Explorer.exe crashes regularly

4,225 · March 18, 2010

Hi,

I am having a strange problem with one of my XP machine where Explorer.exe crashes regularly upon normal use of browsing folders. I have noticed few times that it crashes on its own when not working with explorer but in 99% cases it crashes when using it.

I have made sure of no virus, no trojan or anything like that but I suspect one of the service or application is causing this. What would be the best way to find out what is causing this? This is going to be used for imaging for other machines so it's pretty important that I fix it. I have tried to format and reinstall everything and that still happens so this led me to believe that it is one of the service that is causing this.

Hope this helps to understand and identify issues.

Cheers :)

4,794 · March 18, 2010

Check the event logs

4,225 · March 18, 2010

Did that already.

This is all I see all the time and a search hasn't helped me or I think I am working too late.

Faulting application explorer.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x0001b21a.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

1,848 · March 18, 2010

I had this issue with my win 7 install. I formatted and changed Anti Virus and it stopped.

4,225 · March 18, 2010

I have formatted multiple times and have reinstalled all the apps. Still happening so I believe this is some app causing memory conflict or something like that with explorer.exe!

2,073 · March 18, 2010

Sounds like a virus.

Possible one of the apps you are installing after the fresh windows install is infected.

4,794 · March 18, 2010

You done a disk check ?

Also people on another forum suggested the following fix

--

Right click My Computer. Click properties. Choose the advanced tab. click environment variables. if you have a system variable called "NLSPATH" you need to delete it or rename it (select the variable, click edit, and change the name). Note that this might mess up what put NLSPATH there in the first place.

--

4,225 · March 18, 2010

Sounds like a virus.

Possible one of the apps you are installing after the fresh windows install is infected.

Nope not a virus since all the apps are legitimate apps like Visual Studio 2008, SQL Server, SmartRules...basically apps related to Development of .NET applications. This is purely a development machine. The trouble is I can't test after installing each app as it is just not possible and after installing everything it's happening.

4,225 · March 18, 2010

You done a disk check ?

Also people on another forum suggested the following fix

--

Right click My Computer. Click properties. Choose the advanced tab. click environment variables. if you have a system variable called "NLSPATH" you need to delete it or rename it (select the variable, click edit, and change the name). Note that this might mess up what put NLSPATH there in the first place.

--

Yups disk check done. Brand new HDD though so shouldn't come with anything nasty and didn't show anything bad after check.

No such variable.

March 18, 2010

WHAT apps have you installed? Usually its an app (that adds itself to the context menu) that makes it crash. It maybe buggy or corrupt

4,225 · March 18, 2010

OK allright. Now we are getting somewhere.

I just checked. Below is what I see in the right click menu.

BeyondCompare

HexEdit

VEdit

MSE

Notepad++

WinRAR

Funny that right after checking this it crashed again! Let me find the dump.

The error report shows a whole heap of HEX data and show the files below will be reported.

&lt;?xml version="1.0" encoding="UTF-16"?&gt;
&lt;DATABASE&gt;
&lt;EXE NAME="SYSTEM INFO" FILTER="GRABMI_FILTER_SYSTEM"&gt;
    &lt;MATCHING_FILE NAME="advapi32.dll" SIZE="617472" CHECKSUM="0xA0887D0D" BIN_FILE_VERSION="5.1.2600.5755" BIN_PRODUCT_VERSION="5.1.2600.5755" PRODUCT_VERSION="5.1.2600.5755" FILE_DESCRIPTION="Advanced Windows 32 Base API" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft? Windows? Operating System" FILE_VERSION="5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)" ORIGINAL_FILENAME="advapi32.dll" INTERNAL_NAME="advapi32.dll" LEGAL_COPYRIGHT="? Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xA5BB8" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5755" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5755" LINK_DATE="02/09/2009 12:10:48" UPTO_LINK_DATE="02/09/2009 12:10:48" VER_LANGUAGE="English (United States) [0x409]" /&gt;
    &lt;MATCHING_FILE NAME="gdi32.dll" SIZE="286720" CHECKSUM="0x98314A3F" BIN_FILE_VERSION="5.1.2600.5698" BIN_PRODUCT_VERSION="5.1.2600.5698" PRODUCT_VERSION="5.1.2600.5698" FILE_DESCRIPTION="GDI Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft? Windows? Operating System" FILE_VERSION="5.1.2600.5698 (xpsp_sp3_gdr.081022-1932)" ORIGINAL_FILENAME="gdi32" INTERNAL_NAME="gdi32" LEGAL_COPYRIGHT="? Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x4CE95" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5698" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5698" LINK_DATE="10/23/2008 12:36:14" UPTO_LINK_DATE="10/23/2008 12:36:14" VER_LANGUAGE="English (United States) [0x409]" /&gt;
    &lt;MATCHING_FILE NAME="kernel32.dll" SIZE="989696" CHECKSUM="0x2D998938" BIN_FILE_VERSION="5.1.2600.5781" BIN_PRODUCT_VERSION="5.1.2600.5781" PRODUCT_VERSION="5.1.2600.5781" FILE_DESCRIPTION="Windows NT BASE API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft? Windows? Operating System" FILE_VERSION="5.1.2600.5781 (xpsp_sp3_gdr.090321-1317)" ORIGINAL_FILENAME="kernel32" INTERNAL_NAME="kernel32" LEGAL_COPYRIGHT="? Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xFE572" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5781" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5781" LINK_DATE="03/21/2009 14:06:58" UPTO_LINK_DATE="03/21/2009 14:06:58" VER_LANGUAGE="English (United States) [0x409]" /&gt;
    &lt;MATCHING_FILE NAME="ntdll.dll" SIZE="714752" CHECKSUM="0xC695BA95" BIN_FILE_VERSION="5.1.2600.5755" BIN_PRODUCT_VERSION="5.1.2600.5755" PRODUCT_VERSION="5.1.2600.5755" FILE_DESCRIPTION="NT Layer DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft? Windows? Operating System" FILE_VERSION="5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)" ORIGINAL_FILENAME="ntdll.dll" INTERNAL_NAME="ntdll.dll" LEGAL_COPYRIGHT="? Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xBC674" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5755" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5755" LINK_DATE="02/09/2009 12:10:48" UPTO_LINK_DATE="02/09/2009 12:10:48" VER_LANGUAGE="English (United States) [0x409]" /&gt;
    &lt;MATCHING_FILE NAME="ole32.dll" SIZE="1287168" CHECKSUM="0xB764FEEA" BIN_FILE_VERSION="5.1.2600.5512" BIN_PRODUCT_VERSION="5.1.2600.5512" PRODUCT_VERSION="5.1.2600.5512" FILE_DESCRIPTION="Microsoft OLE for Windows" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft? Windows? Operating System" FILE_VERSION="5.1.2600.5512 (xpsp.080413-2108)" ORIGINAL_FILENAME="OLE32.DLL" INTERNAL_NAME="OLE32.DLL" LEGAL_COPYRIGHT="? Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x14744B" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5512" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5512" LINK_DATE="04/14/2008 00:10:57" UPTO_LINK_DATE="04/14/2008 00:10:57" VER_LANGUAGE="English (United States) [0x409]" /&gt;
    &lt;MATCHING_FILE NAME="oleaut32.dll" SIZE="551936" CHECKSUM="0xE8E0E87" BIN_FILE_VERSION="5.1.2600.5512" BIN_PRODUCT_VERSION="5.1.2600.5512" PRODUCT_VERSION="5.1.2600.5512" COMPANY_NAME="Microsoft Corporation" FILE_VERSION="5.1.2600.5512" INTERNAL_NAME="OLEAUT32.DLL" LEGAL_COPYRIGHT="Copyright ? Microsoft Corp. 1993-2001." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x8D4E3" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5512" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5512" LINK_DATE="04/14/2008 00:10:58" UPTO_LINK_DATE="04/14/2008 00:10:58" VER_LANGUAGE="English (United States) [0x409]" /&gt;
    &lt;MATCHING_FILE NAME="shell32.dll" SIZE="8461312" CHECKSUM="0x229B7DE8" BIN_FILE_VERSION="6.0.2900.5622" BIN_PRODUCT_VERSION="6.0.2900.5622" PRODUCT_VERSION="6.00.2900.5622" FILE_DESCRIPTION="Windows Shell Common Dll" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft? Windows? Operating System" FILE_VERSION="6.00.2900.5622 (xpsp_sp3_gdr.080617-1319)" ORIGINAL_FILENAME="SHELL32.DLL" INTERNAL_NAME="SHELL32" LEGAL_COPYRIGHT="? Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x812125" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="6.0.2900.5622" UPTO_BIN_PRODUCT_VERSION="6.0.2900.5622" LINK_DATE="06/17/2008 19:02:17" UPTO_LINK_DATE="06/17/2008 19:02:17" VER_LANGUAGE="English (United States) [0x409]" /&gt;
    &lt;MATCHING_FILE NAME="user32.dll" SIZE="578560" CHECKSUM="0x6280E825" BIN_FILE_VERSION="5.1.2600.5512" BIN_PRODUCT_VERSION="5.1.2600.5512" PRODUCT_VERSION="5.1.2600.5512" FILE_DESCRIPTION="Windows XP USER API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft? Windows? Operating System" FILE_VERSION="5.1.2600.5512 (xpsp.080413-2105)" ORIGINAL_FILENAME="user32" INTERNAL_NAME="user32" LEGAL_COPYRIGHT="? Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x8FC76" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5512" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5512" LINK_DATE="04/14/2008 00:11:07" UPTO_LINK_DATE="04/14/2008 00:11:07" VER_LANGUAGE="English (United States) [0x409]" /&gt;
    &lt;MATCHING_FILE NAME="wininet.dll" SIZE="916480" CHECKSUM="0x76D44F45" BIN_FILE_VERSION="8.0.6001.18854" BIN_PRODUCT_VERSION="8.0.6001.18854" PRODUCT_VERSION="8.00.6001.18854" FILE_DESCRIPTION="Internet Extensions for Win32" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Windows? Internet Explorer" FILE_VERSION="8.00.6001.18854 (longhorn_ie8_gdr.091026-1700)" ORIGINAL_FILENAME="wininet.dll" INTERNAL_NAME="wininet.dll" LEGAL_COPYRIGHT="? Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xE32B0" LINKER_VERSION="0x60000" UPTO_BIN_FILE_VERSION="8.0.6001.18854" UPTO_BIN_PRODUCT_VERSION="8.0.6001.18854" LINK_DATE="10/29/2009 07:45:37" UPTO_LINK_DATE="10/29/2009 07:45:37" VER_LANGUAGE="English (United States) [0x409]" /&gt;
    &lt;MATCHING_FILE NAME="winsock.dll" SIZE="2864" CHECKSUM="0x73AE8088" BIN_FILE_VERSION="3.10.0.103" BIN_PRODUCT_VERSION="3.10.0.103" PRODUCT_VERSION="3.10" FILE_DESCRIPTION="Windows Socket 16-Bit DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft? Windows(TM) Operating System" FILE_VERSION="3.10" ORIGINAL_FILENAME="WINSOCK.DLL" INTERNAL_NAME="WINSOCK" LEGAL_COPYRIGHT="Copyright ? Microsoft Corp. 1981-1996" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x10001" VERFILETYPE="0x2" MODULE_TYPE="WIN16" S16BIT_DESCRIPTION="BSD Socket API for Windows" S16BIT_MODULE_NAME="WINSOCK" UPTO_BIN_FILE_VERSION="3.10.0.103" UPTO_BIN_PRODUCT_VERSION="3.10.0.103" VER_LANGUAGE="English (United States) [0x409]" /&gt;
&lt;/EXE&gt;
&lt;EXE NAME="SHELL32.dll" FILTER="GRABMI_FILTER_THISFILEONLY"&gt;
    &lt;MATCHING_FILE NAME="shell32.dll" SIZE="8461312" CHECKSUM="0x229B7DE8" BIN_FILE_VERSION="6.0.2900.5622" BIN_PRODUCT_VERSION="6.0.2900.5622" PRODUCT_VERSION="6.00.2900.5622" FILE_DESCRIPTION="Windows Shell Common Dll" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft? Windows? Operating System" FILE_VERSION="6.00.2900.5622 (xpsp_sp3_gdr.080617-1319)" ORIGINAL_FILENAME="SHELL32.DLL" INTERNAL_NAME="SHELL32" LEGAL_COPYRIGHT="? Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x812125" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="6.0.2900.5622" UPTO_BIN_PRODUCT_VERSION="6.0.2900.5622" LINK_DATE="06/17/2008 19:02:17" UPTO_LINK_DATE="06/17/2008 19:02:17" VER_LANGUAGE="English (United States) [0x409]" /&gt;
&lt;/EXE&gt;
&lt;/DATABASE&gt;

This what the event log shows. Two crashes back to back!

Faulting application explorer.exe, version 6.0.2900.5512, faulting module shell32.dll, version 6.0.2900.5622, fault address 0x0002f18e.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

Faulting application explorer.exe, version 6.0.2900.5512, faulting module ole32.dll, version 5.1.2600.5512, fault address 0x0001d7e9.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

Hope this takes me to right place.

March 18, 2010

Dont think MSE would cause it. If the others have an option (in the program), to remove it from the context menu, untick it. See which one fixes the crashing. Are you using some kind of virtual cd program as well? ie: Daemontools ? Post a hijackthis log, we'll see what else in on your system

4,225 · March 18, 2010

Thanks Paul.

No I am not using any virtual programs however the machine itself runs in a VMWare. Sorry I didn't mention this before as I manage around 300 GB worth of VMs ranging from different OS and programs. This is the only one having this specific problem. All the VMs I have are development VMs and they all have the same basic setup of Visual Studio and .NET framework. This has more stuff installed on it due to client requirements and that is what I want to find out which extension DLL is causing this.

Here is the HijackThis log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:19:40 PM, on 18/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\VMware\VMware Tools\vmacthlp.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\DevTools\Kontac\Smart Rules\Services\SmartRules.WatchServices.exe
C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VMware\VMware Tools\VMwareTray.exe
C:\Program Files\VMware\VMware Tools\VMwareUser.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\devenv.exe
C:\Apps\Notepad++\notepad++.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Microsoft Shared\Help 9\dexplore.exe
C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\devenv.exe
C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\devenv.exe
V:\Development\Projects\MEGT\Source\Releases\Release 18.0\Optimum\Utilities\AzManReport\bin\Debug\AzManReport.vshost.exe
V:\Development\Projects\MEGT\Source\Releases\Release 18.1\Optimum\Automation\FFS\bin\Debug\FFS.vshost.exe
C:\Documents and Settings\NiravP\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = itproxy.megt.com.au:8081
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: IEInspector Browser Helper - {9B43B7B1-BF56-4708-81D2-332D708B0DD9} - C:\PROGRA~1\IEINSP~1\HTTPAN~1\IEINSP~1.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [VMware Tools] "C:\Program Files\VMware\VMware Tools\VMwareTray.exe"
O4 - HKLM\..\Run: [VMware User Process] "C:\Program Files\VMware\VMware Tools\VMwareUser.exe"
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: CCTray.lnk = C:\Apps\CCTray\cctray.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&amp;xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: IE HTTPAnalyzer V5 - {858CFDE9-D018-453E-80D9-FD4FC3EF631E} - C:\PROGRA~1\IEINSP~1\HTTPAN~1\IEHTTP~1.DLL
O9 - Extra 'Tools' menuitem: IE HTTPAnalyzer V5 - {858CFDE9-D018-453E-80D9-FD4FC3EF631E} - C:\PROGRA~1\IEINSP~1\HTTPAN~1\IEHTTP~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware tools\vsock sdk\bin\win32\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware tools\vsock sdk\bin\win32\vsocklib.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1245644833708
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1245644823754
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = maxit.com.au
O17 - HKLM\Software\..\Telephony: DomainName = maxit.com.au
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = maxit.com.au
O20 - Winlogon Notify: TPSvc - C:\WINDOWS\SYSTEM32\TPSvc.dll
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HttpAnalyzerV5 CodeHook service (HttpAnalyzerV5 DllInjectService) - Unknown owner - C:\Program Files\IEInspector\HTTPAnalyzerFullV5\InjectWinSockServiceV5.exe
O23 - Service: Smart Rules Watch Services (SmartRules.WatchServices) - Home - C:\DevTools\Kontac\Smart Rules\Services\SmartRules.WatchServices.exe
O23 - Service: TP AutoConnect Service (TPAutoConnSvc) - ThinPrint GmbH - C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe
O23 - Service: VMware Tools Service (VMTools) - VMware, Inc. - C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
O23 - Service: VMware Upgrade Helper (VMUpgradeHelper) - VMware, Inc. - C:\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe
O23 - Service: VMware Physical Disk Helper Service - VMware, Inc. - C:\Program Files\VMware\VMware Tools\vmacthlp.exe

--
End of file - 8821 bytes

Cheers :)

March 18, 2010

Looks good to me. Only other thing to try is untick the context menu option in the programs you mentioned (if they've got the option). Is Winrar the latest version (it was updated to 3.93 the other day). Or uninstall them (except MSE) see if it crashes. If it doesnt install them again one by one, and see if one crashes

4,225 · March 18, 2010

Checked WinRAR, Notepad++, VEdit, HexEdit and BeyondCompre. No change so there must be something else!

Is there a way to analyze error dump log?

March 18, 2010

Hey I was just reading this and thought I'd offer two other possibilities that nobody else has mentioned yet:

1) a faulty DIMM. Have you booted the computer into memtest86+ and done a check?

2) PSU may be dying or underpowered for the machine. I've run into issues like a few times before. Once the power supply was simply starting to malfunction and voltage stability across all the rails was fluctuating all over the place leading to similar glitches to the ones you describe. Another time, I tried using an old 400W PSU as a temporary solution on my gaming rig when its 850W psu failed, which resulted in similar BSODs.

Mine weren't always specifically related to explorer.exe, but given that in both instances you posted it was another windows dll that actually caused explorer.exe to crash, this still seems pretty random. Especially given the way sometimes you can use explorer for awhile without a crash but other times it crashes instantly. Just my hunch, but I am thinking its either a memory problem or a power related problem.

4,225 · March 18, 2010

Both of those done. Just replaced memory modules with 2X4GB and no PSU issues as this is a laptop. Like I said, this happends with only this specific VM and no other VMs making me sure that this is not a hardware problem but some sort of software conflict or something like that.

BTW I am not getting BSODs but just a normal EXEPLORER.EXE crashed and I hit ok and everything turns black until Windows starts it again.

March 18, 2010

You should be able to open task manager then go to file / new task / run. Type explorer.exe to bring things up again. You may have this. Does the black screen appear in safe mode as well?

4,225 · March 18, 2010

Thanks Paul. It automatically starts the Explorer.exe so no need to start it. I am not getting that kinda blank screen as it only does it while it restarts the explorer.exe.

March 18, 2010

Are the folders youre browsing shared?? Can you share folders in VMWare?

March 18, 2010

Invalid video and image files also can make explorer.exe leak when/if it tries to create thumbnails and get tags. Unlike newer Windows' version, XP doesn't have anykind error supression or validity check.

Do you happen to have mobile devices, network devices or drives integrated to explorer?

PS. Adobe's lines in your HJT makes little boy inside me cry.

6,429 · March 18, 2010

What I suggest you do is, go to "run" and type "msconfig" (Without the " ") and go and disable all the things that start up on boot then put them back one by one until you ID the app that is causing the issue! Good luck!

4,225 · March 18, 2010

Are the folders youre browsing shared?? Can you share folders in VMWare?

Yes you can share folders in VMWare but not it's not happening on anything like that but happens anywhere in explorer.

Invalid video and image files also can make explorer.exe leak when/if it tries to create thumbnails and get tags. Unlike newer Windows' version, XP doesn't have anykind error supression or validity check.

Do you happen to have mobile devices, network devices or drives integrated to explorer?

PS. Adobe's lines in your HJT makes little boy inside me cry.

No audio/video files there. Only images are icons for development purposes but then again this happens everywhere not just on a specific folder.

Only mobile device driver I have is with ActiveSync.

Yeah adobe is ****ing **** when it comes to startup applications. I remove them and they just come back!

What I suggest you do is, go to "run" and type "msconfig" (Without the " ") and go and disable all the things that start up on boot then put them back one by one until you ID the app that is causing the issue! Good luck!

Did that already no joy!

March 20, 2010

Hi! please enter "cmd.exe" , and run command "sfc /scannow" after that windows may ask you to insert a windows XP CD, then wait this process finish up, try it again, and see if there are some errors???

May 20, 2010

I have exactly the same issue.

Context menu use crashes Win7-64 to BSD under VMWare.

The culprit in my case is WinRar (3.93 registered version) - un-check the "shell integration" ie the context menu options and its stable under VMWare. Check them and it BSDs as soon as I try to show a context menu in explorer.

Interestingly I run this partition under VMWare (Booting from a physical partition) and so can boot the partition directly - when running native on the physical machine this error doesn't happen.

My conclusion is that there is a VMWare tools bug, at least I assume that's where its introduced but I've yet to uninstall VMWare tools to confirm this but that's the bit that installs and twiddles with things at the OS layer- as soon as I do confirm I'll raise a bug with VMWare.

Cheers

A.

Sign In

Explorer.exe crashes regularly

Recommended Posts

wrack

Link to comment

Share on other sites

Phenom II

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

Ridlas

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

jasondefaoite

Link to comment

Share on other sites

Phenom II

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

John.D

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

John.D

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

John.D

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

a.mcdear

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

John.D

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

John.D

Link to comment

Share on other sites

Gocom

Link to comment

Share on other sites

Farstrider

Link to comment

Share on other sites

wrack

Link to comment

Share on other sites

zyfse

Link to comment

Share on other sites

Ammnesiac

Link to comment

Share on other sites

Recently Browsing 0 members