Explorer.exe Constantly crashes

[sullysnet]

The original crash data supplied by Anon is about 98% likely a bogus context menu handler. Any other crash would best be analyzed by looking at the fault data/DMP file. Identification of *what* context menu handler it is would be predicated upon having the DMP file to look at.

The most effective thing you can do is to supply the crash DMP file that people asked for and MagicAndre provided great instructions for how to provide - if my own weren't sufficient. Any other typing you're doing is simply wasting time and increasing your time to solution. :)

We like your computer running well. Help people help you. :)

Well see if you guys can find anything on my post. I have given people everything besides a dump. Since I am testing x32 to see my results I cannot enable the registry change to create a dump. I wish I could cause I would but I will not reload to x64 just to create the dump unless I decide to create an image of this drive and do some testing. I would like to see what Anon's dump shows, if he is willing to create it.

Here is my post https://www.neowin.net/forum/index.php?show...amp;p=591836648

You can see from my list from Shexview that I do not have a single third party extension loaded. Unless you are going to tell me that removing all extensions is not enough to troubleshoot the issue. For people on a clean system with nothing loaded I am not sure how you can still think it's an shell extension. I am more apt to think it is something hooked to Explorer.exe like soldier1st said. I do not see anything in Process Explorer. I should peek at it now in x32 with a few apps open.

thanks everyone for the help

Here is a list that looks exactly like what I had seen in x64 from Explorer

http://rapidshare.com/files/306260130/PE.png

Edited November 13, 2009 by sullysnet

[Preppy Veteran]

Yes, I am specifically stating to you that the information you gave is not sufficient and would not lead anyone to be able to make any effective educated guesses.

RapidShare absolutely sucks and timed out every download for me. All you needed to do was post the fault data and bucket number from that data anyways - the files you uploaded were extraneous. :)

All anyone really needs is the crash data and preferably the DMP. Post the text of the crash data information and put up the DMP on some place that's not RapidSuck. :D

[sullysnet]

Yes, I am specifically stating to you that the information you gave is not sufficient and would not lead anyone to be able to make any effective educated guesses.

RapidShare absolutely sucks and timed out every download for me. All you needed to do was post the fault data and bucket number from that data anyways - the files you uploaded were extraneous. :)

All anyone really needs is the crash data and preferably the DMP. Post the text of the crash data information and put up the DMP on some place that's not RapidSuck. :D

RS is fine, never had an issue using it

[MagicAndre1981]

try to disable the Bluewire General Property Sheet. If the crashes happen again, look into the Action Center and select the crash and post the Bucket ID or the dump. Otherwise we can't help you.

[sullysnet]

try to disable the Bluewire General Property Sheet. If the crashes happen again, look into the Action Center and select the crash and post the Bucket ID or the dump. Otherwise we can't help you.

I had tried the bluewire disabling and still had the crashes. I plan to image this machine from the x32 build that is working and try again reloading x64 and try to generate a dump. Do you think if I ran Dr Watson while I was using the machine it may grab something? I also thought about another link for grabbing dumps

http://searchwindowsserver.techtarget.com/...1370041,00.html

thanks

try to disable the Bluewire General Property Sheet. If the crashes happen again, look into the Action Center and select the crash and post the Bucket ID or the dump. Otherwise we can't help you.

Also you cannot get to the Action Center while Explorer is crashed, mostly everything that relies on Explorer cannot be used. Best bet is either that reg file that someone posted or that link I posted about capturing application crashes

[Preppy Veteran]

The sooner you post a crash dump the sooner you will more likely have a much better weekend. :)

[sullysnet]

The sooner you post a crash dump the sooner you will more likely have a much better weekend. :)

well I just got finished installing x64 and the same apps I had on x32

Opera 10

Firefox 3.55

Trillian 4.1

Windows Updates

that is it and I will just keep testing until a crash comes along. I hope that Action Center picks up something. Do you think I should import the registry file just in case? I do not see Dr Watson in x64 but I have not search the complete Win directory.

Forget it I imported the registry file, hopefully it will grab something

Edited November 13, 2009 by sullysnet

[sullysnet]

Well that seemed to be a waste of my time. There is no crash dump placed in the directory C:\Localdumps after importing that registry key. I didn't have time to reboot after adding the reg file so maybe to enable that you need a reboot (if so sorry)

I did grab as much info as was displayed. Action center seemed to disappear and nothing is listed in there for a crash. The crash

did happen after using Firefox and I imagine it is something to do with that, but what that is I still have no clue. I am going to reboot and hope to get another one.

Here is as much as I collected, I attached it

AppCrash_Explorer.EXE_69e96abb22ff39b03a6bce9716868aa72039fa83_05215522.zip

[Preppy Veteran]

You can also right click in Task Manager:Processes tab on that process and select "Create Dump File"...

The data you can provide short of the crash dump is going to be pretty "useless". The data above shows us about what haystack it's in, but diving into the haystack to find the needle to my mind will absolutely require the crash dump.

Psychic powers and educated guesses only go so far. :)

[soldier1st]

according to the screenshot in rapidshare explorer is trying to query an unknown service/device it looks like, Try Running process Monitor on explorer and see what files/reg keys it is hitting the most. under device manager do you have any unknown devices with no drivers installed?

[sullysnet]

according to the screenshot in rapidshare explorer is trying to query an unknown service/device it looks like, Try Running process Monitor on explorer and see what files/reg keys it is hitting the most. under device manager do you have any unknown devices with no drivers installed?

No unknown device since I updated one from Windows updates. Right now I only have one non MS driver and I already excluded the Intel ACHI driver in my previous tests. Only just now did I install my Creative XFI drivers so I can have a little music while I test. Hard to use a machine with next to nothing on it and try to make up the time to get to crash. If I didn't have at least something on here I would be opening and closing windows all day.

Anyway the Creative is after the crash and Intel was removed in my previous testing and I went back to the INtel AHCI driver. No other unknown devices there. I can review process monitor I have it and I rebooted and I hope that change to the registry captures a dump. If not then we have to look at another way of capturing a application crash.

Back to some testing.....

[sullysnet]

tons of crashes LOL 9 total before I rebooted. Remember these are all application crashes and no system crashes.

Anyway I do not have the right symbols to review them in Win Debug but maybe others can. I also included all of the Process Monitor logs that where collected during both crashes. You will need Process Monitor to review them. All crashes started after

closing Firefox 3.55 but once it crashes it will not crashing until log off or reboot.

Sorry about the RS for the people who hate it but I have an account and it is just easier to place them here

http://rapidshare.com/files/306695076/Logs.zip

thanks

[sullysnet]

trying not to load too many things but I need to at least make the computer usable so I am not bored :p

I changed one thing and I am still testing it to see if that was the issue. If it is I will let others know. I still would like to see

if anyone can see anything more from the debugger.

This is all I see

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Temp\Crash\explorer.exe.1596.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: .sympath SRV*C:\Windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Fri Nov 13 21:01:42.000 2009 (GMT-5)
System Uptime: not available
Process Uptime: 0 days 0:54:46.000
................................................................
................................................................
..................................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(63c.470): Unknown exception - code c000041d (first/second chance not available)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
ntdll!RtlSizeHeap+0x8d:
00000000`7737202d 0fb74118		movzx   eax,word ptr [rcx+18h] ds:00000d92`1d2ca548=????

So either my symbols are off or I am missing something :)

[Anonymous_101]

I added the registry file into my registry. I am waiting for it to crash now. I thought that this was my issue and not sullysnet lol.

[sullysnet]

I added the registry file into my registry. I am waiting for it to crash now. I thought that this was my issue and not sullysnet lol.

sorry :) I thought you gave up :) well I am hoping that we both have a similar issue or a similar fix. So far I think my issue is Firefox 3.55 not playing nicely with Explorer. I still need more time with testing and I figure by either Wed. or earlier I would have tested it long enough. Either today or tonight I want to install the rest or a few more applications and see how that goes. Maybe at least get my Outlook working again :)

Make sure to reboot after importing that registry key. I even went as far to create the directory C:\LocalDumps just in the event there was an issue creating a directory (which shouldn't be the case) but I wanted a dump fast :)

[Preppy Veteran]

@Anon: Cool, it'll be great to see your DMP so we can maybe figure this out.

@Sully: I think you have bad RAM potentially. Those crashes all over the place - I looked at the first seven, and most of them are related to heap corruption issues, with nothing particularly of interest/aberrant that I'm seeing in the crash otherwise.

[sullysnet]

@Anon: Cool, it'll be great to see your DMP so we can maybe figure this out.

@Sully: I think you have bad RAM potentially. Those crashes all over the place - I looked at the first seven, and most of them are related to heap corruption issues, with nothing particularly of interest/aberrant that I'm seeing in the crash otherwise.

I tested the RAM and I will test it again but it comes up clean. I saw the heap corruption as well but this is the same issue someone reported on the Mozilla forum and they where using then in-private mode in Firefox. I was also using that and had

it on as default. Once I disabled as well as the extension I had, it has not crashed (knock on wood, crossing my fingers)

I am still going to do a second rescanning of the memory just to be sure

thanks

[sullysnet]

checked again and memory is perfectly fine when it comes to all tests. Well Mozilla is saying it is an MS issue and not sure if MS even cares. I posted my dumbs on technet but since there is next to nothing in them I do not think they will even look into it.

I am still keeping an eye on the crashes since I have not completely installed everything.

[hairbawl87]

Do you by any chance have the "Launch folder windows in a separate process" ticked on?

[Preppy Veteran]

checked again and memory is perfectly fine when it comes to all tests. Well Mozilla is saying it is an MS issue and not sure if MS even cares. I posted my dumbs on technet but since there is next to nothing in them I do not think they will even look into it.

I am still keeping an eye on the crashes since I have not completely installed everything.

What specifically is wrong on the MS side? I would think that tentatively unlikely in a heap corruption case...

[sullysnet]

Do you by any chance have the "Launch folder windows in a separate process" ticked on?

nope, thanks

[sullysnet]

What specifically is wrong on the MS side? I would think that tentatively unlikely in a heap corruption case...

It was nothing that I had said it was stated on the Mozilla links posted https://support.mozilla.com/en-US/forum/1/481957

I have no clue who's issue it is but it is a fact that since disabling that feature I still have not received an Explorer crash. If no

one wants to take credit for it and resolve it then oh well. I feel since Mozilla designed the feature they need to review and see

if it is possible. They cannot recreate it unless someone builds a VM x64 session and recreates it and lets them download the image. Me I will just stop using that feature and after a few builds who knows maybe it will be resolved.

Seems kind of strange that on x32 version of Win7 using that feature you do not receive the crash but in x64 you do

Edited November 16, 2009 by sullysnet

[Preppy Veteran]

Looks like eldgoat in that thread may have helped identify what's corrupting memory(?). I'd bet that if it was MS side, the FF devs could get in touch with MS to straighten out anything aberrant.

@Anon: Now that it looks like Sully is moving forward, how are you doing? :)

[Anonymous_101]

I have more than 1 DMP file so I will attach them via MegaUpload if thats ok with everyone. I can also attach them via RapidShare and send you the links.

http://www.megaupload.com/?d=AH8A45AL

[Preppy Veteran]

More random memory corruption, probably more bad shell extensions.

Enable pageheap using GFlags from the Windows Debugging Toolkit:

* http://msdn.microsoft.com/en-us/library/cc265942.aspx

- should be

gflags -p /enable explorer.exe

OR

gflags -p /enable explorer.exe /full

(if you have a very solid machine). (Also- http://blogs.technet.com/askperf/archive/2...f-part-two.aspx .)

Then recrash - that should generate a dump with *much* better information. Turn that off when you're done.