I crash is caused by the Intel driver:
Call Site
ntdll!NtWaitForSingleObject
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!KiUserExceptionDispatch
verifier!VerifierStopMessage
verifier!AVrfpDphReportCorruptedBlock
verifier!AVrfpDphCheckNormalHeapBlock
verifier!VerifierCheckPageHeapAllocation
verifier!AVrfpHeapFree
hccutils!DllUnregisterServer
hccutils!GetCUICustomizationKey
hccutils!GetCUICustomizationKey
hccutils!GetCUICustomizationKey
hccutils!CreateThisKey
hccutils!FindResources
hccutils!LoadSTRING
hccutils!SaveString
hccutils!LoadICON
hccutils!LoadIMAGE
igfxcpl!CPlApplet
shell32!CPL_CallEntry
shell32!_InitializeControl
shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''
shell32!CPL_LoadCPLModule
shell32!_LoadCPLModuleAndAdd
shell32!CPLD_InitModule
shell32!CControlPanelEnum::_NextNonCachedCpl
shell32!CControlPanelEnum::Next
shell32!CRegFolderEnum::Next
shell32!CControlPanelAppletList::_AddAppletsToCategories
shell32!CControlPanelAppletList::LoadSlowApplets
shell32!CControlPanelDataWorkItem::_LoadSlowData
shell32!CControlPanelDataWorkItem::DoWork
shell32!CFrameTask::InternalResumeRT
shell32!CRunnableTask::Run
shell32!CShellTask::TT_Run
shell32!CShellTaskThread::ThreadProc
shell32!CShellTaskThread::s_ThreadProc
SHCore!ExecuteWorkItemThreadProc
ntdll!RtlpTpWorkCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
0:031> lmvm igfxcpl
start end module name
00000001`80000000 00000001`80025000 igfxcpl (export symbols) igfxcpl.cpl
Loaded symbol image file: igfxcpl.cpl
Image path: C:\Windows\System32\igfxcpl.cpl
Image name: igfxcpl.cpl
Timestamp: Mon Sep 03 04:50:21 2012 (50441AED)
CheckSum: 00022721
ImageSize: 00025000
File version: 8.15.10.2849
Product version: 8.15.10.2849
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: IGFXCPL
OriginalFilename: IGFXCPL.DLL
ProductVersion: 8.15.10.2849
FileVersion: 8.15.10.2849
PrivateBuild: 8.15.10.2849
SpecialBuild: 8.15.10.2849
FileDescription: igfxcpl Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
0:031> lmvm hccutils
start end module name
00000000`09ee0000 00000000`09eff000 hccutils (export symbols) hccutils.dll
Loaded symbol image file: hccutils.dll
Image path: C:\Windows\System32\hccutils.dll
Image name: hccutils.dll
Timestamp: Mon Sep 03 04:49:28 2012 (50441AB8)
CheckSum: 00023677
ImageSize: 0001F000
File version: 8.15.10.2849
Product version: 8.15.10.2849
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: HCCUTILS
OriginalFilename: HCCUTILS.DLL
ProductVersion: 8.15.10.2849
FileVersion: 8.15.10.2849
PrivateBuild: 8.15.10.2849
SpecialBuild: 8.15.10.2849
FileDescription: hccutils Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
So update the driver or use ShellExView to disable the Intel shell extension.
The second crash looks like a corrupted shel32.dll on the HDD:
CHKIMG_EXTENSION: !chkimg -lo 50 -d !shell32
7fcac39c000-7fcac39c059 90 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43944
[ 4d d8 e8 09 77 b1 ff 48:16 00 00 00 02 00 00 00 ]
7fcac39c05b-7fcac39c07a 32 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+4399f (+0x5b)
[ 8b d8 7c 1d 48 8b 4d e0:00 00 00 00 00 00 00 00 ]
7fcac39c07c-7fcac39c0af 52 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+439c0 (+0x21)
[ 48 8d 4d e0 e8 8b 76 b1:00 00 00 00 00 00 00 00 ]
7fcac39c0b1-7fcac39c0bb 11 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+439f5 (+0x35)
[ a9 ff 48 8b 06 4c 8d 05:00 00 00 00 00 00 00 00 ]
7fcac39c0bd-7fcac39c0c4 8 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43a01 (+0x0c)
[ 8b d3 48 8b ce ff 90 98:00 00 00 00 00 00 00 00 ]
7fcac39c0c8-7fcac39c0ca 3 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43a0c (+0x0b)
[ 90 e9 16:00 00 00 ]
7fcac39c0cc-7fcac39c0e6 27 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43a10 (+0x04)
[ a9 ff cc 48 8b 07 48 8b:00 00 00 00 98 e0 53 ae ]
7fcac39c0e8-7fcac39c0ef 8 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43a2b (+0x1c)
[ 8b d3 48 8b cf ff 90 98:00 00 00 00 00 00 00 00 ]
7fcac39c0f3-7fcac39c0fa 8 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43a36 (+0x0b)
[ 90 e9 be 05 a9 ff bb 18:04 00 00 00 00 00 00 00 ]
7fcac39c0fd-7fcac39c118 28 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43a40 (+0x0a)
[ 80 e9 b4 05 a9 ff cc 48:00 00 00 d0 e0 53 ae fc ]
7fcac39c11c-7fcac39c13c 33 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43a5e (+0x1f)
[ ff 10 90 e9 7c 78 a8 ff:00 00 00 00 00 00 00 04 ]
7fcac39c13f-7fcac39c175 55 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43a80 (+0x23)
[ 80 e9 7d e4 a8 ff cc 48:00 00 f4 53 ae fc 07 00 ]
7fcac39c179-7fcac39c189 17 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43ab8 (+0x3a)
[ 85 c0 75 14 8d 50 01 44:00 00 00 00 00 00 00 ff ]
7fcac39c18b-7fcac39c1b5 43 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43aca (+0x12)
[ 90 e9 0b cf b5 ff 8b d3:ff 00 00 00 00 00 00 00 ]
7fcac39c1b7-7fcac39c1c9 19 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43af5 (+0x2c)
[ 07 80 e9 61 e9 a8 ff 4c:00 00 00 00 00 00 00 00 ]
7fcac39c1cb-7fcac39c1e9 31 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43b09 (+0x14)
[ 10 48 85 db 0f 84 4a e9:ff 00 00 00 00 00 00 00 ]
7fcac39c1eb-7fcac39c1f4 10 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43b27 (+0x20)
[ 07 80 e9 db b3 a8 ff cc:00 00 00 00 00 00 00 00 ]
7fcac39c1f6-7fcac39c208 19 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43b31 (+0x0b)
[ 07 80 e9 28 f4 a8 ff cc:00 00 00 00 00 00 00 00 ]
7fcac39c20a-7fcac39c237 46 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43b42 (+0x14)
[ 50 08 33 c0 e9 81 b4 a8:ff ff 00 00 00 00 00 00 ]
7fcac39c239-7fcac39c240 8 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43b65 (+0x2f)
[ 48 8d 4d e8 41 b9 ff 1c:00 00 00 00 00 00 00 00 ]
7fcac39c243-7fcac39c248 6 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43b6f (+0x0a)
[ 41 83 c8 ff ba 01:00 00 00 00 00 00 ]
7fcac39c24c-7fcac39c25e 19 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43b78 (+0x09)
[ e8 4f 70 b0 ff 83 f8 ff:00 00 00 00 10 00 00 00 ]
7fcac39c260-7fcac39c361 258 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43b8c (+0x14)
[ 80 e9 2d b2 a8 ff 48 8d:00 00 00 00 00 00 00 00 ]
7fcac39c363-7fcac39c36c 10 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43c8d (+0x103)
[ 07 80 e9 b5 bb a8 ff cc:00 00 00 00 00 00 00 00 ]
7fcac39c36e-7fcac39c39b 46 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43c97 (+0x0b)
[ 07 80 e9 c1 da a8 ff cc:00 00 00 00 00 00 00 00 ]
7fcac39c39d-7fcac39c3eb 79 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43cc5 (+0x2f)
[ 3a 90 ff 84 c0 0f 84 cd:00 00 00 00 00 00 00 00 ]
7fcac39c3ed-7fcac39c3f8 12 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43d14 (+0x50)
[ 90 e9 fb e3 b8 ff cc ff:00 00 00 00 00 00 00 00 ]
7fcac39c3fa-7fcac39c405 12 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43d20 (+0x0d)
[ 85 c0 0f 8e 42 8a a8 ff:00 00 00 00 00 00 00 00 ]
7fcac39c408-7fcac39c489 130 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43d2e (+0x0e)
[ 07 80 e9 35 8a a8 ff cc:00 00 00 00 00 00 00 00 ]
7fcac39c48b-7fcac39c4a5 27 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43daf (+0x83)
[ 48 85 db 74 09 48 8b 13:ff 00 00 00 00 00 00 00 ]
7fcac39c4a8-7fcac39c4b5 14 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43dc8 (+0x1d)
[ 00 ff 50 40 85 c0 0f 88:3f 00 00 00 2d 22 04 0b ]
7fcac39c4b9-7fcac39c4bd 5 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43dd9 (+0x11)
[ eb 12 ba 01 00:00 00 00 09 04 ]
7fcac39c4c0-7fcac39c4e7 40 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43de0 (+0x07)
[ ff 50 40 85 c0 0f 88 cb:10 00 00 00 01 00 00 00 ]
7fcac39c4ea-7fcac39c4ff 22 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43e06 (+0x2a)
[ c0 41 8d 51 01 ff 15 43:00 00 00 00 00 00 00 00 ]
7fcac39c501-7fcac39c508 8 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43e1d (+0x17)
[ 48 8d 4d e8 41 b9 ff 1c:00 00 00 00 00 00 00 3f ]
7fcac39c50b-7fcac39c510 6 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43e27 (+0x0a)
[ 41 83 c8 ff ba 01:00 e4 04 00 00 3f ]
7fcac39c514-7fcac39c526 19 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43e30 (+0x09)
[ e8 87 6d b0 ff 83 f8 ff:00 00 00 00 00 00 00 00 ]
7fcac39c528-7fcac39c5a8 129 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43e44 (+0x14)
[ 80 e9 c1 b8 a8 ff 48 8d:f0 d3 bc ab fc 07 00 00 ]
7fcac39c5aa-7fcac39c5ab 2 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43ec6 (+0x82)
[ cc 83:fe ff ]
7fcac39c5ad-7fcac39c5b9 13 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43ec8 (+0x03)
[ 01 0f 85 40 7d a8 ff 48:07 00 00 b0 ad 0d 7b 95 ]
7fcac39c5bb-7fcac39c5d6 28 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43ed6 (+0x0e)
[ 48 8b 11 ff 52 10 90 e9:00 00 00 00 00 02 00 00 ]
7fcac39c5d8-7fcac39c695 190 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43ef2 (+0x1d)
[ 48 8b 11 ff 52 08 90 e9:00 00 00 00 00 00 00 00 ]
7fcac39c699-7fcac39c6eb 83 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43faa (+0xc1)
[ 48 8b ce 41 ff 53 40 8b:00 00 00 00 00 00 00 00 ]
7fcac39c6ef-7fcac39c6f5 7 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+43ffd (+0x56)
[ ff 50 60 c7 07 02 00:00 4a 06 b7 af f7 07 ]
7fcac39c6f8-7fcac39c705 14 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+44006 (+0x09)
[ eb 18 48 8b 01 4c 8d 05:00 00 00 00 00 00 00 00 ]
7fcac39c708-7fcac39c70c 5 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+44016 (+0x10)
[ 00 ff 50 60 c7:22 02 b6 af f7 ]
7fcac39c70e - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+4401c (+0x06)
[ 03:00 ]
7fcac39c710-7fcac39c71e 15 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+4401e (+0x02)
[ 00 00 44 8b c8 e9 a9 a1:40 9d 26 69 e8 00 00 00 ]
7fcac39c720-7fcac39c75c 61 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+4402c (+0x10)
[ 00 00 e9 17 74 a8 ff c7:10 74 0d 7b 95 00 00 00 ]
7fcac39c75e-7fcac39c7c1 100 bytes - shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+44068 (+0x3e)
[ 80 e9 a5 d8 ae ff cc b8:00 00 60 87 53 ae fc 07 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
8192 errors : !shell32 (7fcac39c000-7fcac3aeebb)
APP: explorer.exe
FAULTING_THREAD: 0000000000000f0c
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 000007fcabcc02f5 to 000007fcac39cd00
BUGCHECK_STR: APPLICATION_FAULT_MEMORY_CORRUPTION_INVALID_POINTER_WRITE_LARGE_EXPLOITABLE
PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_LARGE_EXPLOITABLE
DEFAULT_BUCKET_ID: MEMORY_CORRUPTION_LARGE_EXPLOITABLE
STACK_TEXT:
00000000`00000000 00000000`00000000 memory_corruption!shell32+0x0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: memory_corruption!shell32
Repair the DLL with DISM:
http://social.technet.microsoft.com/Forums/en-US/w8itprogeneral/thread/5c651c1b-f800-47c4-801d-98996eaf99a4/#c280a27b-7bc9-43ac-9c1a-2ad97230a9ea