
e. Click Enter
(Then by command DIR yo don't see desktop.ini, but only by command DIR /A)
f. Type ATTRIB -S -H DESKTOP.INI
g. Click Enter
(Then by command DIR you see desktop.ini)
2. Disable Google Drive option that indicates sync status on all file icons.
You will notice if all files are synced
by moving mouse over Google Drive System Tray icon
and seeing "Sync Complete".
Accomplish this by:
a. Right-click on the "Google drive" system tray icon
b. Select "Preferences..."
c. Turn off the option "Show file sync status icons"
-
Proposed as answer by
michael.lev
Friday, August 16, 2013 9:33 AM
August 16th, 2013 9:32am
Thanks very much, Michael and Andre. I've gone a whole day without an Explorer crash, so it appears to be working. What a relief!
August 17th, 2013 10:05am
Thanks very much
I've gone a whole day without an Explorer crash, so it appears to be working.
nice to hear this :)
August 17th, 2013 8:18pm
Hi,
I feel really bad coming here again to pester you people, but all of a sudden, I'm getting explorer crashes again. I tried various ways of reading the dmp files, but to no avail.
I've posted one here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!443
I would be extremely grateful for any pointers.
August 27th, 2013 8:22am
Hi,
My plea for help appears to have been buried under Paolo's, so now that Andre (a saint in my eyes) appears to have nailed Paolo's problem, please allow me to draw attention to my problem once again.
I feel really bad coming here again to pester you people, but all of a sudden, I'm getting explorer crashes again. I tried various ways of reading the dmp files, but to no avail.
I've posted one here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!443
I would be extremely grateful for any pointers.
August 27th, 2013 9:00pm
Hi,
My plea for help appears to have been buried under Paolo's, so now that Andre (a saint in my eyes) appears to have nailed Paolo's problem, please allow me to draw attention to my problem once again.
I feel really bad coming here again to pester you people, but all of a sudden, I'm getting explorer crashes again. I tried various ways of reading the dmp files, but to no avail.
I've posted one here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!443
I would be extremely grateful for any pointers.
Jeremy, my notes regarding FineReader were initially referred to you. I am sorry to Paolo and you for messing the dumps. The links to FineReader's shell extensions are in your dump indeed and surprisingly, there's a dozen of copies of various versions of
its extensions:
0:052> lmvm frintegration.x64*
start end module name
Unloaded modules:
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.1.dll
Timestamp: Tue Nov 01 12:55:15 2011 (4EAFB3F3)
Checksum: 00006D35
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.14.dll
Timestamp: Tue Nov 01 12:55:32 2011 (4EAFB404)
Checksum: 0001265E
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.15.dll
Timestamp: Tue Nov 01 12:55:24 2011 (4EAFB3FC)
Checksum: 000064FA
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.16.dll
Timestamp: Tue Nov 01 12:55:24 2011 (4EAFB3FC)
Checksum: 000065BC
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.17.dll
Timestamp: Tue Nov 01 12:55:15 2011 (4EAFB3F3)
Checksum: 0000D82D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.2.dll
Timestamp: Tue Nov 01 12:55:22 2011 (4EAFB3FA)
Checksum: 00005243
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.20.dll
Timestamp: Tue Nov 01 12:55:32 2011 (4EAFB404)
Checksum: 0000B497
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.22.dll
Timestamp: Tue Nov 01 12:55:37 2011 (4EAFB409)
Checksum: 00012280
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.23.dll
Timestamp: Tue Nov 01 12:55:28 2011 (4EAFB400)
Checksum: 00004867
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.24.dll
Timestamp: Tue Nov 01 12:55:26 2011 (4EAFB3FE)
Checksum: 0000870D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.27.dll
Timestamp: Tue Nov 01 12:55:26 2011 (4EAFB3FE)
Checksum: 00010B38
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.3.dll
Timestamp: Tue Nov 01 12:55:19 2011 (4EAFB3F7)
Checksum: 0000960E
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.4.dll
Timestamp: Tue Nov 01 12:55:17 2011 (4EAFB3F5)
Checksum: 00009B26
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.5.dll
Timestamp: Tue Nov 01 12:55:19 2011 (4EAFB3F7)
Checksum: 000070D1
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.6.dll
Timestamp: Tue Nov 01 12:55:17 2011 (4EAFB3F5)
Checksum: 00003DDD
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.63.dll
Timestamp: Tue Nov 01 12:55:36 2011 (4EAFB408)
Checksum: 00011C0D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.64.dll
Timestamp: Tue Nov 01 12:55:22 2011 (4EAFB3FA)
Checksum: 00011546
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.65.dll
Timestamp: Tue Nov 01 12:55:28 2011 (4EAFB400)
Checksum: 0000F716
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.7.dll
Timestamp: Tue Nov 01 12:55:30 2011 (4EAFB402)
Checksum: 00010A74
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.8.dll
Timestamp: Tue Nov 01 12:55:30 2011 (4EAFB402)
Checksum: 00011490
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.9.dll
Timestamp: Tue Nov 01 12:55:34 2011 (4EAFB406)
Checksum: 0000690A
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.1.dll
Timestamp: Tue Nov 01 12:55:15 2011 (4EAFB3F3)
Checksum: 00006D35
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.14.dll
Timestamp: Tue Nov 01 12:55:32 2011 (4EAFB404)
Checksum: 0001265E
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.15.dll
Timestamp: Tue Nov 01 12:55:24 2011 (4EAFB3FC)
Checksum: 000064FA
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.16.dll
Timestamp: Tue Nov 01 12:55:24 2011 (4EAFB3FC)
Checksum: 000065BC
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.17.dll
Timestamp: Tue Nov 01 12:55:15 2011 (4EAFB3F3)
Checksum: 0000D82D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.2.dll
Timestamp: Tue Nov 01 12:55:22 2011 (4EAFB3FA)
Checksum: 00005243
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.20.dll
Timestamp: Tue Nov 01 12:55:32 2011 (4EAFB404)
Checksum: 0000B497
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.22.dll
Timestamp: Tue Nov 01 12:55:37 2011 (4EAFB409)
Checksum: 00012280
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.23.dll
Timestamp: Tue Nov 01 12:55:28 2011 (4EAFB400)
Checksum: 00004867
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.24.dll
Timestamp: Tue Nov 01 12:55:26 2011 (4EAFB3FE)
Checksum: 0000870D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.27.dll
Timestamp: Tue Nov 01 12:55:26 2011 (4EAFB3FE)
Checksum: 00010B38
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.3.dll
Timestamp: Tue Nov 01 12:55:19 2011 (4EAFB3F7)
Checksum: 0000960E
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.4.dll
Timestamp: Tue Nov 01 12:55:17 2011 (4EAFB3F5)
Checksum: 00009B26
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.5.dll
Timestamp: Tue Nov 01 12:55:19 2011 (4EAFB3F7)
Checksum: 000070D1
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.6.dll
Timestamp: Tue Nov 01 12:55:17 2011 (4EAFB3F5)
Checksum: 00003DDD
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.63.dll
Timestamp: Tue Nov 01 12:55:36 2011 (4EAFB408)
Checksum: 00011C0D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.64.dll
Timestamp: Tue Nov 01 12:55:22 2011 (4EAFB3FA)
Checksum: 00011546
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.65.dll
Timestamp: Tue Nov 01 12:55:28 2011 (4EAFB400)
Checksum: 0000F716
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.7.dll
Timestamp: Tue Nov 01 12:55:30 2011 (4EAFB402)
Checksum: 00010A74
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.8.dll
Timestamp: Tue Nov 01 12:55:30 2011 (4EAFB402)
Checksum: 00011490
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.9.dll
Timestamp: Tue Nov 01 12:55:34 2011 (4EAFB406)
Checksum: 0000690A
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
I would check with ShellExView by NirSoft for ABBYY's extension and disable it temporary.
Here's where it sits in your system:
0:052> lmvm FRIntegration_x64
start end module name
00000000`2f980000 00000000`2fa5f000 FRIntegration_x64 (deferred)
Image path: C:\Program Files (x86)\ABBYY FineReader 11\FRIntegration.x64.dll
Image name: FRIntegration.x64.dll
Timestamp: Sat Oct 29 05:51:56 2011 (4EAB5C3C)
CheckSum: 000E9130
ImageSize: 000DF000
File version: 11.0.102.536
Product version: 11.0.102.536
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
I would also recommend turning on full dumps,
here is how. Andre has had a good page of its own with a list of registry files that enable/disable extended dumps using application verifier and driver verifier, but I've forgotten the link... Let's wait for
August 27th, 2013 10:35pm
Thanks very much, EH. Yes, I do get FineReader error messages occasionally, but nothing perturbing enough to force me to take further action - or so I thought. I used ShellExView to disable FRIntegration_x64, and will monitor behavior. I'm afraid
that while I was able to navigate to Localdumps folder using regedit, I couldn't figure how to turn on full dumps, despite the link you provided. I much appreciate your help.
August 27th, 2013 11:37pm
to get full dumps, create a DWORD DumpType and set it to 2.
August 28th, 2013 5:04am
Thanks very much, EH. Yes, I do get FineReader error messages occasionally, but nothing perturbing enough to force me to take further action - or so I thought. I used ShellExView to disable FRIntegration_x64, and will monitor behavior. I'm
afraid that while I was able to navigate to Localdumps folder using regedit, I couldn't figure how to turn on full dumps, despite the link you provided. I much appreciate your help.
If you still unhappy with manually changing registry settings, you can download the WER_Explorer_full.reg file from the Repository of registry settings to manage
Windows diagnostic and configure Windows Error Reporting (WER).
When downloaded, just double-click the REG file and confirm adding settings from there. Registry settings will be imported to registry. Use WER_Explorer_full_uninstall.reg to remove settings and disable extended diagnostic.
August 28th, 2013 1:17pm
If you still unhappy with manually changing registry settings, you can download the WER_Explorer_full.reg file from the Repository of registry settings to manage
Windows diagnostic and configure Windows Error Reporting (WER).
yeah, that's my skydrive folder. The full creates full dumps with AppVerifier enabled. The other only minis without AppVerifier.
August 28th, 2013 8:38pm
Thanks very much, EH, and to Andre for providing that resource.
I have done as instructed.
The reason I was having problems is that I couldn't find any explorer.exe folder among all the folders
within LocalDumps when viewed using regedit on my computer. There is still no such folder, even after doing as told above. Moreover, all of the folders in LocalDumps give C:\ProgramData\Norton\LocalDumps,
but the explorer dumps actually go to C:\Users\Jeremy\AppData\Local\CrashDumps. (I use Norton 360.)
When using regedit, should I be able to find an explorer.exe folder under Microsoft\Windows\Windows Error Reporting\LocalDumps\?
I suspect that I just don't know where to look or what I'm talking about, and I don't want to use up any more of your valuable time, but it's still something of a mystery to me.
August 28th, 2013 9:45pm
disable Norton while importing the .reg file.
August 29th, 2013 5:06am
Thanks, Andre. Worked like a charm, and so I now have full explorer.exe dumps enabled.
Much indebted.
August 29th, 2013 5:22am
did you get new Explorer crashes? If yes, zip and upload the new dumps
August 29th, 2013 6:46pm
Hi Andre,
Thanks for getting in touch.
I did in fact had 2 explorer crashes this morning, but having switched to full dumps, the dump files are HUGE. I followed your advice and used 7-zip to compress them individually (set at Ultra), but even then, one is 175 MB, the other 336 MB. Skydrive refused
to take the latter, but the former is here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!446&authkey=!AAAr2yiIisIRq1U
I'm now facing a different problem. I don't know whether this has anything to do with installing 7-zip (which I did to upload the full dump above), but since then, I've been having frequent explorer crashes, and always when I right-click on a blank space
in the rh pane of an explorer window (which makes explorer very difficult to use.) For example, I right click on a couple of attachments in an email in Outlook and press copy, then go to Explorer to paste them into the required folder, but the moment I right-click,
explorer crashes.
Because I was having problems uploading full dumps, I used regedit to switch back to the (1) setting. Then I reproduced a number of the crashes by right-clicking in an explorer window. I don't know whether these dumps will be of any help, but I've uploaded
them too:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!449&authkey=!ACrT4IWAAfy61j4
This is definitely an issue that I have to resolve urgently, so I look forward to your response (and those of anyone else able to help me) with bated breath!
Thanks in advance.
August 30th, 2013 4:03am
Andre,
Further to my post above, I switched back to full dumps to see if I could create a full dump of the latest explorer crashes (that occur when right-clicking in explorer) that would pass Skydrive's limits. It came to under 90 MB, and so was just about uploadable.
Here it is:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!450&authkey=!AJW7B4Jr5g9kzwM
BTW, I tried compressing using LZMA2 at ultra level, but failed, getting an error message that the "system cannot allocate sufficient memory". So this and the previous 7z file uploaded to my skydrive were both compressed using LZMA an ultra level.
Anyway, I hope this second full dump helps you to nail the problem.
Again, thanks in advance.
August 30th, 2013 4:35am
BTW, I tried compressing using LZMA2 at ultra level, but failed, getting an error message that the "system cannot allocate sufficient memory".
LZMA2 / Ultra requires a lot of RAM. 7-zip tells you have much RAm you need, make sure you have enough free RAM.
You get the well known Intel driver crash:
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
0000000022cd4590 0008 0000 [00] 0000000022cd45e0 00004 - (busy)
7fe9c0f81ab verifier!AVrfDebugPageHeapAllocate+0x000000000000039f
7feaceef108 ntdll!RtlDebugAllocateHeap+0x0000000000000038
7feacead679 ntdll!RtlpAllocateHeap+0x00000000000a6f59
7feace06704 ntdll!RtlAllocateHeap+0x00000000000001ae
7fe9c1106eb verifier!AVrfpRtlAllocateHeap+0x00000000000000d7
2176addb hccutils!DllUnregisterServer+0x0000000000002f9f
2176a217 hccutils!DllUnregisterServer+0x00000000000023db
21761378 hccutils!GetCUICustomizationKey+0x0000000000000190
21761936 hccutils!GetCUICustomizationKey+0x000000000000074e
2176320b hccutils!CreateThisKey+0x00000000000003f3
217635f8 hccutils!FindResources+0x0000000000000108
21763a11 hccutils!LoadSTRING+0x00000000000002f1
22acfc0d igfxpph+0x000000000000fc0d
22acfffe igfxpph+0x000000000000fffe
7feab109077 shell32!IShellExtInit_Initialize+0x0000000000000047
7feab10b3ed shell32!HDXA_QueryContextMenu+0x00000000000002dd
7feab10a56f shell32!CDefFolderMenu::QueryContextMenu+0x000000000000041b
7feab6ad3b9 shell32!CContextMenuOnContextMenuArray::_QueryNthContextMenu+0x0000000000000035
7feab6ad21c shell32!CContextMenuOnContextMenuArray::QueryContextMenu+0x00000000000000b0
7feab416ff7 shell32!CDefView::_DoContextMenuPopup+0x00000000000001ab
7feab416c77 shell32!CDefView::OnBackgroundContextMenu+0x00000000000001ab
7fe9ae89c2e explorerframe!UIItemsView::ShowContextMenu+0x0000000000000292
7fe9ae8335f explorerframe!CItemsView::ShowContextMenu+0x0000000000000017
7feab416e29 shell32!CDefView::_DoContextMenu+0x0000000000000081
7feab410a55 shell32!CDefView::_OnContextMenu+0x00000000000000e9
7feab7465bb shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x000000000001bf5a
7feab0647b9 shell32!CDefView::s_WndProc+0x0000000000000071
7feaa82171e user32!UserCallWinProcCheckWow+0x000000000000013a
7feaa82432b user32!CallWindowProcW+0x0000000000000093
7fea7b812ed comctl32!CallOriginalWndProc+0x000000000000001d
7fea7b811e6 comctl32!CallNextSubclassProc+0x0000000000000082
7fea7b812a7 comctl32!DefSubclassProc+0x0000000000000077
Image path: C:\Windows\System32\igfxpph.dll
Image name: igfxpph.dll
Timestamp: Tue Jul 31 23:14:59 2012 (50184AD3)
CheckSum: 0006E71C
ImageSize: 00065000
File version: 8.15.10.2828
Product version: 8.15.10.2828
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: IGFXPPH
OriginalFilename: IGFXPPH.DLL
ProductVersion: 8.15.10.2828
FileVersion: 8.15.10.2828
PrivateBuild: 8.15.10.2828
SpecialBuild: 8.15.10.2828
FileDescription: igfxpph Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Image path: C:\Windows\System32\hccutils.dll
Image name: hccutils.dll
Timestamp: Tue Jul 31 23:14:26 2012 (50184AB2)
CheckSum: 000295E3
ImageSize: 0001F000
File version: 8.15.10.2828
Product version: 8.15.10.2828
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: HCCUTILS
OriginalFilename: HCCUTILS.DLL
ProductVersion: 8.15.10.2828
FileVersion: 8.15.10.2828
PrivateBuild: 8.15.10.2828
SpecialBuild: 8.15.10.2828
FileDescription: hccutils Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
0x000000000f2cb968 : 0x000007feace1b679 : ntdll!RtlRaiseException+0x27e
0x000000000f2cb990 : 0x000007fea7b812ed : comctl32!CallOriginalWndProc+0x1d
0x000000000f2cba10 : 0x000007fea7d63c20 : comctl32!ShellTraceId_ComCtl32_Wizard_Open_Stop+0x8
0x000000000f2cbae0 : 0x000007feace1b46e : ntdll!RtlRaiseException+0x4e
0x000000000f2cbb20 : 0x000000000f2cbae0 : 0x000007feace1b46e : ntdll!RtlRaiseException+0x4e
0x000000000f2cbb28 : 0x000007feace00000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x000000000f2cbb60 : 0x000007feace1b46e : ntdll!RtlRaiseException+0x4e
0x000000000f2cbba0 : 0x000000000f2cbb60 : 0x000007feace1b46e : ntdll!RtlRaiseException+0x4e
0x000000000f2cbba8 : 0x000007feace00000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x000000000f2cbbc8 : 0x000007fea7d7c000 : "comctl32!Microsoft::WRL::Details::ModuleBase::module_ <PERF> (comctl32+0x1fc000)"
0x000000000f2cbcb8 : 0x000007feace04bba : ntdll!KiUserExceptionDispatch+0x2e
0x000000000f2cbdb8 : 0x000007fe9c0fa088 : verifier!VerifierStopMessage+0x1fc
0x000000000f2cbe70 : 0x0000000002556a90 : 0x000007fe9c11205c : verifier!AVrfpHeapFree+0xf4
0x000000000f2cbf70 : 0x000000000f2cc618 : 0x000007feac6e1330 : kernel32!HeapFreeStub
0x000000000f2cbfa0 : 0x000007feab8b3b9c : shell32!_NULL_IMPORT_DESCRIPTOR+0x49c
0x000000000f2cbfb8 : 0x000007feab8b3b9c : shell32!_NULL_IMPORT_DESCRIPTOR+0x49c
0x000000000f2cbfe0 : 0x000000001e36d670 : dt ntshrui!COnlineIdFilter
0x000000000f2cc068 : 0x000007feace4e57f : ntdll!vsnprintf_l+0x75
0x000000000f2cc070 : 0x000007feab10b3ed : shell32!HDXA_QueryContextMenu+0x2dd
0x000000000f2cc088 : 0x000007feab6ad21c : shell32!CContextMenuOnContextMenuArray::QueryContextMenu+0xb0
0x000000000f2cc090 : 0x3030303030303030 : !da "0000000022CD45E0T"
0x000000000f2cc098 : 0x3045353444433232 : !da "22CD45E0T"
0x000000000f2cc0d8 : 0x000007feace4e511 : ntdll!vsnprintf+0x11
0x000000000f2cc0e8 : 0x000007feace85722 : ntdll!vsnprintf_l+0x98
0x000000000f2cc0f8 : 0x000007fe9c0f7152 : verifier!AVrfpDphPlaceOnDelayFree+0x1f2
0x000000000f2cc100 : 0x000000000f2cc3f8 : 0x000007fe9c0f1760 : !da ""This verifier stop is not continuable. Process will be terminated .when you use ...""
0x000000000f2cc118 : 0x000007feacec93bc : ntdll!RtlStringVPrintfWorkerA+0x20
0x000000000f2cc148 : 0x000007feace1ad81 : ntdll!vDbgPrintExWithPrefixInternal+0x89
0x000000000f2cc1a8 : 0x736968540a3d3d3d : !da "===.This"
0x000000000f2cc1c0 : 0x000007fe9c0fa088 : verifier!VerifierStopMessage+0x1fc
0x000000000f2cc248 : 0x3d3d3d3d3d3d3d3d : !da "========"
0x000000000f2cc250 : 0x000007fe9c0fa088 : verifier!VerifierStopMessage+0x1fc
0x000000000f2cc258 : 0x206c6c6977207373 : !da ""ss will be termi""
0x000000000f2cc260 : 0x696d726574206562 : !da ""be termi""
0x000000000f2cc308 : 0x000007feaceeddee : ntdll!RtlpValidateHeap+0x32
0x000000000f2cc388 : 0x000007fe9c0f1760 : !da ""This verifier stop is not continuable. Process will be terminated .when you use ...""
0x000000000f2cc398 : 0x000007feace407a4 : ntdll!DbgPrintEx+0x30
0x000000000f2cc3b8 : 0x000007feaceeddee : ntdll!RtlpValidateHeap+0x32
0x000000000f2cc3c0 : 0x000000000f2cc3f8 : 0x000007fe9c0f1760 : !da ""This verifier stop is not continuable. Process will be terminated .when you use ...""
0x000000000f2cc3c8 : 0x000007fe9c10c601 : verifier!AVrfpSRWLockFreeMemoryChecks+0x85
0x000000000f2cc3d8 : 0x000007fe9c0fa07b : verifier!VerifierStopMessage+0x1ef
0x000000000f2cc3f0 : 0x000007fe9c0f1860 : !da "===========================================================.%s.=================..."
0x000000000f2cc3f8 : 0x000007fe9c0f1760 : !da ""This verifier stop is not continuable. Process will be terminated .when you use ...""
0x000000000f2cc408 : 0x000007fe9c0f14a8 : !da ""corrupted suffix pattern""
0x000000000f2cc418 : 0x000007fe9c0f11c0 : !da ""Heap handle""
0x000000000f2cc428 : 0x000007fe9c0f13c8 : !da ""Heap block""
0x000000000f2cc438 : 0x000007fe9c0f13b8 : !da ""Block size""
0x000000000f2cc448 : 0x000007fe9c0f1408 : !da ""corruption address""
0x000000000f2cc450 : 0x000007fe9c0f13c8 : !da ""Heap block""
0x000000000f2cc458 : 0x000007fe9c0f13b8 : !da ""Block size""
0x000000000f2cc460 : 0x000007fe9c0f1408 : !da ""corruption address""
0x000000000f2cc468 : 0x000007fe9c0f11c0 : !da ""Heap handle""
0x000000000f2cc488 : 0x000007fe9c0f8f68 : verifier!AVrfpDphReportCorruptedBlock+0x224
0x000000000f2cc498 : 0x000007fe9c0f14a8 : !da ""corrupted suffix pattern""
0x000000000f2cc4a8 : 0x000007fe9c0f11c0 : !da ""Heap handle""
0x000000000f2cc4b8 : 0x000007fe9c0f13c8 : !da ""Heap block""
0x000000000f2cc4c8 : 0x000007fe9c0f13b8 : !da ""Block size""
0x000000000f2cc4d8 : 0x000007fe9c0f1408 : !da ""corruption address""
0x000000000f2cc520 : 0x000007feac6e1330 : kernel32!HeapFreeStub
0x000000000f2cc548 : 0x000007fe9c0f92a4 : verifier!AVrfpDphCheckNormalHeapBlock+0xc8
0x000000000f2cc598 : 0x000007fe9c0fd59b : verifier!VerifierCheckPageHeapAllocation+0x6b
0x000000000f2cc5c8 : 0x000007fe9c111fcd : verifier!AVrfpHeapFree+0x65
*** ERROR: Symbol file could not be found. Defaulted to export symbols for hccutils.dll -
0x000000000f2cc618 : 0x000007feac6e1330 : kernel32!HeapFreeStub
0x000000000f2cc688 : 0x0000000021761286 : hccutils!GetCUICustomizationKey+0x9e
0x000000000f2cc6b8 : 0x000000002176162d : hccutils!GetCUICustomizationKey+0x445
0x000000000f2cc728 : 0x0000000021761936 : hccutils!GetCUICustomizationKey+0x74e
0x000000000f2cc750 : 0x000000000f2ccf00 : !da "igfxres.dll"
0x000000000f2cc758 : 0x000000002176320b : hccutils!CreateThisKey+0x3f3
0x000000000f2cc760 : 0x000000000f2ccf00 : !da "igfxres.dll"
0x000000000f2cc7b8 : 0x0000000022cd44d0 : !da "C:\windows\system32\igfxr"
0x000000000f2cc7d8 : 0x000007feaceeef6e : ntdll!RtlDebugSizeHeap+0x36
0x000000000f2cc7e0 : 0x0000000022cd4440 : !da "C:\windows\system32\igfxres.dll"
0x000000000f2cc7e8 : 0x000007fea9dcd429 : KERNELBASE!GetLocaleInfoHelper+0x279
0x000000000f2cc850 : 0x6f646e69775c3a43 : !da "C:\windows\system32"
0x000000000f2cc858 : 0x65747379735c7377 : !da "ws\system32"
*** ERROR: Symbol file could not be found. Defaulted to export symbols for igfxpph.dll -
0x000000000f2ccc70 : 0x0000000022ac0000 : igfxpph
0x000000000f2ccc88 : 0x0000000022ac0000 : igfxpph
0x000000000f2ccca8 : 0x00000000217635f8 : hccutils!FindResources+0x108
0x000000000f2ccf00 : 0x2e73657278666769 : !da "igfxres.dll"
0x000000000f2cd038 : 0x0000000021763a11 : hccutils!LoadSTRING+0x2f1
0x000000000f2cd090 : 0x6572617774666f53 : !da "Software\Intel\Display\igfxcui\igfxpph\resources"
0x000000000f2cd098 : 0x445c6c65746e495c : !da "\Intel\Display\igfxcui\igfxpph\resources"
0x000000000f2cd0a0 : 0x695c79616c707369 : !da "isplay\igfxcui\igfxpph\resources"
0x000000000f2cd0a8 : 0x695c697563786667 : !da "gfxcui\igfxpph\resources"
0x000000000f2cd0b0 : 0x725c687070786667 : !da "gfxpph\resources"
0x000000000f2cd0b8 : 0x73656372756f7365 : !da "esources"
0x000000000f2cd1f8 : 0x000007feab062996 : shell32!_SHCoCreateInstance+0x1a6
0x000000000f2cd238 : 0x000007feab0fb318 : shell32!GUID_000214e4_0000_0000_c000_000000000046
0x000000000f2cd258 : 0x000007fea9dc3839 : KERNELBASE!BaseRegGetKeySemantics+0x1b9
0x000000000f2cd260 : 0x004200410033007b : !du "{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}"
0x000000000f2cd268 : 0x0035003700360031 : !du "1675A-CCFF-11D2-8B20-00A0C93CB1F4}"
0x000000000f2cd270 : 0x00430043002d0041 : !du "A-CCFF-11D2-8B20-00A0C93CB1F4}"
0x000000000f2cd278 : 0x0031002d00460046 : !du "FF-11D2-8B20-00A0C93CB1F4}"
0x000000000f2cd280 : 0x002d003200440031 : !du "1D2-8B20-00A0C93CB1F4}"
0x000000000f2cd288 : 0x0030003200420038 : !du "8B20-00A0C93CB1F4}"
0x000000000f2cd290 : 0x004100300030002d : !du "-00A0C93CB1F4}"
0x000000000f2cd298 : 0x0033003900430030 : !du "0C93CB1F4}"
0x000000000f2cd2a0 : 0x0046003100420043 : !du "CB1F4}"
0x000000000f2cd3b8 : 0x000007fe9c0f5f90 : verifier!AVrfSetHeapPathCaller+0xc
0x000000000f2cd3c0 : 0x6572617774666f53 : !da "Software\Intel\Display\igfxcui\igfxpph\resources"
0x000000000f2cd3c8 : 0x445c6c65746e495c : !da "\Intel\Display\igfxcui\igfxpph\resources"
0x000000000f2cd3d0 : 0x695c79616c707369 : !da "isplay\igfxcui\igfxpph\resources"
0x000000000f2cd3d8 : 0x695c697563786667 : !da "gfxcui\igfxpph\resources"
0x000000000f2cd3e0 : 0x725c687070786667 : !da "gfxpph\resources"
0x000000000f2cd3e8 : 0x73656372756f7365 : !da "esources"
so update the Intel graphic card driver and look if this fixes it. Also run the uninstall.reg to disable AppVeririfer/dump creation.
August 30th, 2013 5:15am
Hi Andre,
Thanks for getting back so quickly. I updated the Intel driver, but the problem remains. Right-clicking in any blank space in the rh pane of explorer results in a crash. Right-clicking any of the folders in the folder tree in the left pane also does the
same. Also had huge problems opening device manager to update the Intel driver, with frequent crashes, eventually got to it through launching Computer Management.
I've uploaded the latest full dump created after updating the Intel graphics driver. (No matter
how much RAM I tired to create, it was insufficient for LZMA2/ultra, and the 7z file created with LMZA/Ultra is about 135 MB). Here it is:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!451&authkey=!AFHy516UjEjYQqo
As far as I know, I never installed AppVerifier/dump creation, unless this refers to the WER_Explorer_full.reg
file that I downloaded and installed from your Skydrive. Should I now download and install WER_Explorer_full_uninstall.reg?
Sorry to pester you with what probably strike you as very beginner level questions.
August 30th, 2013 7:00am
still the same Intel driver issue.
Use ShellExView and disable the Intel driver shell extension. Also add the intel .cpl (igfxcpl.cpl) to the don't load list:
August 30th, 2013 6:37pm
Andre,
Thanks very much for the advice. I have done as instructed, with great trepidation as I had to do things and go place I have never been before. I kept getting error messages trying to add the intel .cpl to the effect that I didn't have permission (despite
administrator status), so for the first time ever, I went through various contortions to give myself full permission to edit don't load. I had to change ownership from Trustedinstaller to Administrators, and was unable to switch it back after adding the intel
.cpl.
Anyway, I'm glad to say that I can now right-click in Explorer without crashing.
Microsoft Management Console (MMC) still crashes for some reason after a few minutes, and device manager seems to take far longer than it should to load. Otherwise, no problems for the time being.
Last time I asked about AppVerifier. Should I ignore?:
************************************
As far as I know, I never installed AppVerifier/dump creation, unless this refers to the WER_Explorer_full.reg file that I downloaded and installed from your Skydrive. Should I now download and install WER_Explorer_full_uninstall.reg?
*************************************
Thanks again for all your help.
August 31st, 2013 3:45am
yes run the WER_Explorer_full_uninstall.reg to disable AppVerifier and stop dump creation.
Download the WER_MMC.reg and import it. Create a new topic about the MMC issue and upload the MMC dump.
August 31st, 2013 6:30am
Hi Andre,
Thanks, I'll create a new topic for the MMC issue. I have the dumps already uploaded.
I was hoping that I had seen the last of explorer crashes thanks to you, but I did suffer another while opening the device manager - an explorer window just closed, without the shell crashing as it had in the past. For some reason even after running WER_Explorer_full_uninstall.reg
, I got a pretty large dump. I've uploaded it just in case you're interested:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!553&authkey=!AB0KJIxdFOd3Zsw
August 31st, 2013 8:55am
Hello
I have a Lenovo Y500 Laptop with the original Win 8 on it.After a month of working with it I had the problem of windows explorer crashing and restarting.So I used the backup and restore pre-installed software and restored it to the beginning of device usage.After
a while I had the same problem again.I've tried to create the dumb file but the size is arround 400 MB so I can't upload it by skydrive.What should I do.PLEASE HELP ME.MY HEAD IS GONNA BE EXPLODED.
Thanks for your attention
September 7th, 2013 3:48am
Time to pass on the favors I received here from Andre and Exotic Hadron (though I'm still suffering Explorer crashes). You can use 7zip (http://www.7-zip.org/) to compress the dump file considerably. Use Add to archive,
and set to LZMA/ultra, or even better, LZMA2/ultra if you have enough memory, and then upload the 7z file. I managed to upload a dump of over 600 MB by this method, using LZMA/ultra.
September 7th, 2013 4:46am
@Mehdi_ID
zip the dump
@Jeremy Angel
upload new dumps.
September 7th, 2013 2:15pm
Thanks
This is mine : https://skydrive.live.com/redir?resid=9F0DA8F031098F3!159&authkey=!ACN_hYALKFw6njw
September 7th, 2013 7:24pm
Thanks
This is mine
Autodesk causes the crash:
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for IDMShellExt64.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for SugarSyncShellExt_x64.dll -
FAULTING_IP:
QtCore_Ad_SyncNs_4!QThread::start+3fb
00000000`521966ab 488b98c0000000 mov rbx,qword ptr [rax+0C0h]
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000521966ab (QtCore_Ad_SyncNs_4!QThread::start+0x00000000000003fb)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000000000000c0
Attempt to read from address 00000000000000c0
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=0000000000000000 rbx=0000000000000000 rcx=bb3caf7046380000
rdx=0000000000000000 rsi=000000002294e9d8 rdi=0000000000000001
rip=000007fbf012319b rsp=000000002294e5d8 rbp=0000000000000002
r8=000000002294de78 r9=000000002294df80 r10=0000000000000000
r11=0000000000000000 r12=0000000000000008 r13=000000002294e9d8
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!NtWaitForMultipleObjects+0xa:
000007fb`f012319b c3 ret
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_READ
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00000000000000c0
READ_ADDRESS: 00000000000000c0
FOLLOWUP_IP:
QtCore_Ad_SyncNs_4!QThread::start+3fb
00000000`521966ab 488b98c0000000 mov rbx,qword ptr [rax+0C0h]
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
FAULTING_THREAD: 00000000000016a4
PRIMARY_PROBLEM_CLASS: NULL_CLASS_PTR_READ
BUGCHECK_STR: APPLICATION_FAULT_NULL_CLASS_PTR_READ
LAST_CONTROL_TRANSFER: from 000007fbe49e653d to 00000000521966ab
STACK_TEXT:
00 ntdll!NtWaitForMultipleObjects
01 verifier!AVrfpNtWaitForMultipleObjects
02 KERNELBASE!WaitForMultipleObjectsEx
03 verifier!AVrfpWaitForMultipleObjectsExCommon
04 verifier!AVrfpKernelbaseWaitForMultipleObjectsEx
05 kernel32!WerpReportFaultInternal
06 kernel32!WerpReportFault
07 KERNELBASE!UnhandledExceptionFilter
08 ntdll!RtlUserThreadStart$filt$0
09 ntdll!_C_specific_handler
0a ntdll!RtlpExecuteHandlerForException
0b ntdll!RtlDispatchException
0c ntdll!KiUserExceptionDispatch
0d QtCore_Ad_SyncNs_4!QThread::start
0e verifier!AVrfpStandardThreadFunction
0f kernel32!BaseThreadInitThunk
10 ntdll!RtlUserThreadStart
IMAGE_NAME: QtCore_Ad_SyncNs_4.dll
FAILURE_BUCKET_ID: NULL_CLASS_PTR_READ_c0000005_QtCore_Ad_SyncNs_4.dll!QThread::start
FAILURE_ID_HASH_STRING: um:null_class_ptr_read_c0000005_qtcore_ad_syncns_4.dll!qthread::start
Image path: C:\Program Files\Autodesk\Autodesk Sync\QtCore_Ad_SyncNs_4.dll
Image name: QtCore_Ad_SyncNs_4.dll
Browse all global symbols functions data
Timestamp: Fri Dec 21 07:07:35 2012 (50D3FCA7)
CheckSum: 002DC7EA
ImageSize: 002D7000
File version: 4.8.2.0
Product version: 4.8.2.0
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Digia Plc and/or its subsidiary(-ies)
ProductName: Qt4
OriginalFilename: QtCore_Ad_SyncNs_4.dll
ProductVersion: 4.8.2.0
FileVersion: 4.8.2.0
FileDescription: C++ application development framework.
LegalCopyright: Copyright (C) 2012 Digia Plc and/or its subsidiary(-ies).
update Autodesk or remove it. After doing this import the uninstall.reg to stop dump creation.
September 7th, 2013 7:45pm
Andre,
Thanks. I was hesitating to pester you again, especially as these are only very small dumps since I turned off full dumps. The full dumps I was getting were over 800 MB, so doubtful whether I could upload the 7z file.
Let me know if these aren't useful:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!557&authkey=!ABduTOfKBvZTGWo
September 7th, 2013 8:32pm
the small dumps are an issue because they don't contain all data.
Disable the Dropbox Shell Extension and look if this fixes it.
September 8th, 2013 5:53am
Hi, Andre
Looks you help may guys solved the issue. thanks very much.
Sorry to say, I hit the same issue, during last two month. one time, I tried to uninstall some program by time, it works. but those two days, I hit it again, but cannot find any clue again.
So, I will try to dump the file, and to analysis, so look to see if you can share how you use the Windbg to analyze the dump file. so that maybe may guys can help themselves.
thanks again.
September 8th, 2013 11:01am
And below is a dump from my crash. can you help to have a look firstly, thanks.
http://sdrv.ms/14vnTF3
Thanks
Darren
September 8th, 2013 11:11am
below stack is got by analyze -v, but I don't know how to get more details.
0:033> !analyze -v
*******************************************************************************
*
*
* Exception Analysis *
*
*
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
FAULTING_IP:
ntdll!RtlLoadString+147
000007ff`10c9873b 410fb71440 movzx edx,word ptr [r8+rax*2]
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007ff10c9873b (ntdll!RtlLoadString+0x0000000000000147)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000004055022
Attempt to read from address 0000000004055022
DEFAULT_BUCKET_ID: INVALID_POINTER_READ
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000004055022
READ_ADDRESS: 0000000004055022
FOLLOWUP_IP:
Actioncenter!CStringResolver::s_ExpandAndLoad+13b
000007ff`07a3c8af 85c0 test eax,eax
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
FAULTING_THREAD: 0000000000000764
PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ
BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ
LAST_CONTROL_TRANSFER: from 000007ff0dcd014a to 000007ff10c9873b
STACK_TEXT:
00000000`0f0ef180 000007ff`0dcd014a : 0000c6bd`64d32859 00000000`0f0ef3b0 00000000`00000008 00000000`00000000 : ntdll!RtlLoadString+0x147
00000000`0f0ef250 000007ff`0e915291 : 00000000`0a1922f0 000007ff`00000000 00000000`00000000 00000000`00000000 : KERNELBASE!LoadStringBaseExW+0x7a
00000000`0f0ef2c0 000007ff`07a3c8af : 00000000`00000000 00000000`0a1c9ba0 00000000`00000078 000007ff`0ee316dd : user32!LoadStringW+0x11
00000000`0f0ef300 000007ff`07a2e8f5 : 00000000`0a1c9fd0 00000000`04393550 00000000`0a1c9ba0 000007ff`07a19200 : Actioncenter!CStringResolver::s_ExpandAndLoad+0x13b
00000000`0f0ef350 000007ff`07a2d6e8 : 000007ff`07a491d0 00000000`0a1c9ba0 00000000`0f0ef4d0 00000000`0f0ef4d0 : Actioncenter!CStockCheckProvider::_Initialize+0x179
00000000`0f0ef3a0 000007ff`07a26361 : 000007ff`07a491d0 00000000`0a188a20 000007ff`07a16938 000007ff`07a169f0 : Actioncenter!CNotificationManager::AddStockCheckProvider+0x84
00000000`0f0ef3d0 000007ff`07a2e132 : 00000000`00000000 00000000`0a188a18 00000000`043927d0 00000000`00000001 : Actioncenter!CAllowedProviders::s_InitializeNotificationManagerCB+0x199
00000000`0f0ef680 000007ff`07a27386 : 00000000`043927d0 00000000`00000000 00000000`00000000 00000000`00000000 : Actioncenter!CNotificationManager::Initialize+0x42
00000000`0f0ef6b0 000007ff`07a272f1 : 00000000`006f065e 00000000`00000000 00000000`043927d0 00000000`043927d0 : Actioncenter!CHealthCenterSSO::_Initialize+0x36
00000000`0f0ef6e0 000007ff`07a27136 : 00000000`006f065e 00000000`00000113 00000000`00000001 000007ff`07a270f4 : Actioncenter!CHealthCenterSSO::_WndProc+0x18d
00000000`0f0ef710 000007ff`0e91171e : 00000000`00000001 00000000`00000001 00000000`00000000 00000000`00000401 : Actioncenter!CHealthCenterSSO::s_WndProc+0x42
00000000`0f0ef740 000007ff`0e9114d7 : 00000000`010921e0 00000000`0f0ef8b0 000007f7`5fb90800 000007ff`07a270f4 : user32!UserCallWinProcCheckWow+0x13a
00000000`0f0ef800 000007ff`0925119f : 00000000`091a8350 00000000`091a8350 00000000`00000001 00000000`00000001 : user32!DispatchMessageWorker+0x1a7
00000000`0f0ef880 000007ff`0bf140bc : 00000000`02daf500 00000000`02daf500 00000000`0f0efd99 00000000`00000000 : stobject!CSSOSharedThread::ThreadProc+0x100
00000000`0f0efd10 000007ff`0e311832 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : SHCore!COplockFileHandle::v_GetHandlerCLSID+0x12c
00000000`0f0efe00 000007ff`10cdd609 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x1a
00000000`0f0efe30 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: actioncenter!CStringResolver::s_ExpandAndLoad+13b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Actioncenter
IMAGE_NAME: Actioncenter.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 50109167
STACK_COMMAND: ~33s; .ecxr ; kb
FAILURE_BUCKET_ID: INVALID_POINTER_READ_c0000005_Actioncenter.dll!CStringResolver::s_ExpandAndLoad
BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_actioncenter!CStringResolver::s_ExpandAndLoad+13b
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/6_2_9200_16628/51a94434/ntdll_dll/6_2_9200_16579/51637f77/c0000005/0001873b.htm?Retriage=1
Followup: MachineOwner
September 8th, 2013 12:47pm
And below is a dump from my crash. can you help to have a look firstly, thanks.
Please run a chkdsk. The action center does some NTFS/File History logging while the explorer crashes.
September 8th, 2013 6:58pm
Hi,
i was having the explorer crash sometiems per day and then i found this topic. I've downloaded the reg file from your skydrive and i've added it to the registry. After i restarted my computer and my explorer never loaded again. i can still open programms
through the tasks manager but when i load the windows i just get a black screen and the mouse pointer. How can i solve this problem? i've already tried to use the system restore a couple of a times and still the same...If i start in safe mode then the explorer
turns on and works normally, but when i make a normal boot even i start it trough the tasks manager i get the error: "The application failed to
initialize properly (0xc0000142)"
-
Edited by
MarcoM2013
Saturday, October 26, 2013 3:48 PM
October 26th, 2013 3:38pm
October 26th, 2013 7:08pm
i haven't done that, i've tried(in safe mode) 2 times to restore the system and at the 2nd atempt the main problem(explorer not loading) was solved. For now i have just the problem of having explorer crashing and reloading sometimes and i'm already waiting
for the dumps to appear in the C folder. It has already happened but there wasn't any file created in the folder
-
Edited by
MarcoM2013
Saturday, October 26, 2013 8:23 PM
October 26th, 2013 8:07pm
I've managed to go the "events viewer" in the "administrative tools" of windows and we can see there a log file with some informations. I've uploaded it to my skydrive(3 files) and you can see it in the following link:
https://skydrive.live.com/redir?resid=181F7339F4ADBBC0!3443
I'm not any computer geek but i've noticed that the problem may be an autodesk file which is specified in the error. I would be very thankful if you could help me solving this problem or at least suggest me something.
Note that my system is in portuguese, so a few fields will be written in portuguese, but all directories, codes, etc are "understandable"
October 26th, 2013 8:48pm
after googling a few words i've probably found what the problem is and it's explained in the microsft forum and also in autodesk forum. you can easily find it by googling with this name"QtCore_Ad_SyncNs_4.dll". IT's probably caused by a product called "autodesk
360". I hope that unninstalling it will solve the explorer crash problem.
-
Proposed as answer by
sangeethmvs
Saturday, November 23, 2013 3:02 AM
October 26th, 2013 9:06pm
i am using windows 8 os 64-bit and i am facing really severe issues every time my all apps are crashing then i keep on refreshing the pc and installing the programs again and again please anyone tell me the solution for this issue and one more thing
every time when i open the store graphics are not loading properly my internet plan is decent but still the graphics are not loading,another issue is screen turns into black and makes windows 8 app permission sound every time please help.
thanks and regards
November 23rd, 2013 3:08am
Hello Andre,
We too have an isue where explorer (and taskbar) crashes. I made a fresh re-install of windows 8, but the laptop keeps crashing. I made a dumpfile as sugested in your post. I hope you can help and/or advice me.
https://skydrive.live.com/redir?resid=4E5E698947364C8D%21105
Thanks in advance
December 22nd, 2013 2:40pm
>>We too have an isue where explorer (and taskbar) crashes. I made a fresh re-install of windows 8, but the laptop >>keeps crashing. I made a dumpfile as sugested in your post. I hope you can help and/or advice me.
Hey, please update driver and software for your Intel network interface card. Its control library is crashing.
>>https://skydrive.live.com/redir?resid=4E5E698947364C8D%21105
February 24th, 2014 12:02pm
after the last update for win8.1 pro i have a lot of problem like my computer get slow and explorer.exe sometimes crashed help me plez
i try to make "Refresh My PC" but he side some files are not available
-
Edited by
Abode965
Sunday, April 20, 2014 1:29 PM
April 20th, 2014 1:25pm
explorer.exe now crashing on a number of PCs after the new updates after 8.1.
Haven't been able to track this down to a single cause. Happening on PCs with completely different software installed. I'm pretty sure this is a MS bug.
April 29th, 2014 12:16am
Ok, what's the difference between doing the "Refresh My PC" and doing a System Recovery" given you have to reload everything anyway? Seems like the same pain in the butt to me.
November 6th, 2014 4:13am
After I installed your script on Windows 8 my explorer isnt working anymore. How can I revert the changes?
April 10th, 2015 2:18am