Technology Tips and News
I have installed Windows 8 Pro x64 as a clean install. Every few minutes the explorer shell will crash and reload. The reliability report monitor is filled with "Windows Explorer has stopped working".
I'm definitely not the only one experiencing this issue. A quick search online shows other people reporting their Windows 8 explorer frequently crashes. Is there a solution?
Hi,
does this happen also with a new user account?
Best greetings from Germany
Olaf
https://skydrive.live.com/redir?resid=48983623CE517F74!894
Thanks for responding to my problem!
The explroer crashes becasue of a visal issue (duser!TransitionVisual::PushOpacityToLeaves)
FAULTING_IP:
duser!TransitionVisual::PushOpacityToLeaves+121
000007fd`1f0efbe5 488b01 mov rax,qword ptr [rcx]
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fd1f0efbe5 (duser!TransitionVisual::PushOpacityToLeaves+0x0000000000000121)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
PROCESS_NAME: explorer.exeChild-SP RetAddr Call Site 00000000`044ddfa0 000007fd`1f0efbb7 duser!TransitionVisual::PushOpacityToLeaves+0x121 00000000`044ddff0 000007fd`1f0efb49 duser!DuVisual::xdSetFlags+0x254 00000000`044de040 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xb1 00000000`044de070 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee 00000000`044de0a0 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee 00000000`044de0d0 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee 00000000`044de100 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee 00000000`044de130 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee 00000000`044de160 000007fd`1f0efa64 duser!ClearPushedOpacitiesFromGadgetTree+0xee 00000000`044de190 000007fd`1f58fae7 duser!ClearPushedOpacitiesFromGadgetTree+0xee 00000000`044de1c0 000007fd`1f58f9f1 dui70!HandleLauncher+0x178 00000000`044de4c0 000007fd`1f5f35d4 dui70!AnimationTrap::_CheckNotifyStart+0x366 00000000`044de580 000007fd`1f571ef9 dui70!DirectUI::Element::OnEvent+0x12b 00000000`044de5f0 000007fd`1f0d58d4 dui70!DirectUI::Element::_DisplayNodeCallback+0x19b 00000000`044de9f0 000007fd`1f0d596a duser!GPCB::xwInvokeFull+0x1e4 00000000`044dead0 000007fd`1f5f50c4 duser!DUserSendEvent+0xc7 00000000`044deb10 000007fd`1f58f985 dui70!DirectUI::FireAnimationEvent+0xac 00000000`044deb60 000007fd`163785e8 dui70!DirectUI::PVLLauncherAnimationTriggers::TriggerLauncher+0x245 00000000`044debb0 000007fd`163bd9d2 twinui!CImmersiveLauncherApps::_TriggerLaunchDismissAnimation+0x3f6 00000000`044ded10 000007fd`163be309 twinui!CImmersiveLauncherApps::OnHidden+0x62 00000000`044ded40 000007fd`163789be twinui!CImmersiveLauncher::_Hide+0x207 00000000`044dedc0 000007fd`21222005 twinui!CImmersiveLauncher::ActiveZbandChanged+0x17d 00000000`044deea0 000007fd`21336221 rpcrt4!Invoke+0x65 00000000`044def00 000007fd`2123c455 rpcrt4!Ndr64StubWorker+0xc01 00000000`044df570 000007fd`214bb53f rpcrt4!NdrStubCall3+0xb5 00000000`044df5d0 000007fd`214bb451 combase!CStdStubBuffer_Invoke+0x67 00000000`044df600 000007fd`2136392b combase!SyncStubInvoke+0x131 00000000`044df720 000007fd`214bcc85 combase!CCtxComChnl::ContextInvoke+0x25b 00000000`044df940 000007fd`214bbc84 combase!AppInvoke+0x307 00000000`044dfa60 000007fd`21362bac combase!ComInvokeWithLockAndIPID+0x60a 00000000`044dfc50 000007fd`2156171e combase!ThreadWndProc+0x2da 00000000`044dfd30 000007fd`215614d7 user32!UserCallWinProcCheckWow+0x13a 00000000`044dfdf0 000007fd`1f041264 user32!DispatchMessageWorker+0x1a7 00000000`044dfe70 000007fd`1f0435c0 windows_immersiveshell_serviceprovider!CImmersiveShellController::_ImmersiveShellComponentsThreadProcInternal+0x2a6 00000000`044dff10 000007fd`22ee167e windows_immersiveshell_serviceprovider!CImmersiveShellController::s_ImmersiveShellComponentsThreadProc+0x75 00000000`044dff40 000007fd`23b93501 kernel32!BaseThreadInitThunk+0x1a 00000000`044dff70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
Contact the support:
I too have the same issue, searched all over the place.
Heres my dmp file. http://sdrv.ms/TpJIJF
I solved this by using the new "Refresh My PC" feature in Windows 8.
Yes, it was a pain to re-install my programs and drivers. However, Windows is running great and explorer does not crash.
I solved this by using the new "Refresh My PC" feature in Windows 8.
Yes, it was a pain to re-install my programs and drivers. However, Windows is running great and explorer does not crash.
ok, looks like some Windows files got damaged.
@Shivaram
check for damaged files, too:
http://blogs.technet.com/b/joscon/archive/2012/09/26/fixing-component-store-corruption-in-windows-8-and-windows-server-2012.aspx
One issue still remains; navigating folders in Windows 8 file explorer is slow.
On Windows 7 I could:
On Windows 8:
Here is another post describing the same issue as mine. Microsoft Community Why is Windows 8 File Explorer So Slow?
My explorer crashes aswell on three ocasions. 1. Randomly, without doing something, about 3-4 times a day. 2. When Starting a Chrome Application Shortcut. 3. When Starting Dropbox.
The dumps turn out to be huge, even if i zip them with 7-zip.
Since my explorer also crashes when i launch Dropbox and i don't have enough space on SkyDrive i chose to upload the splitted zip (webupload limitation) to box.net:
https://www.box.com/s/kj8jhoqrdypvx8uxx1tf
https://www.box.com/s/xuzezttoi8tozdctundx
https://www.box.com/s/0lmm83815rrf6npxj2re
https://www.box.com/s/xqzle6i0nrd6q4hk1j64
https://www.box.com/s/roqwt3sg5kq8h6rpvl3l
What tool do you use to analyse these dumps?
Thanks for your time!
disable Windows Defender.One issue still remains; navigating folders in Windows 8 file explorer is slow.
My explorer crashes aswell on three ocasions.
What tool do you use to analyse these dumps?
I use WinDbg from the Debugging Tools for Windows. Looks like your Intel GPU driver causes the crashes:
STACK_TEXT: 00000000`00000000 00000000`00000000 igd10umd64.dll!Unknown+0x0 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: igd10umd64.dll!Unknown FOLLOWUP_NAME: igfx-gpu MODULE_NAME: igd10umd64 FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_igd10umd64.dll!Unknown Followup: igfx-gpu 0x000007fce6295be5: verifier!AVrfpInitializeCriticalSectionCommon+0x115 0x000007fce33ac1ee: igd10umd64+0x13C1EE 0x000007fce33910cd: igd10umd64+0x1210CD 0x000007fce338f352: igd10umd64+0x11F352 0x000007fce38d68a2: igd10umd64+0x6668A2 0x000007fce38d7d35: igd10umd64+0x667D35 0x000007fce390393b: igd10umd64+0x69393B 0x000007fce3903afd: igd10umd64!OpenAdapter10_2+0x3D 0x000007fce4886d1d: atiuxp64!OpenAdapter10_2+0x4125 0x000007fce488276f: atiuxp64!XopEnumerateAdapters10+0xC7 0x000000006ff2a2a4: aticfx64!OpenAdapter10_2+0x91E4 0x000000006ff2a080: aticfx64!OpenAdapter10_2+0x8FC0 0x000000006ff210e9: aticfx64!OpenAdapter10_2+0x29 0x000007fce4c25757: dlumd64!SetDxHelperAppMode+0x43D7 0x000007fce4c21375: dlumd64!OpenAdapter10_2+0x65 0x000007fce5a09ef9: d3d11!NDXGI::CUMDAdapter::CUMDAdapter+0x175 0x000007fce5a09c5c: d3d11!CCreateDeviceCache::CUMDAdapterCache::Load+0xA0 0x000007fce5a09aa4: d3d11!CCreateDeviceCache::CAdapterCache::ResolveUMDAndVersion+0xD4 0x000007fce5a0989d: d3d11!D3D11CoreCreateDevice+0x3D5 0:009> lmvm igd10umd64 start end module name 000007fc`e3270000 000007fc`e3be4000 igd10umd64 (deferred) Image path: C:\Windows\System32\igd10umd64.dll Image name: igd10umd64.dll Timestamp: Tue Jul 31 19:39:56 2012 (5018186C) CheckSum: 00000000 ImageSize: 00974000 File version: 8.15.10.2827 Product version: 8.15.10.2827 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.8 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Intel Corporation ProductName: Intel Graphics Accelerator Drivers for Windows 7(R) InternalName: igd10umd64.dll OriginalFilename: igd10umd64.dll ProductVersion: 8.15.10.2827 FileVersion: 8.15.10.2827 FileDescription: LDDM User Mode Driver for Intel(R) Graphics Technology LegalCopyright: Copyright (c) 1998-2006 Intel Corporation.
000007fc`e4880000 000007fc`e4892000 atiuxp64 (export symbols) atiuxp64.dll
Loaded symbol image file: atiuxp64.dll
Image path: C:\Windows\System32\atiuxp64.dll
Image name: atiuxp64.dll
Timestamp: Fri Feb 17 04:39:05 2012 (4F3DCBD9)
CheckSum: 00015954
ImageSize: 00012000
File version: 8.14.1.6248
Product version: 8.14.1.6248
File flags: 0 (Mask 0)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: Advanced Micro Devices, Inc.
ProductName: Advanced Micro Devices, Inc PowerXpress Vista DX10 User Mode Driver
InternalName: atiuxpag.dll
OriginalFilename: atiuxpag.dll
ProductVersion: 8.14.01.6248
FileVersion: 8.14.01.6248
PrivateBuild: 4
SpecialBuild: DevStudio Build
FileDescription: atiuxpag.dll
LegalCopyright: Copyright (C) 2007 Advanced Micro Devices, Inc.
LegalTrademarks: PowerXpress (TM) is a Trademark of ATI Technologies Inc.
0:009> lmvm aticfx64
start end module name
00000000`6ff20000 00000000`70020000 aticfx64 C (export symbols) aticfx64.dll
Loaded symbol image file: aticfx64.dll
Image path: C:\Windows\System32\aticfx64.dll
Image name: aticfx64.dll
Timestamp: Fri Feb 17 05:53:58 2012 (4F3DDD66)
CheckSum: 00000000
ImageSize: 00100000
File version: 8.17.10.1114
Product version: 8.17.10.1114
File flags: 0 (Mask 0)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: Advanced Micro Devices, Inc.
ProductName: AMD Inc. Radeon DirectX 11 Driver
InternalName: aticfx64.dll
OriginalFilename: aticfx64.dll
ProductVersion: 8.17.10.1114
FileVersion: 8.17.10.1114
PrivateBuild: Built by swtools on CNABCD05 on 02/16/12 at 23:53
SpecialBuild: DevStudio Build
FileDescription: aticfx64.dll
LegalCopyright: Copyright (C) 1998-2012 AMD Inc.
LegalTrademarks: Radeon (TM) is a Trademark of AMD Inc.
I forgot to tell you 1 thing:
After you updated the drivers, delete the created registry key. Appverifier slows down the Explorer too much.
Hi Andre,
I am having the same irregular crashing issue with my clean install of Windows 8 on an originally Windows 7 Fujitsu TH700 Tablet PC. So far I have installed minimally everything else that is required and it works like a treat barring this particular problem. I tried disabling Windows Defender also to no avail.
I have tried several different versions of the (Intel) Video Drivers including the original manufacturer's Windows 7 drivers which I am currently still running but still have the problem although arguably less often (it varies). Intel doesn't explicitly support my older video hardware with Windows 8 and I noticed some visual artefacts with the Microsoft Intel driver that Windows 8 clean installs.
I am after some help or advice after trying your REG file to save some local dumps - very large BTW - and made my machine scream to a halt until I edited the registry again and rebooted. I am glad I limited the number of dumps to three but I think I will make this one next time - it would nice if it is possible to make it a one shot and then delete/move/rename to get more than one if possible once my machine is up and running.
I can install WinDbg for myself with some tips and I would need Windows 8 symbols I guess which are also likely to be huge or I can post the dumps to my Skydrive and make then available to you. (iv'e deleted them but ill have no problem generating more and I am tempted to go back and upgrade to the default drivers that get W8 installs. I am a developer but just haven't messed around with Windows Debugging and Symbols (to tell you the truth I don't particularly want to)....
Hi Andre,
I am having the same irregular crashing issue with my clean install of Windows 8 on an originally Windows 7 Fujitsu TH700 Tablet PC. So far I have installed minimally everything else that is required and it works like a treat barring this particular problem. I tried disabling Windows Defender also to no avail.
I have tried several different versions of the (Intel) Video Drivers including the original manufacturer's Windows 7 drivers which I am currently still running but still have the problem although arguably less often (it varies). Intel doesn't explicitly support my older video hardware with Windows 8 and I noticed some visual artefacts with the Microsoft Intel driver that Windows 8 clean installs.
I am after some help or advice after trying your REG file to save some local dumps - very large BTW - and made my machine scream to a halt until I edited the registry again and rebooted. I am glad I limited the number of dumps to three but I think I will make this one next time - it would nice if it is possible to make it a one shot and then delete/move/rename to get more than one if possible once my machine is up and running.
I can install WinDbg for myself with some tips and I would need Windows 8 symbols I guess which are also likely to be huge or I can post the dumps to my Skydrive and make then available to you. (iv'e deleted them but ill have no problem generating more and I am tempted to go back and upgrade to the default drivers that get W8 installs. I am a developer but just haven't messed around with Windows Debugging and Symbols (to tell you the truth I don't particularly want to)....
In essence, Windows 8 appears to be a bug-ridden disaster. Never in the history of Windows have I encountered an OS that crashes/bombs/hangs this much, and this Explorer crash issue takes things to new heights. Absolutely shocking.
I am running a Lenovo M92P Tiny with i5, 4G & 500GB HDD. It worked fantastically well on Windows 7 when I got it a month ago. I then went through the $18 upgrade process, and bingo. My machine has become a pig.
Disgusting. Are we asking too much for the simple file structure to work correctly? I am not asking for 5 year old devices to work as intended at purchase. I just want to be able to access, manage and use files.
Andre,
Here's the link to my dump zip. I would be grateful if you would please verify it for me?
I've been fighting this problem a lot for weeks now. I tried the DISM command you mentioned for corrupted files. This worked for a day or so, then the problem returned. So now I'm wondering if there is something else going on. I did this command:
DISM /Online /Cleanup-Image /RestoreHealth
I also tried to use WinDbg to view the dmp myself. That didn't work out for me since I really didn't know what I was looking at at all. Here's what I got when I did that. Doesn't look like WinDbg is set up properly or something.
Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\LocalDumps\explorer.exe.2812.dmp] User Mini Dump File with Full Memory: Only application data is available Symbol search path is: *** Invalid *** **************************************************************************** * Symbol loading may be unreliable without a symbol search path. * * Use .symfix to have the debugger choose a symbol path. * * After setting your symbol path, use .reload to refresh symbol locations. * **************************************************************************** Executable search path is: Windows 8 Version 9200 MP (4 procs) Free x86 compatible Product: WinNt, suite: SingleUserTS Built by: 6.2.9200.16384 (win8_rtm.120725-1247) Machine Name: Debug session time: Thu Dec 27 18:13:59.000 2012 (UTC - 7:00) System Uptime: 0 days 0:04:47.467 Process Uptime: 0 days 0:02:28.000 ................................................................ ................................................................ ................................................................ ............................................................ Loading unloaded module list ..................... This dump file has an exception of interest stored in it. The stored exception information can be accessed via .ecxr. (afc.d18): Unknown exception - code c000071f (first/second chance not available) *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for KERNELBASE.dll - eax=00000000 ebx=00000002 ecx=00000001 edx=00000001 esi=00000002 edi=0e22f584 eip=77d66954 esp=0e22f348 ebp=0e22f36c iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!KiFastSystemCallRet: 77d66954 c3 retThanks, Andre.
you get this error:
STATUS_CALLBACK_RETURNED_LANG A threadpool worker thread enter a callback, which left with preferred languages set. This is unexpected, indicating that the callback missed clearing them.
but I can't see anything useful. Disable 3rd party extensions like MozyHome (mozyshell.dll).
(Also remove my settings, this will slowdown the Explorer. go to the registry and delete both keys)
this is not a sensible approach for the solution.
we need solution for the same.
plz if any body have any solution of windows 8 explorer crash reply
Error shows.
The program explorer.exe version 6.2.9200.16384 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 54f4
Start Time: 01cde70e132f4749
Termination Time: 0
Application Path: C:\Windows\explorer.exe
Report Id: 72950975-531e-11e2-afae-0019d196c54d
Faulting package full name:
Faulting package-relative application ID:
@ amJad shafiq
I felt the same way about using "Refresh PC". I found that irksome at first just like you seem to. It's just a catch all solution for things that can't be solved a better way. However, If you're using Windows 8 and have not tried this yet,
you may want to consider it. It's really smooth. You really don't lose any data at all. I like the "list of uninstalled applications" HTML file on the desktop after the refresh completes. It makes things fairly easy to reinstall.
So I would urge you to not waste time on other solutions, but I understand that you're looking for something more sensible. There is one other thing I tried that gave me some success solving the problem.
First, pleas read all Andre.Ziegler's posts in this thread carefully. I had some luck with the solution he proposed to others in this thread, i.e., I did what is
described here. However, the next time my computer had to be reset do to hanging on shutdown the problem unfortunately returned. The short of it is this command (if memory serves):
DISM /Online /Cleanup-Image /RestoreHealth
Keep in mind this was only suggested to those who had shared .dmp files with Andre that showed "damaged files." So this solution may not work for you, but I'm not afraid to suggest it, because I don't think it can harm anything to try.
Please, if you solve this some other way, post your solution here.
Good luck! Best wishes, and Happy New Year!
@ amJad shafiq
I felt the same way about using "Refresh PC". I found that irksome at first just like you seem to. It's just a catch all solution for things that can't be solved a better way. However, If you're using Windows 8 and have not tried this yet,
you may want to consider it. It's really smooth. You really don't lose any data at all. I like the "list of uninstalled applications" HTML file on the desktop after the refresh completes. It makes things fairly easy to reinstall.
So I would urge you to not waste time on other solutions, but I understand that you're looking for something more sensible. There is one other thing I tried that gave me some success solving the problem.
First, pleas read all Andre.Ziegler's posts in this thread carefully. I had some luck with the solution he proposed to others in this thread, i.e., I did what is
described here. However, the next time my computer had to be reset do to hanging on shutdown the problem unfortunately returned. The short of it is this command (if memory serves):
DISM /Online /Cleanup-Image /RestoreHealth
Keep in mind this was only suggested to those who had shared .dmp files with Andre that showed "damaged files." So this solution may not work for you, but I'm not afraid to suggest it, because I don't think it can harm anything to try.
Please, if you solve this some other way, post your solution here.
Good luck! Best wishes, and Happy New Year!
plz if any body have any solution of windows 8 explorer crash replyalso share the dumps.
@BoBeach,
This is not the same problem. This thread is about explorer crashing every few minutes. So, while this is a good solution to the problem you were experiencing, it is not the answer to the problem which spawned the creation of this thread. Moreover, the explorer crashing problem could not have been cause by Defender since I, for one, did not have Defender enabled at that time. I currently am using Defender, however, and it's not causing any problem at all; In fact, it's working perfectly.
Just the same, thanks for taking the time to post.
I've been following this thread for a few weeks and based on my crash analysis there's a couple of things I want to point out.
In my situation I was experiencing crashes at in duser.dll @ TransitionVisual::PushOpacityToLeaves + 0x121
I looked at a few dumps then realized that this is being called from the Animation being launched in the Immersive Shell (twinui). Awhile back
I applied one of the "nifty" registry tweaks that you see to enable animations every time you go back to the start screen, like at login.
Well after disabling the registry key I no longer get the crashes at PushOpacityToLeaves + 0x121 and would explain why folks who do a refresh
are *fixed*
The registry key is HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid\Launcher_SessionLoginAnimation_OnShow
set it to zero, that's what I did in my case.
YMMV
I've been following this thread for a few weeks and based on my crash analysis there's a couple of things I want to point out.
In my situation I was experiencing crashes at in duser.dll @ TransitionVisual::PushOpacityToLeaves + 0x121
I looked at a few dumps then realized that this is being called from the Animation being launched in the Immersive Shell (twinui). Awhile back
I applied one of the "nifty" registry tweaks that you see to enable animations every time you go back to the start screen, like at login.
Well after disabling the registry key I no longer get the crashes at PushOpacityToLeaves + 0x121 and would explain why folks who do a refresh
are *fixed*
The registry key is HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid\Launcher_SessionLoginAnimation_OnShow
set it to zero, that's what I did in my case.
YMMV
I have created a 7z archive as requested: http://sdrv.ms/XT69M3
In deleting Andre's two keys, I hope I did the right thing. I:
(1) deleted the key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe] with everything under it, and
(2) kept [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe] but deleted the specific keys "GlobalFlag" and "PageHeapFlags".
Thank you.
I have created a 7z archive as requested: http://sdrv.ms/XT69M3
In deleting Andre's two keys, I hope I did the right thing. I:
(1) deleted the key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe] with everything under it, and
(2) kept [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe] but deleted the specific keys "GlobalFlag" and "PageHeapFlags".
Thank you.
The Explorer crashes because of a critical section issue:
APPLICATION_VERIFIER_LOCKS_EXIT_THREAD_OWNS_LOCK (200)
Thread cannot own a critical section.
This stop is generated if a thread (thread ID is parameter1) is terminated,
suspended or is in a state (worker thread finished a work item) in which it
cannot hold a critical section. The current thread is the culprit.
To debug this stop use the following debugger commands:
$ kb - to get the current stack trace. If the current thread is the owner of
the critical section it is probably calling ExitThread.
The current thread should have released the critical section before exiting.
If the current thread is calling TerminateThread or SuspendThread then it
should not do this for a thread holding a critical section.
$ !cs -s parameter2 - dump information about this critical section.
$ ln parameter2 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter4 - to dump the stack trace for this critical section initialization.
Arguments:
Arg1: 0000000000001b04, Thread ID.
Arg2: 000000001a496f50, Critical section address.
Arg3: 0000000013c9bee0, Critical section debug information address.
Arg4: 000000000106a8f0, Critical section initialization stack trace.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ComcastSecureBackupShareshell.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL -
Debugger Dbgportaldb Connection::Open failed 80004005
Database Dbgportaldb not connected
FAULTING_IP:
verifier!VerifierStopMessage+1fc
000007fb`cf37a088 cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fbcf37a088 (verifier!VerifierStopMessage+0x00000000000001fc)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000001b04
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007fbd4bb0aed to 000007fbcf37a088
STACK_TEXT:
ntdll!NtWaitForSingleObject
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!KiUserExceptionDispatch
verifier!VerifierStopMessage
ntdll!RtlApplicationVerifierStop
ntdll! ?? ::FNODOBFM::`string'
ntdll!RtlCheckForOrphanedCriticalSections
rpcrt4!DispatchToStubInCAvrf
rpcrt4!RPC_INTERFACE::DispatchToStubWorker
rpcrt4!LRPC_SCALL::DispatchRequest
rpcrt4!LRPC_SCALL::HandleRequest
rpcrt4!LRPC_ADDRESS::ProcessIO
rpcrt4!LrpcIoComplete
ntdll!TppAlpcpExecuteCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStartCritical section = 0x000000001a496f50 (+0x1A496F50) DebugInfo = 0x0000000013c9bee0 LOCKED LockCount = 0x0 WaiterWoken = No OwningThread = 0x0000000000001b04 RecursionCount = 0x1 LockSemaphore = 0x0 SpinCount = 0x00000000020007d0 Stack trace for DebugInfo = 0x0000000013c9bee0: 0x000007fbd4bf0410: ntdll! ?? ::FNODOBFM::`string'+0x7E91 0x000007fbcf385be5: verifier!AVrfpInitializeCriticalSectionCommon+0x115 0x000000018012f76b: ComcastSecureBackupShareshell!DllUnregisterServer+0x12C45B 0x0000000180002a7b: ComcastSecureBackupShareshell+0x2A7B 0x000000018000302a: ComcastSecureBackupShareshell+0x302A 0x00000001801a9b4b: ComcastSecureBackupShareshell!DllUnregisterServer+0x1A683B 0x000007fbcf383b2e: verifier!AVrfpStandardDllEntryPointRoutine+0xBE 0x000007fbd4afba0e: ntdll!LdrpCallInitRoutine+0x3E 0x000007fbd4b182dc: ntdll!LdrpInitializeNode+0x192 0x000007fbd4b1787f: ntdll!LdrpInitializeGraph+0x6F 0x000007fbd4b19202: ntdll!LdrpPrepareModuleForExecution+0x1A5 0x000007fbd4b19af2: ntdll!LdrpLoadDll+0x344 0x000007fbd4b0e08b: ntdll!LdrLoadDll+0xA7 0x000007fbcf383ff6: verifier!AVrfpLdrLoadDll+0x76 0x000007fbd1aef653: KERNELBASE!LoadLibraryExW+0xBF 0x000007fbd355296c: combase!LoadLibraryWithLogging+0x2C 0x000007fbd35528c4: combase!CClassCache::CDllPathEntry::LoadDll+0x70 0x000007fbd3552693: combase!CClassCache::CDllPathEntry::Create+0x43 0x000007fbd35522a0: combase!CClassCache::CClassEntry::CreateDllClassEntry+0x196 0x000007fbd3552238: combase!CClassCache::GetClassObjectActivator+0x932
The cause is the Program "C:\Program Files\SecureBackupShare":
Image path: C:\Program Files\SecureBackupShare\ComcastSecureBackupShareshell.dll
Image name: ComcastSecureBackupShareshell.dll
Timestamp: Mon Nov 08 23:47:33 2010 (4CD87E05)
CheckSum: 00426F0D
ImageSize: 00450000
File version: 2.4.3.0
Product version: 2.4.0.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 01CCBBA5.094B4C4D
Translations: 0009.04b0
CompanyName: Secure Backup and Share
ProductName: Secure Backup and Share
InternalName: x64_shell.dll
ProductVersion: 2.4.0.0
FileVersion: 2.4.3.0
FileDescription: Secure Backup and Share Shell Extensions
LegalCopyright: Copyright 2010
Look if there is an u
Hi,
I also have the same problem in Explorer.exe, random crashes referencing ntdll.dll and the taskbar and explorer restarting itself. Even more strange is that after installing the Windows SDK and its Debugging Tools I cannot use charms-bar Search and control-panel anymore. Again it is explorer.exe breaking and now referencing verifier.dll.
I attached two dump files on my SkyDrive. Andre it would be great if you could take a look as my debugging environment isn't working anymore...
http://sdrv.ms/SBs2Ad (explorer.dll/verifier.dll crash when opening control panel/using search charm)
http://sdrv.ms/VrkDSW (explorer.dll random crash)
thanks
Hi,
I also have the same problem in Explorer.exe, random crashes referencing ntdll.dll and the taskbar and explorer restarting itself. Even more strange is that after installing the Windows SDK and its Debugging Tools I cannot use charms-bar Search and control-panel anymore. Again it is explorer.exe breaking and now referencing verifier.dll.
yes my reg file activates Application verifieer to get better dumps. In your case the Intel driver is the cause:
00000000140542e0 0008 0000 [00] 0000000014054330 00004 - (busy) 7ffc62981ab verifier!AVrfDebugPageHeapAllocate+0x000000000000039f 7ffd7fad83c ntdll!RtlDebugAllocateHeap+0x0000000000000038 7ffd7fcaacb ntdll! ?? ::FNODOBFM::`string'+0x0000000000011407 7ffd7ec6426 ntdll!RtlAllocateHeap+0x00000000000001ae 7ffc62b06eb verifier!AVrfpRtlAllocateHeap+0x00000000000000d7 9f5addb hccutils!DllUnregisterServer+0x0000000000002f9f 9f5a217 hccutils!DllUnregisterServer+0x00000000000023db 9f51378 hccutils!GetCUICustomizationKey+0x0000000000000190 9f51936 hccutils!GetCUICustomizationKey+0x000000000000074e 9f5320b hccutils!CreateThisKey+0x00000000000003f3 9f535f8 hccutils!FindResources+0x0000000000000108 9f53a11 hccutils!LoadSTRING+0x00000000000002f1 9f53fe2 hccutils!SaveString+0x0000000000000152 9f542df hccutils!LoadICON+0x000000000000002b 9f543a6 hccutils!LoadIMAGE+0x000000000000004a 180001582 igfxcpl!CPlApplet+0x00000000000000b2 7ffd5ff9efa shell32!CPL_CallEntry+0x0000000000000052 7ffd5ff99f1 shell32!_InitializeControl+0x000000000000009d 7ffd619daa8 shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x0000000000053d8b 7ffd5b04192 shell32!CPL_LoadCPLModule+0x00000000000001c2 7ffd5b03fa7 shell32!_LoadCPLModuleAndAdd+0x000000000000001f 7ffd5b03f5d shell32!CPLD_InitModule+0x000000000000003d 7ffd5b03ef8 shell32!CControlPanelEnum::_NextNonCachedCpl+0x00000000000000c5 7ffd5b0dec5 shell32!CControlPanelEnum::Next+0x00000000000000b4 7ffd5c51213 shell32!CRegFolderEnum::Next+0x00000000000001fa 7ffd5b0f415 shell32!CControlPanelAppletList::_AddAppletsToCategories+0x0000000000000051 7ffd5b0f389 shell32!CControlPanelAppletList::EnsureLoaded+0x00000000000000a9 7ffd5c016a9 shell32!CTasksFolder::_EnsureLoadedLists+0x0000000000000131 7ffd5c01078 shell32!CTasksFolder::EnumObjects+0x0000000000000038 7ffc49f9258 twinui!CSettingsSearchApp::GetCountForQuery+0x00000000000001a8 7ffd7932005 rpcrt4!Invoke+0x0000000000000065 7ffd7a46221 rpcrt4!Ndr64StubWorker+0x0000000000000c01
Loaded symbol image file: hccutils.dll
Image path: C:\Windows\System32\hccutils.dll
Image name: hccutils.dll
Timestamp: Mon Sep 03 04:49:28 2012 (50441AB8)
CheckSum: 00023677
ImageSize: 0001F000
File version: 8.15.10.2849
Product version: 8.15.10.2849
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: HCCUTILS
OriginalFilename: HCCUTILS.DLL
ProductVersion: 8.15.10.2849
FileVersion: 8.15.10.2849
PrivateBuild: 8.15.10.2849
SpecialBuild: 8.15.10.2849
FileDescription: hccutils Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel CorporationLoaded symbol image file: igfxcpl.cpl
Image path: C:\Windows\System32\igfxcpl.cpl
Image name: igfxcpl.cpl
Timestamp: Mon Sep 03 04:50:21 2012 (50441AED)
CheckSum: 00022721
ImageSize: 00025000
File version: 8.15.10.2849
Product version: 8.15.10.2849
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: IGFXCPL
OriginalFilename: IGFXCPL.DLL
ProductVersion: 8.15.10.2849
FileVersion: 8.15.10.2849
PrivateBuild: 8.15.10.2849
SpecialBuild: 8.15.10.2849
FileDescription: igfxcpl Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Update the Intel driver to version 9.17.10.2932 instead:
http://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=3498&DwnldID=22373&ProductFamily=Graphics&ProductLine=Desktop+graphics+drivers&ProductProduct=3rd+Generation+Intel%C2%AE+Core%E2%84%A2+Processors+with+Intel%C2%AE+HD+Graphics+4000%2f2500&lang=eng
http://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=3498&DwnldID=22375&ProductFamily=Graphics&ProductLine=Desktop+graphics+drivers&ProductProduct=3rd+Generation+Intel%c2%ae+Core%e2%84%a2+Processors+with+Intel%c2%ae+HD+Graphics+4000%2f2500&lang=eng
Run the uninstall.reg to disable the Appverifier and dump creation:
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full_uninstall.reg
Is there anybody out there that can help me with this issue? I need someone to verify my account so that I can post the link to my dump file in the c:\LocalDumps folder.
Any help with this issue would be greatly appreciated.
Thank you!
Great Andre! Thanks a lot!
Is there anybody out there that can help me with this issue? My Windows explorer crashes whenever I browse folders with a large number of files.
Any help with this issue would be greatly appreciated.
Here is the skydrive link to my dumps file from the c:\LocalDumps folder
skydrive.live.com/redir?resid=FE1D35C944D0BF09!332&authkey=!APFNrS63Hjikt5k
Thank you!
I agree with Worm8, I had this problem and had to restore from a restore point.
Andre- if you could please have a look at my dump file when you get a chance, I would really appreciate it. Just copy the link below into a browser to access the dump file.
skydrive.live.com/redir?resid=FE1D35C944D0BF09!332&authkey=!APFNrS63Hjikt5k
Thank you!
this is no malware. It simply activates AppVerifier and dump creation.
Use this file to stop it:
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full_uninstall.reg
@Pantonio3
Wuala is the cause. Disable the overlay icons:
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
APPLICATION_VERIFIER_HANDLES_INVALID_HANDLE (300)
Invalid handle exception for current stack trace.
This stop is generated if the function on the top of the stack passed an
invalid handle to system routines. Usually a simple kb command will reveal
what is the value of the handle passed (must be one of the parameters -
usually the first one). If the value is null then this is clearly wrong.
If the value looks ok you need to use !htrace debugger extension to get a
history of operations pertaining to this handle value. In most cases it
must be that the handle value is used after being closed.
Arguments:
Arg1: 00000000c0000008, Exception code.
Arg2: 000000001857eb50, Exception record. Use .exr to display it.
Arg3: 000000001857e520, Context record. Use .cxr to display it.
Arg4: 0000000000000000, Not used.
GetUrlPageData2 (WinHttp) failed: 12007.
Debugger WatsonDb Connection::Open failed 80004005
FAULTING_IP:
verifier!VerifierStopMessageEx+6d0
000007fa`0407a7fc cc int 3
EXCEPTION_RECORD: 000000001857eb50 -- (.exr 0x1857eb50)
ExceptionAddress: 000007fa08e54c39 (ntdll!KiRaiseUserExceptionDispatcher+0x000000000000003a)
ExceptionCode: c0000008 (Invalid handle)
ExceptionFlags: 00000000
NumberParameters: 0
Thread tried to close a handle that was invalid or illegal to close
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
CONTEXT: 000000001857e520 -- (.cxr 0x1857e520)
rax=0000000000000000 rbx=e0e0e0e0e0e0e0e0 rcx=0000000000000000
rdx=0000000000000000 rsi=000007fa061a1580 rdi=000007fa08e52cd0
rip=000007fa08e54c39 rsp=000000001857eb30 rbp=0000000020e75538
r8=0000000000000000 r9=00000000000002c8 r10=000007fa08e557c0
r11=000000001fe50000 r12=00203a616c617577 r13=000000000e39d0d0
r14=000007fa040959d1 r15=0000000000000001
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!KiRaiseUserExceptionDispatcher+0x3a:
000007fa`08e54c39 8b8424c0000000 mov eax,dword ptr [rsp+0C0h] ss:00000000`1857ebf0=080000c0
Resetting default scope
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000000c6c
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007fa04081e26 to 000007fa0407a7fc
STACK_TEXT:
ntdll!NtWaitForSingleObject
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!KiUserExceptionDispatch
verifier!VerifierStopMessageEx
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!RtlRaiseException
ntdll!KiRaiseUserExceptionDispatcher
verifier!AVrfpNtClose
KERNELBASE!CloseHandle
verifier!AVrfpCloseHandleCommon
verifier!AVrfpCloseHandleCommon
OverlayIcon!DllUnregisterServer
OverlayIcon!DllUnregisterServer
shell32!CFSIconOverlayManager::_GetFileOverlayInfo
shell32!CFSIconOverlayManager::GetFileOverlayInfo
shell32!CFSFolder::_GetOverlayInfo
shell32!CDesktopFolder::GetOverlayIndex
shell32!CRegFolder::GetOverlayIndex
shell32!CIconOverlayTask::InternalResumeRT
shell32!CRunnableTask::Run
shell32!CShellTask::TT_Run
shell32!CShellTaskThread::ThreadProc
shell32!CShellTaskThread::s_ThreadProc
SHCore!ExecuteWorkItemThreadProc
ntdll!RtlpTpWorkCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
IMAGE_NAME: OverlayIcon.dll
Loaded symbol image file: OverlayIcon.dll
Image path: C:\Program Files (x86)\Wuala OverlayIcons\OverlayIcon.dll
Image name: OverlayIcon.dll
Timestamp: Wed May 04 10:12:44 2011 (4DC10A7C)
CheckSum: 0009DC68
ImageSize: 00096000
File version: 1.0.0.0
Product version: 1.0.0.0
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: LaCie AG
ProductName: Wuala
InternalName: OverlayIcon.dll
OriginalFilename: OverlayIcon.dll
ProductVersion: 1.0.0.0
FileVersion: 1.0.0.0
FileDescription: Wuala OverlayIcons
LegalCopyright: LaCie AG. All rights reserved.
or try to update the tool. if the issue is fixed, also run the uninstall reg.
http://sdrv.ms/WWDUx0
Help, please.
you have a memory corruption:
APPLICATION_VERIFIER_FLAGS: 0
CHKIMG_EXTENSION: !chkimg -lo 50 -d !shell32
7fd6188b78e-7fd6188b78f 2 bytes - shell32!CShellUrl::_ParseNextSegment+2c6
[ 45 d7:33 c0 ]
7fd6188b887-7fd6188b888 2 bytes - shell32!ShStrW::_SetStr+37 (+0xf9)
[ eb 63:33 c0 ]
7fd619695d8-7fd619695dd 6 bytes - shell32!c_szShell32Dll+fd8 (+0xddd51)
[ 7c 36 80 61 fd 07:e0 56 06 05 00 00 ]
10 errors : !shell32 (7fd6188b78e-7fd619695dd)
APP: explorer.exe
FAULTING_THREAD: 00000000000010c8
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 000007fd6188f6d9 to 000007fd6188b78f
BUGCHECK_STR: APPLICATION_FAULT_MEMORY_CORRUPTION_INVALID_POINTER_WRITE_LARGE
I understand that the regcode is there to activate Appverifier. It's still possibly malicious, since it can make the whole system unbootable. Doing the unistall code wouldn't help if one had no means to restore the unusable system. This could end up in serious trouble. So at least everyone should be prepared with restore points and restore dvds. Someone could verify the files, though. Would windows restore point remove all of your reg codes or would I stil need to use the uninstall to completely remove it.
Running sfc / scannow has helped my explorer crashes.
Thank you very much Andre, it's working fine now.
Help! Same trouble here!
http://sdrv.ms/XmMh1m
Help! Same trouble here!
You also have Explorer crash causes by the Intel GPU driver:
APPLICATION_VERIFIER_HEAPS_CORRUPTED_HEAP_BLOCK_SUFFIX (f)
Corrupted suffix pattern for heap block.
Most typically this happens for buffer overrun errors. Sometimes the application
verifier places non-accessible pages at the end of the allocation and buffer
overruns will cause an access violation and sometimes the heap block is
followed by a magic pattern. If this pattern is changed when the block gets
freed you will get this break. These breaks can be quite difficult to debug
because you do not have the actual moment when corruption happened.
You just have access to the free moment (stop happened here) and the
allocation stack trace (!heap -p -a HEAP_BLOCK_ADDRESS)
Arguments:
Arg1: 0000000021101000, Heap handle used in the call.
Arg2: 00000000150b4180, Heap block involved in the operation.
Arg3: 0000000000000004, Size of the heap block.
Arg4: 00000000150b4184, Corruption address.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
FAULTING_IP:
verifier!VerifierStopMessage+1fc
000007fe`a78da088 cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fea78da088 (verifier!VerifierStopMessage+0x00000000000001fc)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000000548
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000
STACK_TEXT:
ntdll!NtWaitForSingleObject
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
verifier!AVrfpVectoredExceptionHandler
ntdll!RtlpCallVectoredHandlers
ntdll!RtlDispatchException
ntdll!KiUserExceptionDispatch
verifier!VerifierStopMessage
verifier!AVrfpDphReportCorruptedBlock
verifier!AVrfpDphCheckNormalHeapBlock
verifier!VerifierCheckPageHeapAllocation
verifier!AVrfpHeapFree
hccutils!DllUnregisterServer
hccutils!GetCUICustomizationKey
hccutils!GetCUICustomizationKey
hccutils!GetCUICustomizationKey
hccutils!CreateThisKey
hccutils!FindResources
hccutils!LoadSTRING
hccutils!SaveString
hccutils!LoadICON
hccutils!LoadIMAGE
igfxcpl!CPlApplet
shell32!CPL_CallEntry
shell32!_InitializeControl
shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''
shell32!CPL_LoadCPLModule
shell32!_LoadCPLModuleAndAdd
shell32!CPLD_InitModule
shell32!CControlPanelEnum::_NextNonCachedCpl
shell32!CControlPanelEnum::Next
shell32!CRegFolderEnum::Next
shell32!CControlPanelAppletList::_AddAppletsToCategories
shell32!CControlPanelAppletList::EnsureLoaded
shell32!CTasksFolder::_EnsureLoadedLists
shell32!CTasksFolder::EnumObjects
twinui!CSettingsSearchApp::GetCountForQuery
rpcrt4!Invoke
rpcrt4!Ndr64StubWorker
rpcrt4!NdrStubCall3
combase!CStdStubBuffer_Invoke
combase!SyncStubInvoke
combase!CCtxComChnl::ContextInvoke
combase!AppInvoke
combase!ComInvokeWithLockAndIPID
combase!ThreadWndProc
user32!UserCallWinProcCheckWow
user32!DispatchMessageWorker
shell32!_LocalServerThread
SHCore!COplockFileHandle::v_GetHandlerCLSID
verifier!AVrfpStandardThreadFunction
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: explorer.exe!unknown_error_in_process
IMAGE_NAME: explorer.exe
0:016> !heap -p -a 00000000150b4180
address 00000000150b4180 found in
_HEAP @ 150b0000
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
00000000150b4130 0008 0000 [00] 00000000150b4180 00004 - (busy)
7fea78d81ab verifier!AVrfDebugPageHeapAllocate+0x000000000000039f
7fec035d83c ntdll!RtlDebugAllocateHeap+0x0000000000000038
7fec037aacb ntdll! ?? ::FNODOBFM::`string'+0x0000000000011407
7fec0276426 ntdll!RtlAllocateHeap+0x00000000000001ae
7fea78f06eb verifier!AVrfpRtlAllocateHeap+0x00000000000000d7
f13addb hccutils!DllUnregisterServer+0x0000000000002f9f
f13a217 hccutils!DllUnregisterServer+0x00000000000023db
f131378 hccutils!GetCUICustomizationKey+0x0000000000000190
f131936 hccutils!GetCUICustomizationKey+0x000000000000074e
f13320b hccutils!CreateThisKey+0x00000000000003f3
f1335f8 hccutils!FindResources+0x0000000000000108
f133a11 hccutils!LoadSTRING+0x00000000000002f1
f133fe2 hccutils!SaveString+0x0000000000000152
f1342df hccutils!LoadICON+0x000000000000002b
f1343a6 hccutils!LoadIMAGE+0x000000000000004a
180001582 igfxcpl!CPlApplet+0x00000000000000b2
7febecf9efa shell32!CPL_CallEntry+0x0000000000000052
7febecf99f1 shell32!_InitializeControl+0x000000000000009d
7febee9daa8 shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x0000000000053d8b
7febe804192 shell32!CPL_LoadCPLModule+0x00000000000001c2
7febe803fa7 shell32!_LoadCPLModuleAndAdd+0x000000000000001f
7febe803f5d shell32!CPLD_InitModule+0x000000000000003d
7febe803ef8 shell32!CControlPanelEnum::_NextNonCachedCpl+0x00000000000000c5
7febe80dec5 shell32!CControlPanelEnum::Next+0x00000000000000b4
7febe951213 shell32!CRegFolderEnum::Next+0x00000000000001fa
7febe80f415 shell32!CControlPanelAppletList::_AddAppletsToCategories+0x0000000000000051
7febe80f389 shell32!CControlPanelAppletList::EnsureLoaded+0x00000000000000a9
7febe9016a9 shell32!CTasksFolder::_EnsureLoadedLists+0x0000000000000131
7febe901078 shell32!CTasksFolder::EnumObjects+0x0000000000000038
7feac159258 twinui!CSettingsSearchApp::GetCountForQuery+0x00000000000001a8
7febd8b2005 rpcrt4!Invoke+0x0000000000000065
7febd9c6221 rpcrt4!Ndr64StubWorker+0x0000000000000c01
Image path: C:\Windows\System32\igfxcpl.cpl
Image name: igfxcpl.cpl
Timestamp: Thu Dec 13 01:42:36 2012 (50C9247C)
CheckSum: 000256A6
ImageSize: 00025000
File version: 8.15.10.2932
Product version: 8.15.10.2932
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: IGFXCPL
OriginalFilename: IGFXCPL.DLL
ProductVersion: 8.15.10.2932
FileVersion: 8.15.10.2932
PrivateBuild: 8.15.10.2932
SpecialBuild: 8.15.10.2932
FileDescription: igfxcpl Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Loaded symbol image file: hccutils.dll
Image path: C:\Windows\System32\hccutils.dll
Image name: hccutils.dll
Timestamp: Thu Dec 13 01:42:04 2012 (50C9245C)
CheckSum: 0001FA74
ImageSize: 0001F000
File version: 8.15.10.2932
Product version: 8.15.10.2932
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: HCCUTILS
OriginalFilename: HCCUTILS.DLL
ProductVersion: 8.15.10.2932
FileVersion: 8.15.10.2932
PrivateBuild: 8.15.10.2932
SpecialBuild: 8.15.10.2932
FileDescription: hccutils Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Hi, I have exactly the same issue. Please help have a look, thanks! http://sdrv.ms/YInRzT
the Itel driver is also the cause:
address 00000000278b4310 found in
_HEAP @ 278b0000
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
00000000278b42c0 0008 0000 [00] 00000000278b4310 00004 - (busy)
7ff1ab481ab verifier!AVrfDebugPageHeapAllocate+0x000000000000039f
7ff2b13d83c ntdll!RtlDebugAllocateHeap+0x0000000000000038
7ff2b15aacb ntdll! ?? ::FNODOBFM::`string'+0x0000000000011407
7ff2b056426 ntdll!RtlAllocateHeap+0x00000000000001ae
7ff1ab606eb verifier!AVrfpRtlAllocateHeap+0x00000000000000d7
1f65addb hccutils!DllUnregisterServer+0x0000000000002f9f
1f65a217 hccutils!DllUnregisterServer+0x00000000000023db
1f651378 hccutils!GetCUICustomizationKey+0x0000000000000190
1f651936 hccutils!GetCUICustomizationKey+0x000000000000074e
1f65320b hccutils!CreateThisKey+0x00000000000003f3
1f6535f8 hccutils!FindResources+0x0000000000000108
1f653a11 hccutils!LoadSTRING+0x00000000000002f1
18000e9b1 igfxpph+0x000000000000e9b1
18000edaa igfxpph+0x000000000000edaa
7ff286cd5d7 shell32!IShellExtInit_Initialize+0x0000000000000047
7ff286cfb6d shell32!HDXA_QueryContextMenu+0x00000000000002dd
7ff286cea0f shell32!CDefFolderMenu::QueryContextMenu+0x000000000000041b
7ff28bf9d29 shell32!CContextMenuOnContextMenuArray::_QueryNthContextMenu+0x0000000000000035
7ff28bf9b94 shell32!CContextMenuOnContextMenuArray::QueryContextMenu+0x00000000000000b0
7ff28965a8f shell32!CDefView::_DoContextMenuPopup+0x00000000000001ab
7ff2896570f shell32!CDefView::OnBackgroundContextMenu+0x00000000000001ab
7ff28b3d7b5 shell32!CListViewHost::ShowContextMenu+0x000000000000022d
7ff289658c1 shell32!CDefView::_DoContextMenu+0x0000000000000081
7ff2895f4fd shell32!CDefView::_OnContextMenu+0x00000000000000e9
7ff28c94b37 shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x000000000001c262
7ff285c30e9 shell32!CDefView::s_WndProc+0x0000000000000071
7ff29d4171e user32!UserCallWinProcCheckWow+0x000000000000013a
7ff29d4432b user32!CallWindowProcW+0x0000000000000093
7ff25bd125d comctl32!CallOriginalWndProc+0x000000000000001d
7ff25bd11f6 comctl32!CallNextSubclassProc+0x0000000000000082
7ff25bd13d7 comctl32!DefSubclassProc+0x0000000000000077
7ff285c3465 shell32!CListViewHost::_ViewSubclassWndProc+0x000000000000006d
0:000> lmvm igfxpph
start end module name
00000001`80000000 00000001`80064000 igfxpph (export symbols) igfxpph.dll
Loaded symbol image file: igfxpph.dll
Image path: C:\Windows\System32\igfxpph.dll
Image name: igfxpph.dll
Timestamp: Thu Dec 13 01:42:45 2012 (50C92485)
CheckSum: 000642DF
ImageSize: 00064000
File version: 8.15.10.2932
Product version: 8.15.10.2932
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: IGFXPPH
OriginalFilename: IGFXPPH.DLL
ProductVersion: 8.15.10.2932
FileVersion: 8.15.10.2932
PrivateBuild: 8.15.10.2932
SpecialBuild: 8.15.10.2932
FileDescription: igfxpph Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Update the driver and use ShelExView to disable the Intel shellextension.
1 other crash is caused by Google drive:
STACK_TEXT:
000007ff`2b18fdc8 000007ff`2b15bf2f ntdll! ?? ::FNODOBFM::`string'+0x13981
000007ff`2b18fdd0 00000000`7666cabc msvcr90!free+0x1c
000007ff`2b18fdd8 000007ff`1b6b2dc8 googledrivesync64!DllCanUnloadNow+0xcd8
000007ff`2b18fde0 000007ff`287240b6 shell32!CFSIconOverlayManager::_GetFileOverlayInfo+0xca
000007ff`2b18fde8 000007ff`28678410 shell32!CFSIconOverlayManager::GetFileOverlayInfo+0x48
000007ff`2b18fdf0 000007ff`287246b7 shell32!CFSFolder::_GetOverlayInfo+0xdf
000007ff`2b18fdf8 000007ff`287277f2 shell32!CIconOverlayTask::InternalResumeRT+0x14a
000007ff`2b18fe00 000007ff`286e8324 shell32!CRunnableTask::Run+0x98
000007ff`2b18fe08 000007ff`286df388 shell32!CShellTask::TT_Run+0x3c
000007ff`2b18fe10 000007ff`285b18df shell32!CShellTaskThread::ThreadProc+0xd7
000007ff`2b18fe18 000007ff`285b19e7 shell32!CShellTaskThread::s_ThreadProc+0x33
000007ff`2b18fe20 000007ff`261a157f shcore!ExecuteWorkItemThreadProc+0xf
000007ff`2b18fe28 000007ff`2b067f59 ntdll!RtlpTpWorkCallback+0x189
000007ff`2b18fe30 000007ff`2b058842 ntdll!TppWorkerThread+0x604
000007ff`2b18fe38 000007ff`2a9a167e kernel32!BaseThreadInitThunk+0x1a
000007ff`2b18fe40 000007ff`2b073501 ntdll!RtlUserThreadStart+0x1d
FOLLOWUP_IP:
googledrivesync64!DllCanUnloadNow+cd8
000007ff`1b6b2dc8 488d542430 lea rdx,[rsp+30h]
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: googledrivesync64!DllCanUnloadNow+cd8
FOLLOWUP_NAME: wintriag
MODULE_NAME: googledrivesync64
IMAGE_NAME: googledrivesync64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 50cfe78c
STACK_COMMAND: dps 7ff2b18fdc8 ; kb
FAILURE_BUCKET_ID: INVALID_POINTER_READ_AFTER_CALL_c0000374_googledrivesync64.dll!DllCanUnloadNow
BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_AFTER_CALL_googledrivesync64!DllCanUnloadNow+cd8
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/6_2_9200_16433/50763312/ntdll_dll/6_2_9200_16420/505ab405/c0000374/000ea485.htm?Retriage=1
Followup: wintriag
---------
0:071> lmvm googledrivesync64
start end module name
000007ff`1b6b0000 000007ff`1b76b000 googledrivesync64 (export symbols) googledrivesync64.dll
Loaded symbol image file: googledrivesync64.dll
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Timestamp: Tue Dec 18 04:48:28 2012 (50CFE78C)
CheckSum: 000BE686
ImageSize: 000BB000
File version: 1.7.4018.3496
Product version: 1.7.4018.3496
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Google
ProductName: Google Drive
ProductVersion: 1.7.4018.3496
FileVersion: 1.7.4018.3496
FileDescription: Google Drive shell extension
LegalCopyright: Google
Disable the sync icons in the google drive options to fix this crash.
Also make sure you run the uninstall reg to disable AppVerifer and cump creation:
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full_uninstall.reg
Hi... I'm having this problem, and I think it happens when I install the nvidia drivers.
Heres my dump file: http://sdrv.ms/WHDsEI
I had the following problems with Windows 8 Pro, this was on a new Lenovo X1 Carbon Touch, that came with Windows 8 Pro pre-installed:
The desktop would delay, go to a white screen, go to a blue screen, then reload. Right clicking the desktop, then clicking personalize did not work. The task manager would show CPU usage for Windows Explorer at 13% right after a crash-restart then after about 15 seconds the CPU would go to 26%, then if you clicked the desktop it would go through the loop, white screen, blue screen, restart. I could not change the desktop background image or the theme. The Image it is stuck on is the Sand picture from the Earth theme.
I saw a lot of posts recommending doing a Windows Refresh, which I tried, and it did fix the problem. The problem with a Windows Refresh is that all the programs I need are gone and I would need to put them back, and I suspect at some point the same problem would return. So I set out to determine what was causing the problem.
When I re-installed Windows 8 the problem would go away, when I re-installed my image the problem would return. I tried removing programs and patches I had installed just before the problems started, but nothing would stop the issue. Then I tried logging in as a different user and the issue was not there.
I saw where there was a patch to fix the early version of Windows 8 that was showing these symptoms, caused by the live tiles, but I had all the patches or the replacement patches.
Once, after installing my image when I "turned off the Live Tiles" feature of all the Tiles I had running the problem stopped, when I turned the "Live Tiles" feature back on the problem still did not return. But when I re-installed my image again, just turning off the live tiles did not correct the problem this time.
The one thing that consistently stops the crashing cycle is the following Registry change:
HKEY_CURRENT_USER\Control Panel\Desktop
Change the string for the Wallpaper to the location of some other picture, like for Windows 8;
C:\Windows\Web\Wallpaper\Windows
Then restart Windows.
I hope this helps someone else trying to resolve this issue.
I had the following problems with Windows 8 Pro, this was on a new Lenovo X1 Carbon Touch, that came with Windows 8 Pro pre-installed:
The desktop would delay, go to a white screen, go to a blue screen, then reload. Right clicking the desktop, then clicking personalize did not work. The task manager would show CPU usage for Windows Explorer at 13% right after a crash-restart then after about 15 seconds the CPU would go to 26%, then if you clicked the desktop it would go through the loop, white screen, blue screen, restart. I could not change the desktop background image or the theme. The Image it is stuck on is the Sand picture from the Earth theme.
I saw a lot of posts recommending doing a Windows Refresh, which I tried, and it did fix the problem. The problem with a Windows Refresh is that all the programs I need are gone and I would need to put them back, and I suspect at some point the same problem would return. So I set out to determine what was causing the problem.
When I re-installed Windows 8 the problem would go away, when I re-installed my image the problem would return. I tried removing programs and patches I had installed just before the problems started, but nothing would stop the issue. Then I tried logging in as a different user and the issue was not there.
I saw where there was a patch to fix the early version of Windows 8 that was showing these symptoms, caused by the live tiles, but I had all the patches or the replacement patches.
Once, after installing my image when I "turned off the Live Tiles" feature of all the Tiles I had running the problem stopped, when I turned the "Live Tiles" feature back on the problem still did not return. But when I re-installed my image again, just turning off the live tiles did not correct the problem this time.
The one thing that consistently stops the crashing cycle is the following Registry change:
HKEY_CURRENT_USER\Control Panel\Desktop
Change the string for the Wallpaper to the location of some other picture, like for Windows 8;
C:\Windows\Web\Wallpaper\Windows
Then restart Windows.
I hope this helps someone else trying to resolve this issue.
Andre, could you please look into my crash dump: http://sdrv.ms/Zv84rQ
There's a history in this. This is a month old Win8 64 Pro and earlier the Intel graphics driver crashed explorer whenever I tried to do anything. After rolling the driver back 4 versions (!), it finally stopped crashing. Then the NVidia extensions started crashing explorer since there's dual GPU. That was fixed by disabling NVidia from BIOS and all the shell extensions. Then Intel driver auto-updated itself to a crashing version every day until I found some obscure admin panel where to disable auto updates for given driver ids. But now the desktop crashes 10 times a day and easily 5 times every boot before stabilizing and there is no clear reason.
I'm just totally fed up with this, after 7 years with linux I thought that Windows 8 actually looked pretty functional. It might actually work for me if it just were more reliable than a worse-than-average indie DOS game.
Thanks for any help.
Andre, could you please look into my crash dump
google drive is causing the crash:
0x000007fd18e40410: ntdll! ?? ::FNODOBFM::`string'+0x7E91
0x000007fd103a5be5: verifier!AVrfpInitializeCriticalSectionCommon+0x115
0x000007fd071d6e59: contextmenu64!DllInstall+0x5769
0x000007fd0721731e: contextmenu64!DllInstall+0x45C2E
0x000007fd0722e534: contextmenu64!DllInstall+0x5CE44
0x000007fd071d5aeb: contextmenu64!DllInstall+0x43FB
0x000007fd071d36c0: contextmenu64!DllInstall+0x1FD0
0x000007fd071d3a5f: contextmenu64!DllInstall+0x236F
0x000007fd175fd5d7: shell32!IShellExtInit_Initialize+0x47
0x000007fd175ffb6d: shell32!HDXA_QueryContextMenu+0x2DD
0x000007fd175fea0f: shell32!CDefFolderMenu::QueryContextMenu+0x41B
0x000007fd175294ce: shell32!CShellLink::CTargetContextMenu::QueryContextMenu+0x1E
0x000007fd17529471: shell32!CShellLink::QueryContextMenu+0x7D
0x000007fd175ffcb6: shell32!HDXA_QueryContextMenu+0x426
0x000007fd175fea0f: shell32!CDefFolderMenu::QueryContextMenu+0x41B
0x000007fd175bcd15: shell32!CShellExecute::_InvokeInProcExec+0xA1
0x000007fd175bcc47: shell32!CShellExecute::_InvokeCtxMenu+0x4B
0x000007fd175bcbdb: shell32!CShellExecute::_DoExecute+0x153
0x000007fd175d0ae6: shell32!CSetShellForeground::SetShellForeground+0x6A
0x000007fd13d740bc: SHCore!COplockFileHandle::v_GetHandlerCLSID+0x12C
0:059> lmvm contextmenu64
start end module name
000007fd`071d0000 000007fd`0728a000 contextmenu64 (export symbols) contextmenu64.dll
Loaded symbol image file: contextmenu64.dll
Image path: C:\Program Files (x86)\Google\Drive\contextmenu64.dll
Image name: contextmenu64.dll
Timestamp: Fri Mar 08 01:30:26 2013 (51393122)
CheckSum: 000C27D8
ImageSize: 000BA000
File version: 1.0.0.1
Product version: 1.0.0.1
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: Google
ProductName: Google Drive
InternalName: contextmenu.dll
OriginalFilename: contextmenu.dll
ProductVersion: 1.8.4357.4863
FileVersion: 1.8.4357.4863
FileDescription: Google Drive shell extension
LegalCopyright: Google
Thanks! Just a follow-up on teaching how to fish: how did you get the stack trace? The debugger also found the dll symbols apparently.
I loaded the dump to WinDbg (X64), used MSDL symbol server and gave "!analyze -v". That didn't give any meaningful info, neither stack trace or symbols, and my Windows debugging skills ended there...
Thanks! Just a follow-up on teaching how to fish: how did you get the stack trace? The debugger also found the dll symbols apparently.
I loaded the dump to WinDbg (X64), used MSDL symbol server and gave "!analyze -v". That didn't give any meaningful info, neither stack trace or symbols, and my Windows debugging skills ended there...
Wing tells you what to do:
!cs -s parameter1 - dump information about this critical section.
My Fujitsu Lifebook T900 laptop crashes reproducable in Windows 8, if I have an active Internet connection with built in UMTS modem and send it to Hibernate in that state.
Best greetings from Germany
Olaf
I get the Windows needs to restart sad face ...
Andre,
Would you mind taking a look at my crash dump file? My Windows Explorer is crashing/hanging as well.
http://sdrv.ms/14wN7kW
Thanks
Andre,
Would you mind taking a look at my crash dump file? My Windows Explorer is crashing/hanging as well.
Avast causes a stackoverflow in explorer. Contact their support about the issue. Run the linked install.reg to disable app verifier and dump creation.
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify checksum for snxhk64.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for snxhk64.dll -
FAULTING_IP:
verifier!AVrfpRegOpenKeyExW+8c
000007fa`f9292f0c 8bd8 mov ebx,eax
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fb014113de (advapi32!RegOpenKeyExWStub+0x000000000000000e)
ExceptionCode: c00000fd (Stack overflow)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000eb3ff8
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc00000fd - Eine neue Schutzseite f r den Stapel kann nicht erstellt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc00000fd - Eine neue Schutzseite f r den Stapel kann nicht erstellt werden.
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000eb3ff8
RECURRING_STACK: From frames 0x1 to 0x2
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 00000000000016c4
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 000007faf9292f0c to 000007fb014113de
DEFAULT_BUCKET_ID: STACK_CORRUPTION_CALL
PRIMARY_PROBLEM_CLASS: STACK_CORRUPTION_CALL
BUGCHECK_STR: APPLICATION_FAULT_STACK_CORRUPTION_STACK_OVERFLOW_CALL
STACK_TEXT:
00000000`00eb22f8 000007fb`021fea72 ntdll!EtwEventWriteNoRegistration+0x8e
00000000`00eb23a8 000007fb`02241d0e ntdll!WerpAllocateAndInitializeSid+0xa2
00000000`00eb23d8 000007fb`02241d91 ntdll!WerpFreeSid+0x41
00000000`00eb2408 000007fb`0222eda9 ntdll!SendMessageToWERService+0x75
00000000`00eb24d8 000007fb`022816e0 ntdll! ?? ::FNODOBFM::`string'+0x0
00000000`00eb2568 000007fb`0222ed19 ntdll!ReportExceptionInternal+0xb9
00000000`00eb2f18 000007fb`02241ba4 ntdll!RtlReportExceptionEx+0x22c
00000000`00eb3048 000007fb`02241f5b ntdll!RtlReportException+0xbb
00000000`00eb3068 000007fb`021e46fd ntdll!RtlWalkFrameChain+0x29
00000000`00eb30d8 000007fb`0223b92a ntdll!LdrpCalloutExceptionFilter+0x16
00000000`00eb30e0 000007fb`022a8e78 ntdll!crc64Map32_+0x3d54
00000000`00eb3108 000007fb`02278fe9 ntdll! ?? ::FNODOBFM::`string'+0x818
00000000`00eb3118 000007fb`0218b4f7 ntdll!RtlDecodePointer+0x27
00000000`00eb3148 000007fb`021a4fea ntdll!_C_specific_handler+0x8e
00000000`00eb3158 000007fb`021fe057 ntdll!RtlpCallVectoredHandlers+0x103
00000000`00eb31b8 000007fb`021a464d ntdll!RtlpExecuteHandlerForException+0xd
00000000`00eb31e8 000007fb`021a567c ntdll!RtlDispatchException+0x392
00000000`00eb32c0 000007fb`022c7668 ntdll!__PchSym_ <PERF> +0x0
00000000`00eb32e0 000007fb`021a4f5c ntdll!_C_specific_handler+0x0
00000000`00eb32e8 000007fb`022a8e5c ntdll!crc64Map32_+0x3d38
00000000`00eb37d8 000007fa`f9292e80 verifier!AVrfpRegOpenKeyExW+0x0
00000000`00eb37e0 000007fb`014113f0 advapi32!RegQueryValueExWStub+0x0
00000000`00eb3888 000007fb`01410000 advapi32!_sz_CRYPTSP_dll <PERF> +0x0
00000000`00eb3890 000007fb`014ac06c advapi32!RestrictedMachineHandle <PERF> +0x0
00000000`00eb38a0 000007fa`f92c23f8 verifier!__PchSym_ <PERF> +0x0
00000000`00eb38f8 000007fb`02184bba ntdll!KiUserExceptionDispatch+0x2e
00000000`00eb3ab0 000007fa`f92785e8 verifier!AVrfDebugPageHeapReAllocate+0x300
00000000`00eb3e90 000007fb`014113de advapi32!RegOpenKeyExWStub+0xe
00000000`00f2c6a8 000007fb`011eb700 sechost!SetServiceObjectSecurity+0x2c
00000000`00f2c8e8 00000000`6a61ab83 snxhk64!SnxHk_UninstallHook+0x2153
00000000`00f2c938 000007fb`00d82152 user32!GetWindowLongPtrW+0x12
00000000`00f2c9b8 000007fa`f92939d8 verifier!AVrfpHandleSanityChecks+0x44
00000000`00f2ca48 000007fa`f9294b2b verifier!AVrfpNtProtectVirtualMemory+0x9f
00000000`00f2ca98 000007fa`ff527e91 kernelbase!VirtualProtect+0x35
00000000`00f2cae8 00000000`6a60313f snxhk64+0x313f
00000000`00f2ddf8 000007fb`021e38cf ntdll!RtlpLookupFunctionEntryForStackWalks+0x43
00000000`00f2de98 000007fb`000232d0 shell32!tls_end <PERF> +0x0
00000000`00f2e0d8 000007fb`02199eab ntdll!RtlpExtendHeap+0x5b
00000000`00f2e1b8 000007fb`021c0b98 ntdll!RtlpAllocateHeap+0x1527
00000000`00f2e398 000007fb`021b20ba ntdll!RtlpxLookupFunctionTable+0x188
00000000`00f2e420 000007fb`01eeb084 combase!__objectFactory__CExtensionCatalog <PERF> +0x0
00000000`00f2e4c8 000007fb`021e4624 ntdll!RtlpWalkFrameChain+0xedf
00000000`00f2e540 000007fb`00000005 shell32!api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA+0x5
00000000`00f2e5a8 000007fb`022c70c8 ntdll!__PchSym_ <PERF> +0x0
00000000`00f2e8a8 000007fb`021911cf ntdll!RtlpFindUnicodeStringInSection+0x1db
00000000`00f2ea58 000007fb`02191907 ntdll!RtlDosApplyFileIsolationRedirection_Ustr+0x833
00000000`00f2ebd8 000007fa`f9290b2a verifier!AVrfpRtlReAllocateHeap+0x1ae
00000000`00f2ec00 000007fb`01d90000 combase!CObjServer::CreateInstance+0x130
00000000`00f2ec68 000007fb`0219214b ntdll!LdrpFindLoadedDll+0x1ae
00000000`00f2ec98 000007fb`02262070 ntdll!RtlReleaseStackTrace+0x18
00000000`00f2ecf8 000007fa`f92795af verifier!AVrfpDphNormalHeapFree+0x8f
00000000`00f2ed78 000007fb`0226c522 ntdll!RtlpValidateHeap+0x32
00000000`00f2edc8 000007fb`0226bb1f ntdll!RtlDebugReAllocateHeap+0x3f
00000000`00f2ee08 000007fb`0226d791 ntdll!RtlDebugSizeHeap+0x119
00000000`00f2ee40 000007fb`021f8f40 ntdll!LdrpDefaultExtension+0x0
00000000`00f2ee48 000007fb`02191a96 ntdll!LdrpApplyFileNameRedirection+0x9e
00000000`00f2eea8 000007fa`f92700f0 verifier!`string' <PERF> +0x0
00000000`00f2eed8 000007fb`02191f9c ntdll!LdrGetDllHandleEx+0x4af
00000000`00f2ef38 000007fb`02197b52 ntdll!LdrGetProcedureAddressForCaller+0x3af
00000000`00f2ef78 000007fb`01ea0068 combase!`string'+0x0
00000000`00f2f048 000007fb`02229ffa ntdll! ?? ::FNODOBFM::`string'+0x133e9
00000000`00f2f088 000007fa`f92907a0 verifier!AVrfpRtlAllocateHeap+0x18c
00000000`00f2f098 000007fa`f927873d verifier!AVrfDebugPageHeapSize+0x89
00000000`00f2f0a0 000007fb`014113d0 advapi32!RegOpenKeyExWStub+0x0
00000000`00f2f0b8 000007fb`014113e4 advapi32!RegOpenKeyExWStub+0x14
00000000`00f2f0e8 000007fa`f9270000 verifier!`string' <PERF> +0x0
00000000`00f2f0f8 000007fa`f9292f0c verifier!AVrfpRegOpenKeyExW+0x8c
00000000`00f2f108 000007fb`01e211d0 combase!`string'+0x0
00000000`00f2f118 000007fa`f92861fc verifier!AVrfpIncrementOwnedCriticalSections+0x30
00000000`00f2f128 000007fb`01e9fce5 combase!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<1> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x1b705
00000000`00f2f148 000007fb`01d994b6 combase!ComVerifierSettings::ComVerifierSettings+0x76
00000000`00f2f168 000007fb`022293ca ntdll! ?? ::FNODOBFM::`string'+0x11379
00000000`00f2f178 000007fa`f9285aa5 verifier!AVrfpRtlLeaveCriticalSection+0xcd
00000000`00f2f1a8 000007fb`01d99169 combase!onexit+0x7d
00000000`00f2f1b0 000007fb`01de5608 combase!_chkstk+0x15c8
00000000`00f2f1d8 000007fb`01d99425 combase!_chkstk+0xf35
00000000`00f2f1e0 000007fb`01e203b0 combase!_xc_a+0x190
00000000`00f2f1e8 000007fb`01e204b8 combase!_xc_z+0x0
00000000`00f2f1f8 000007fb`022617cb ntdll!RtlpStdGetRecordedStackTraceIndex+0xab
00000000`00f2f200 000007fb`01e204c8 combase!_xi_a+0x8
00000000`00f2f208 000007fb`014f3cef msvcrt!initterm+0x1f
00000000`00f2f228 000007fb`02293d61 ntdll! ?? ::FNODOBFM::`string'+0x1d051
00000000`00f2f230 000007fb`01e204d0 combase!_xi_z+0x0
00000000`00f2f238 000007fb`01d99209 combase!CRT_INIT+0x1c3
00000000`00f2f250 000007fb`01b6d4b0 rpcrt4!NdrOle_CS+0x0
00000000`00f2f258 000007fb`021bc0c7 ntdll!RtlpAddDebugInfoToCriticalSection+0xb3
00000000`00f2f278 000007fb`01d713b0 combase!CRT_INIT+0x2d4
00000000`00f2f2c8 000007fa`f9284ff7 verifier!AVrfpInsertCritSectInSplayTree+0xa3
00000000`00f2f2e8 000007fa`f92b42a0 verifier!CriticalSectionLock+0x0
00000000`00f2f328 000007fb`01a6746c rpcrt4!SafeAllocaInitialize+0x1c
00000000`00f2f358 000007fb`021853aa ntdll!RtlDeactivateActivationContextUnsafeFast+0xf6
00000000`00f2f378 000007fb`014f11bc msvcrt!free+0x1c
00000000`00f2f380 000007fb`014f0000 msvcrt!_xc_a <PERF> +0x0
00000000`00f2f388 000007fb`0218545f ntdll!RtlActivateActivationContextUnsafeFast+0x93
00000000`00f2f3a8 000007fb`01d99276 combase!DllMainCRTStartup+0x21
00000000`00f2f3d8 000007fa`f9283b2e verifier!AVrfpStandardDllEntryPointRoutine+0xbe
00000000`00f2f418 000007fa`f92b10a0 verifier!AVrfpFirstThreadTlsStruct+0x0
00000000`00f2f420 000007fb`01a50000 rpcrt4!_sz_api_ms_win_security_lsalookup_l1_1_1_dll <PERF> +0x0
00000000`00f2f468 000007fb`00000001 shell32!api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA+0x1
00000000`00f2f498 000007fb`0218ba0e ntdll!LdrpCallInitRoutine+0x3e
00000000`00f2f4a8 000007fb`021a82dc ntdll!LdrpInitializeNode+0x192
00000000`00f2f4b8 000007fb`01d70000 combase!_xc_a <PERF> +0x0
00000000`00f2f4f0 000007fa`f9283a70 verifier!AVrfpStandardDllEntryPointRoutine+0x0
00000000`00f2f548 000007fb`021a82a1 ntdll!LdrpInitializeNode+0x157
00000000`00f2f5a8 000007fb`021a787f ntdll!LdrpInitializeGraph+0x6f
00000000`00f2f5c8 000007fb`021fa3a0 ntdll! ?? ::FNODOBFM::`string'+0x0
00000000`00f2f608 000007fb`021a2592 ntdll!RtlImageNtHeader+0x1e
00000000`00f2f628 000007fb`021ab64e ntdll!LdrpInitializeGraph+0x8d
00000000`00f2f668 000007fb`021b319c ntdll!LdrpInitializeProcess+0x1a1b
00000000`00f2f690 000007fb`00000000 shell32!api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA+0x0
00000000`00f2f6f8 000007f6`772200e8 explorer!_xc_a <PERF> +0x0
00000000`00f2f748 000007fb`016e0000 kernel32!c_PmapEntries_api_ms_win_core_bicltapi_l1_1_0 <PERF> +0x0
00000000`00f2f780 000007fb`021fa090 ntdll!RtlNtdllName+0x18
00000000`00f2f7b8 000007fb`016e2bd0 kernel32!TermsrvGetWindowsDirectoryW+0x0
00000000`00f2f808 000007fb`022bf2e0 ntdll!AvrfpLoaderEntry+0x0
00000000`00f2f850 000007fb`021800d8 ntdll!NtDllUserStubs <PERF> +0x0
00000000`00f2f950 000007fb`02180000 ntdll!NtDllUserStubs <PERF> +0x0
00000000`00f2f968 000007fb`021b216a ntdll! ?? ::FNODOBFM::`string'+0x5766
00000000`00f2f978 000007fb`021b4647 ntdll!InitSecurityCookie+0x2f
00000000`00f2f9a8 000007fb`021b4605 ntdll! ?? ::FNODOBFM::`string'+0x598d
00000000`00f2f9d8 000007fb`021a32ae ntdll!LdrInitializeThunk+0xe
00000000`00f2fab0 000007f6`7725b6d4 explorer!wWinMainCRTStartup+0x0
00000000`00f2fb28 000007fb`021a34e0 ntdll!RtlUserThreadStart+0x0
IMAGE_NAME: snxhk64.dll
FAILURE_BUCKET_ID: STACK_CORRUPTION_CALL_c00000fd_snxhk64.dll!Unknown
BUCKET_ID: APPLICATION_FAULT_STACK_CORRUPTION_STACK_OVERFLOW_CALL_snxhk64+313f
Loaded symbol image file: snxhk64.dll
Image path: C:\Program Files\AVAST Software\Avast\snxhk64.dll
Image name: snxhk64.dll
Timestamp: Thu Mar 07 00:27:21 2013 (5137D0D9)
CheckSum: 00000000
ImageSize: 0004D000
File version: 8.0.1483.72
Product version: 8.0.1483.72
File flags: 0 (Mask 17)
File OS: 4 Unknown Win32
File type: 0.0 Unknown
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: AVAST Software
ProductName: avast! Antivirus
InternalName: snxhk
OriginalFilename: snxhk.dll
ProductVersion: 8.0.1483.72
FileVersion: 8.0.1483.72
FileDescription: avast! snxhk
LegalCopyright: Copyright (c) 2013 AVAST Software
You're a life saver! I uninstalled Avast & my machine works again!
Thank you!
Andre, could you please look into my crash dump also: http : // sdrv . ms / 14PLJdu
I have this issue on my computer and my girlfriend's computer which barely has anything on it. mine was a windows 8 upgrade and hers was a fresh install of windows 8, both 64bit. the files explorer.exe.4908.dmp and explorer.exe.22792.dmp were created when explorer.exe crashed which are the most important to me. the other 3 dumps were unexpected as they were created just logging in which I don't notice anything weird during this time. please have a look its driving us crazy. every time we do a lot of folder navigating it crashes explorer. thanks in advance.
Is there anybody out there that can help me with this issue? My Windows explorer crashes whenever I browse folders with a large number of files.
Any help with this issue would be greatly appreciated.
COMODO Internet Security caused 1 crash:
APPLICATION_VERIFIER_HANDLES_NULL_HANDLE (303)
NULL handle passed as parameter. A valid handle must be used.
This stop is generated if the function on the top of the stack passed a
NULL handle to system routines.
Arguments:
Arg1: 0000000000000000, Not used.
Arg2: 0000000000000000, Not used.
Arg3: 0000000000000000, Not used.
Arg4: 0000000000000000, Not used.
FAULTING_IP:
verifier!VerifierStopMessageEx+6d0
000007ff`8f1da7fc cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007ff8f1da7fc (verifier!VerifierStopMessageEx+0x00000000000006d0)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000001368
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007ff8f1f39ce to 000007ff8f1da7fc
STACK_TEXT:
00000000`0bd8f240 000007ff`8f1f39ce : 000007ff`aa0d88d0 000007ff`8f1dcbc0 000007f7`99017000 000007ff`8f1dcbc0 : verifier!VerifierStopMessageEx+0x6d0
00000000`0bd8f5c0 000007ff`8f1f40f2 : 00000000`02c42940 00000000`00000000 0000b054`4ef29b0c 000007ff`a9fb40dd : verifier!AVrfpHandleSanityChecks+0x3a
00000000`0bd8f610 00000001`80021059 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : verifier!AVrfpNtQueryInformationThread+0x46
00000000`0bd8f650 00000001`8000fae0 : 00000000`08e50bf0 00000000`00000000 00000000`00000016 000007ff`8f1e209a : guard64!Exported+0x1b5a9
00000000`0bd8f6d0 000007ff`aa640052 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : guard64!Exported+0xa030
00000000`0bd8f730 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007ff`aa640052
STACK_COMMAND: ~8s; .ecxr ; kb
FOLLOWUP_IP:
guard64!Exported+1b5a9
00000001`80021059 85c0 test eax,eax
IMAGE_NAME: guard64.dll
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_guard64.dll!Exported
Loaded symbol image file: guard64.dll
Image path: C:\Windows\System32\guard64.dll
Image name: guard64.dll
Timestamp: Thu Jan 24 22:51:52 2013 (5101ACF8)
CheckSum: 00072F57
ImageSize: 00076000
File version: 6.0.2566.2708
Product version: 6.0.2566.2708
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: COMODO
ProductName: COMODO Internet Security
ProductVersion: 6, 0, 264710, 2708
FileVersion: 6, 0, 264710, 2708
FileDescription: COMODO Internet Security
LegalCopyright: 2005-2012 COMODO. All rights reserved.
the other crash is caused by Google Drive shell extension:
FAULTING_IP:
ntdll!RtlReportCriticalFailure+89
000007fb`1eaba485 eb00 jmp ntdll!RtlReportCriticalFailure+0x8b (000007fb`1eaba487)
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fb1eaba485 (ntdll!RtlReportCriticalFailure+0x0000000000000089)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000007fb1eb0fd60
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_PARAMETER1: 000007fb1eb0fd60
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
LAST_CONTROL_TRANSFER: from 000007fb1eabf2a0 to 000007fb1eaba485
FAULTING_THREAD: ffffffffffffffff
BUGCHECK_STR: APPLICATION_FAULT_STATUS_HEAP_CORRUPTION_AFTER_CALL
PRIMARY_PROBLEM_CLASS: STATUS_HEAP_CORRUPTION_AFTER_CALL
DEFAULT_BUCKET_ID: STATUS_HEAP_CORRUPTION_AFTER_CALL
STACK_TEXT:
000007fb`1eb0fdc8 000007fb`1eadbf2f ntdll! ?? ::FNODOBFM::`string'+0x13981
000007fb`1eb0fdd0 00000000`77cbcabc msvcr90!free+0x1c
000007fb`1eb0fdd8 00000000`775c9f71 msvcp90!std::basic_string<unsigned short,std::char_traits<unsigned short>,std::allocator<unsigned short> >::~basic_string<unsigned short,std::char_traits<unsigned short>,std::allocator<unsigned short> >+0x19
000007fb`1eb0fde0 000007fb`004e2e7a googledrivesync64!DllCanUnloadNow+0xd2a
000007fb`1eb0fde8 000007fb`1cd240b6 shell32!CFSIconOverlayManager::_GetFileOverlayInfo+0xca
000007fb`1eb0fdf0 000007fb`1cc78410 shell32!CFSIconOverlayManager::GetFileOverlayInfo+0x48
000007fb`1eb0fdf8 000007fb`1cd246b7 shell32!CFSFolder::_GetOverlayInfo+0xdf
000007fb`1eb0fe00 000007fb`1cd277f2 shell32!CIconOverlayTask::InternalResumeRT+0x14a
000007fb`1eb0fe08 000007fb`1cce8324 shell32!CRunnableTask::Run+0x98
000007fb`1eb0fe10 000007fb`1ccdf388 shell32!CShellTask::TT_Run+0x3c
000007fb`1eb0fe18 000007fb`1cbb18df shell32!CShellTaskThread::ThreadProc+0xd7
000007fb`1eb0fe20 000007fb`1cbb19e7 shell32!CShellTaskThread::s_ThreadProc+0x33
000007fb`1eb0fe28 000007fb`1aa4157f shcore!ExecuteWorkItemThreadProc+0xf
000007fb`1eb0fe30 000007fb`1e9e7f59 ntdll!RtlpTpWorkCallback+0x189
000007fb`1eb0fe38 000007fb`1e9d8842 ntdll!TppWorkerThread+0x604
000007fb`1eb0fe40 000007fb`1dea167e kernel32!BaseThreadInitThunk+0x1a
000007fb`1eb0fe48 000007fb`1e9f3501 ntdll!RtlUserThreadStart+0x1d
FOLLOWUP_IP:
googledrivesync64!DllCanUnloadNow+d2a
000007fb`004e2e7a 418bc5 mov eax,r13d
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: googledrivesync64!DllCanUnloadNow+d2a
FOLLOWUP_NAME: wintriag
MODULE_NAME: googledrivesync64
IMAGE_NAME: googledrivesync64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 513930fc
STACK_COMMAND: dps 7fb1eb0fdc8 ; kb
FAILURE_BUCKET_ID: STATUS_HEAP_CORRUPTION_AFTER_CALL_c0000374_googledrivesync64.dll!DllCanUnloadNow
BUCKET_ID: APPLICATION_FAULT_STATUS_HEAP_CORRUPTION_AFTER_CALL_googledrivesync64!DllCanUnloadNow+d2a
Loaded symbol image file: googledrivesync64.dll
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Timestamp: Fri Mar 08 01:29:48 2013 (513930FC)
CheckSum: 000BDD33
ImageSize: 000C0000
File version: 1.8.4357.4863
Product version: 1.8.4357.4863
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Google
ProductName: Google Drive
ProductVersion: 1.8.4357.4863
FileVersion: 1.8.4357.4863
FileDescription: Google Drive shell extension
LegalCopyright: Google
I use WinDbg. Read here how to get the correct symbols:
http://support.microsoft.com/kb/311503
If you install updates you need the updated PDB files. So use the symbol server and don't install the symbol package
Andre, I am having th explorer crash on some new Dell Inspiron 14 laptops. I ran the reg file which has created dump files, but they are all over 200 MB in size. Is there a way to trim them? Skydrive only allows 100 MB I think.
The one thing we recently discovered is that on one of the laptops, right clicking on the touchpad seems to cause Explorer to crash. But this isn't consistent.
Andre, I am having th explorer crash on some new Dell Inspiron 14 laptops. I ran the reg file which has created dump files, but they are all over 200 MB in size. Is there a way to trim them? Skydrive only allows 100 MB I think.
The one thing we recently discovered is that on one of the laptops, right clicking on the touchpad seems to cause Explorer to crash. But this isn't consistent.
Sir Andre, please help me also with my explorer crash problem. Here's my dump file:
http://sdrv.ms/ZKhDkM
I just recently uninstalled several programs which I think affects this problem, although I don't know how to read dump files. I manage to uninstall programs such as Stardock, Rainmeter and Xwidget but still no effect. I already performed registry clean-up using Tune-up Utilities 2012.
Sir Andre, please help me also with my explorer crash problem. Here's my dump file:
the following file seams to cause the crash:
Mega Codec Pack\Filters\Haali\mmdinfo.dll
APPLICATION_VERIFIER_LOCKS_LOCK_IN_FREED_HEAP (202)
Freeing heap block containing an active critical section.
This stop is generated if a heap allocation contains a critical section,
the allocation is freed and the critical section has not been deleted.
To debug this stop use the following debugger commands:
$ !cs -s parameter1 - dump information about this critical section.
$ ln parameter1 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter2 - to dump the stack trace for this critical section initialization.
$ parameter3 and parameter4 might help understand where this heap block was
allocated (the size of the allocation is probably significant).
Arguments:
Arg1: 0ec591f4, Critical section address.
Arg2: 01563e14, Critical section initialization stack trace.
Arg3: 0ec591c0, Heap block address.
Arg4: 0000004c, Heap block size.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for duser.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for uxtheme.dll -
FAULTING_IP:
verifier!VerifierStopMessageEx+701
66d6c121 cc int 3
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 66d6c121 (verifier!VerifierStopMessageEx+0x00000701)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 84db8600
Parameter[2]: 059b6ca0
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
CRITICAL_SECTION: 0ec591f4 -- (!cs -s 0ec591f4)
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 84db8600
EXCEPTION_PARAMETER3: 059b6ca0
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 00000aa8
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 66d76598 to 66d6c121
STACK_TEXT:
0b50ec7c 66d76598 66d85488 00000202 0ec591f4 verifier!VerifierStopMessageEx+0x701
0b50eca8 66d74531 00000000 0000004c 00000000 verifier!AVrfpFreeMemLockChecks+0xc5
0b50ecc8 66d7ef52 00000000 0000004c 00000000 verifier!AVrfpFreeMemNotify+0x2a
0b50ece0 77a0fffa 0ec591c0 0000004c 0ea60000 verifier!AVrfpNtdllHeapFreeCallback+0x15
0b50ed00 66d686ee 0ec591c0 0000004c 0ec50000 ntdll!AVrfInternalHeapFreeNotification+0x4a
0b50ed2c 779c6c8e 0ea60000 7798c0fa 66d94600 verifier!AVrfDebugPageHeapDestroy+0x16e
0b50ed40 66d7f026 0ea60000 00000000 00000000 ntdll!RtlDestroyHeap+0x74
0b50ed54 75292c7c 0ea60000 0b50ed98 6a5dcd37 verifier!AVrfpRtlDestroyHeap+0x33
0b50ed60 6a5dcd37 0ea60000 6a5da935 f803d02b KERNELBASE!HeapDestroy+0xe
WARNING: Stack unwind information not available. Following frames may be wrong.
0b50ed98 6a5daa7c 6a5c0000 00000000 00000000 mmdinfo!DllUnregisterServer+0x823e
0b50edd8 6a5daae7 6a5c0000 0b50ee38 66d752f1 mmdinfo!DllUnregisterServer+0x5f83
0b50ede4 66d752f1 6a5c0000 00000000 00000000 mmdinfo!DllUnregisterServer+0x5fee
0b50ee38 7794ed9a 6a5c0000 00000000 00000000 verifier!AVrfpStandardDllEntryPointRoutine+0x9f
0b50ee58 7794ee10 66d75252 6a5c0000 00000000 ntdll!LdrxCallInitRoutine+0x16
0b50eea0 7798b996 66d75252 6a5c0000 00000000 ntdll!LdrpCallInitRoutine+0x63
0b50ef0c 7798b746 094fe360 09516650 094fe360 ntdll!LdrpProcessDetachNode+0x10f
0b50ef48 779556e1 094fe360 12631328 09516650 ntdll!LdrpUnloadNode+0x51
0b50ef80 77951b15 014fe360 12631360 779519c1 ntdll!LdrpDecrementNodeLoadCount+0x17d
0b50efc8 66d7573f 6a5c0000 0b50f4b8 09500406 ntdll!LdrUnloadDll+0x12b
0b50efdc 7528ce33 6a5c0000 00000001 0b50eff8 verifier!AVrfpLdrUnloadDll+0x61
0b50efec 774c1fae 6a5c0000 0b50f00c 774c2013 KERNELBASE!FreeLibrary+0x15
0b50eff8 774c2013 00000006 6a5c0000 00000000 combase!FreeLibraryWithLogging+0x21
0b50f00c 7748f730 0b50f3f8 774742f0 00000000 combase!CClassCache::CDllPathEntry::CFinishObject::Finish+0x28
0b50f4d0 7748e8e1 127f3c56 00000001 0b50f558 combase!CClassCache::CleanUpDllsForApartment+0x2a0
0b50f528 7748e6c6 0b50f598 66d76927 00000000 combase!FinishShutdown+0x13b
0b50f564 7748f08d 00000000 08c75ca0 00000000 combase!ApartmentUninitialize+0xb4
0b50f57c 774896ff 00000000 0059a214 094df968 combase!wCoUninitialize+0x163
0b50f5a4 66d7a1e7 0b50f5b8 76396400 05314e68 combase!CoUninitialize+0x9d
0b50f5ac 76396400 05314e68 0b50f5c8 75473678 verifier!AVrfpCoUninitialize+0x17
0b50f5b8 75473678 094df968 05b54f00 0b50f708 shell32!CShellTaskThread::s_ThreadProc+0x30
0b50f5c8 77988ab2 05314e68 12630ba0 005081f0 SHCore!DllCanUnloadNow+0x36
0b50f708 7794a35e 0b50f758 05b54f00 12630430 ntdll!RtlpTpWorkCallback+0x27f
0b50f898 76091866 005081f0 0b50f8e8 779668f1 ntdll!TppWorkerThread+0x538
0b50f8a4 779668f1 005081f0 12630440 00000000 kernel32!BaseThreadInitThunk+0xe
0b50f8e8 7796689d ffffffff 779f5ae2 00000000 ntdll!__RtlUserThreadStart+0x4a
0b50f8f8 00000000 7796704d 005081f0 00000000 ntdll!_RtlUserThreadStart+0x1c
FOLLOWUP_IP:
mmdinfo!DllUnregisterServer+823e
6a5dcd37 8325583c5f6a00 and dword ptr [mmdinfo!DllUnregisterServer+0x1f15f (6a5f3c58)],0
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: mmdinfo!DllUnregisterServer+823e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: mmdinfo
IMAGE_NAME: mmdinfo.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 50c45e1c
STACK_COMMAND: ~30s; .ecxr ; kb
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_mmdinfo.dll!DllUnregisterServer
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_mmdinfo!DllUnregisterServer+823e
Loaded symbol image file: mmdinfo.dll
Image path: C:\Program Files\Mega Codec Pack\Filters\Haali\mmdinfo.dll
Image name: mmdinfo.dll
Timestamp: Sun Dec 09 10:47:08 2012
remove those codec packs.
Hi,
Can you see my dump file ?
https://59mpgw.dm1.livefilestore.com/y1pS9HPxU-y8IVz_n2H8uBaZz5h60i61lC9PP-GUJqhkpj9auFOX0ikx6oAfqlNiLAm/explorer.exe.1556.rar?download&psid=1
Thank you very much.
Hi,
Can you see my dump file ?
https://59mpgw.dm1.livefilestore.com/y1pS9HPxU-y8IVz_n2H8uBaZz5h60i61lC9PP-GUJqhkpj9auFOX0ikx6oAfqlNiLAm/explorer.exe.1556.rar?download&psid=1
Thank you very much.
Hi,
Can you see my dump file ?
Hi, you are having issues with QT runtime. Please try updating to the latest stable version of QT runtime with major version 4: http://qt-project.org/downloads
For some reason, the QT runtime is causing an NX bit bit issue when attempting a system call. Do you have some QT-based software (like, say, AutoCAD) integrated into your shell? The runtime is trying to access a protected memory area (a protected memory page) and run the code at that address, and the Execute Disable bit technology (in Intel CPU) is preventing it (because some process has marked that page as protected and disabled execution of the code from that address; this is typically done to protect from code injections and buffer overflow attacks.)
Seems like some software based on the QT runtime is trying to inject its code into Windows Explorer process, and since latter has Data Execution Prevention turned on by default (can be checked on the Details tab of your Task Manager, this causes a crash).
Hi Exotic Hadron,
I have Autodesk Products.
I try to update QT Runtime.
I'll let you know
Regards.
Hi Exotic Hadron,
I have Autodesk Products.
I try to update QT Runtime.
I'll let you know
Regards.
Hi,
If you're using Maya, make sure you use the modified QT runtime called PyQT, which is downloaded at http://www.riverbankcomputing.com/static/Downloads/PyQt4/
Read here for more details on how you could build the Qt runtime for your Autodesk products:
If you're using Autodesk, I would also check to see your registry settings and probably set its options to allow the registry database to grow unlimited and remove the limit of 4 Gbytes:
http://forums.esri.com/thread.asp?t=287391&f=1148&c=93#902480
I'm quoting on this:
1) If you are receiving the "Low Registry Space" error, set the Registry Size Limit to "unlimited": HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control Key: RegistrySizeLimit Type: REG_DWORD Value: 0xffffff (4294967295) 2) Reboot
Additionally, make sure to check DEP protection is enabled on your PC: http://support.microsoft.com/kb/912923
If nothing helps you, add Autodesk software to the exclusion list and disable Data Execution Prevention (DEP) for it: http://windows.microsoft.com/en-US/windows-vista/Change-Data-Execution-Prevention-settings
If nothing helps you, you can disable the DEP and turn off support for XD/NX bit in OS by setting the corresponding bit in the boot record.
To turn DEP/NX bit off:
1. In the elevated command prompt run:
bcdedit.exe /set {current} nx AlwaysOff
To turn DEP/NX bit off:
1. In the elevated command prompt run:
bcdedit.exe /set {current} nx AlwaysOn
You can even create a separate boot entry in the Boot Manager and be able to boot into a system configuration where DEP is turned off.
To create a new boot entry and turn off DEP for it (all commands must be executed in an elevated command prompt; hold Ctrl+Shift pressed when clicking Command prompt icon on the Start screen to open it with elevated permissions, confirm elevation when asked):
1. Copy your current boot entry (the one you used to boot into OS) to a new entry and name the new entry as "Data Execution Prevention Off". This is how you will see the new entry displayed in the Boot Manager next time you boot into Windows.
C:\Windows\system32>bcdedit /copy {current} /d "Data Execution Prevention Off"
2. Once ran, the command will return a GUID like: {8ed69d9a-4741-4307-a4f3-4a95326d4af4}
This GUID will be used as a unique identifier of a newly created boot record in the boot manager's menu. This new boot entry will hold all the settings of its master record from which it is copied (your current settings where NX bit is turned on).
3. Now modify the settings for this new boot record and execute:
C:\Windows\system32>bcdedit /set {8ed69d9a-4741-4307-a4f3-4a95326d4af4} nx AlwaysOff
NOTE: put your actual GUID returned to you after you've executed command in step 1 instead of {8ed69d9a-4741-4307-a4f3-4a95326d4af4}, the latter is fictitious and used for the sake of example only.
4. Restart the PC; now you will have your new Data Execution Prevention Off shown to you in the Boot Manager, choose this record to start the PC without support for NX bit.
WARNING! I HIGLY RECOMMEND YOU DO NOT DISABLE DEP PROTECTION BECAUSE DISABLING NX BIT POSES HIGH SECURITY RISKS AND OPENS WAYS FOR MALWARE TO IMPLEMENT BUFFER OVERFLOW ATTACKS ON YOUR PC.
Still if you think there is little chance you get a malware running locally on your PC, you may opt for turning DEP and run that, eh, faulty Autodesk product.
Hi, cavara,
So it did help you somehow, right? Glad to hear if it did. You are welcome.
This is mine : https://skydrive.live.com/redir?resid=9F0DA8F031098F3!121
My laptop is lenovo y500 with original win 8
My laptop is lenovo y500 with original win 8
Comodo Internet security causes the crash:
APPLICATION_VERIFIER_HANDLES_NULL_HANDLE (303)
NULL handle passed as parameter. A valid handle must be used.
This stop is generated if the function on the top of the stack passed a
NULL handle to system routines.
Arguments:
Arg1: 0000000000000000, Not used.
Arg2: 0000000000000000, Not used.
Arg3: 0000000000000000, Not used.
Arg4: 0000000000000000, Not used.
FAULTING_IP:
verifier!VerifierStopMessageEx+6d0
000007ff`ec8ea7fc cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007ffec8ea7fc (verifier!VerifierStopMessageEx+0x00000000000006d0)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000000734
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007ffec9039ce to 000007ffec8ea7fc
STACK_TEXT:
00000000`0103f2c0 000007ff`ec9039ce : 00000000`00000708 00000000`0103f880 00000000`09a70000 00000000`00000734 : verifier!VerifierStopMessageEx+0x6d0
00000000`0103f640 000007ff`ec904536 : 00000000`00000000 00000000`00000000 00000000`00000000 000007ff`f15563e4 : verifier!AVrfpHandleSanityChecks+0x3a
00000000`0103f690 00000001`8001fa49 : 00000000`00000000 00000000`0103f880 00000000`00000000 00000000`00000000 : verifier!AVrfpNtQueryInformationProcess+0x46
00000000`0103f6d0 00000001`8000f0fd : 00000000`08870870 00000000`00000000 000007f7`3625d2c8 00000000`00000005 : guard64!Exported+0x1e379
00000000`0103f750 000007ff`f17e0052 : 00000000`00000000 ffffffff`00000001 00000000`00000005 ffffffff`ffffffff : guard64!Exported+0xda2d
00000000`0103f7a0 00000000`00000000 : ffffffff`00000001 00000000`00000005 ffffffff`ffffffff 000007ff`00140012 : 0x000007ff`f17e0052
STACK_COMMAND: ~0s; .ecxr ; kb
FOLLOWUP_IP:
guard64!Exported+1e379
00000001`8001fa49 85c0 test eax,eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: guard64!Exported+1e379
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: guard64
IMAGE_NAME: guard64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 51766998
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_guard64.dll!Exported
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_guard64!Exported+1e379
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/6_2_9200_16433/50763312/verifier_dll/6_2_9200_16384/5010ac29/80000003/0000a7fc.htm?Retriage=1
Followup: MachineOwner
---------
0:000> lmvm guard64
start end module name
00000001`80000000 00000001`80070000 guard64 (export symbols) guard64.dll
Loaded symbol image file: guard64.dll
Image path: C:\Windows\System32\guard64.dll
Image name: guard64.dll
Timestamp: Tue Apr 23 12:59:36 2013 (51766998)
CheckSum: 0006D040
ImageSize: 00070000
File version: 6.1.14060.2807
Product version: 6.1.14060.2807
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: COMODO
ProductName: COMODO Internet Security
ProductVersion: 6, 1, 276204, 2807
FileVersion: 6, 1, 276204, 2807
FileDescription: COMODO Internet Security
LegalCopyright: 2005-2013 COMODO. All rights reserved.
Hi everyone, I have windows 8 pro installed on my PC. I started to have this explorer crashes around 15-20 days ago. So I wanted to give my skydrive link to my dump file. But my account needs to be verified.
Someone please verify my account.
Please help.
Thanks a lot.
google drive seams to cause it. Disable the sync overlay icons in the Google Drive options.
ntdll!NtWaitForSingleObject
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
ntdll!RtlReportCriticalFailure$filt$0
ntdll!_C_specific_handler
ntdll!_GSHandlerCheck_SEH
ntdll!RtlpExecuteHandlerForException
ntdll!RtlDispatchException
ntdll!RtlRaiseException
ntdll!RtlReportCriticalFailure
ntdll!RtlpLogHeapFailure
ntdll!RtlFreeHeap
msvcr90!free
googledrivesync64!DllCanUnloadNow
shell32!CFSIconOverlayManager::_GetFileOverlayInfo
shell32!CFSIconOverlayManager::GetFileOverlayInfo
shell32!CFSFolder::_GetOverlayInfo
shell32!CKnownFoldersFolder::_GetOverlayIndex
shell32!CRegFolder::GetOverlayIndex
explorerframe!CNscOverlayTask::InternalResumeRT
explorerframe!CRunnableTask::Run
shell32!CShellTask::TT_Run
shell32!CShellTaskThread::ThreadProc
shell32!CShellTaskThread::s_ThreadProc
SHCore!ExecuteWorkItemThreadProc
ntdll!RtlpTpWorkCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
Loaded symbol image file: googledrivesync64.dll Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll Image name: googledrivesync64.dll Timestamp: Fri Jun 07 08:55:22 2013 (51B183DA) CheckSum: 000CAC91 ImageSize: 000C0000 File version: 1.10.4769.632 Product version: 1.10.4769.632 File flags: 0 (Mask 3F) File OS: 4 Unknown Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Google ProductName: Google Drive ProductVersion: 1.10.4769.0632 FileVersion: 1.10.4769.0632 FileDescription: Google Drive shell extension LegalCopyright: Google
Thanks a lot, Andre. I have disabled the sync status icons and the file explorer seems to work fine now.
I have the same problem too, and here is my dmp file, http://sdrv.ms/13rvkvw
I appreciate your work. :)
I have the same problem too, and here is my dmp file, http://sdrv.ms/13rvkvw
I appreciate your work. :)
a files called MenuEx.dll causes the crash.
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for SogouPY.ime -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for 360UDiskGuard64.dll -
FAULTING_IP:
MenuEx!unloaded+18385
00000001`80018385 ?? ???
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0000000180018385 (<Unloaded_MenuEx.dll>+0x0000000000018385)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000008
Parameter[1]: 0000000180018385
Attempt to execute non-executable address 0000000180018385
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000113
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=0000000180018385 rsp=000000002048fea0 rbp=0000000000000000
r8=000000002048fe68 r9=0000000000000000 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010204
<Unloaded_MenuEx.dll>+0x18385:
00000001`80018385 ?? ???
DEFAULT_BUCKET_ID: BAD_INSTRUCTION_PTR
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_PARAMETER1: 0000000000000008
EXCEPTION_PARAMETER2: 0000000180018385
WRITE_ADDRESS: 0000000180018385
FOLLOWUP_IP:
MenuEx!unloaded+18385
00000001`80018385 ?? ???
FAILED_INSTRUCTION_ADDRESS:
MenuEx!unloaded+18385
00000001`80018385 ?? ???
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
IP_MODULE_UNLOADED:
MenuEx!unloaded+18385
00000001`80018385 ?? ???
FAULTING_THREAD: 0000000000001158
PRIMARY_PROBLEM_CLASS: BAD_INSTRUCTION_PTR
BUGCHECK_STR: APPLICATION_FAULT_BAD_INSTRUCTION_PTR_SOFTWARE_NX_FAULT
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000180018385
STACK_TEXT:
<Unloaded_MenuEx.dll>+0x18385
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: menuex!unloaded+18385
IMAGE_NAME: MenuEx.dll
FAILURE_BUCKET_ID: BAD_INSTRUCTION_PTR_c0000005_MenuEx.dll!unloaded
BUCKET_ID: APPLICATION_FAULT_BAD_INSTRUCTION_PTR_SOFTWARE_NX_FAULT_UNLOADED_IP_menuex!unloaded+18385
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:bad_instruction_ptr_c0000005_menuex.dll!unloaded
FAILURE_ID_HASH: {29050b42-f687-ecb2-0087-871ffdeb7f31}
But I can't see any details about the file. Search for it on your HDD, look at the file properties and look for the manufacture. Go to site and get an updated version of the tool.
explorer crashes when copy a file over the explorer
please can you analyze my files?
https://www.dropbox.com/sh/771aae1mgzbmiul/mq2uFVaZ9X
dave
explorer crashes when copy a file over the explorer
please can you analyze my files?
https://www.dropbox.com/sh/771aae1mgzbmiul/mq2uFVaZ9X
dave
Hi Dave,
I don't like that Mpk64.dll library that is popping up here and there in your Windows Blue 8.3 dumps.
I would recommend scanning your PC for malware, at least I'd do that for %appdata% and %systemroot%. Free tool from Kaspersky would do the trick. Or you could use any antimalware tool of your like.
Google traces this library to the KGB keyboard tracer/keylogger that spies for everything you type. Running a quick scan is a no big deal, so I would go and do this.
Hi, my explorer crashes and reloads.. what should i do? and there's no dmp files
but there is a dmp file in C:\Local dump Files
Hi, my explorer crashes and reloads.. what should i do? and there's no dmp files
but there is a dmp file in C:\Local dump Files
yes, i tried to import the .reg file. and it still crashes and reloads..
yes, i tried to import the .reg file. and it still crashes and reloads..
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full.reg
this is the .reg file that i used. and the Windows Error reporting Service is running
http://cid-128fc518635be2dc.skydrive.live.com/self.aspx/.Public/MS%20Foren/Registry/WER%5E_Explorer_full.reg
this is the .reg file that i used. and the Windows Error reporting Service is running
hi andre, i found this .dmp file in C:\local dump files https://skydrive.live.com/#cid=A5E572BF5C5325A5&id=A5E572BF5C5325A5%21103
yes, it is correctly imported.
Hi,
Same problem here for some reason. Tried to view the debug information myself, but I don't understand how to use it.
https://drive.google.com/folderview?id=0ByKen41yqyXeRDJMTnYxbzl6bkk&usp=sharing
Thanks in advance!
hi andre, i found this .dmp file in C:\local dump files https://skydrive.live.com/#cid=A5E572BF5C5325A5&id=A5E572BF5C5325A5%21103
hi andre, i found this .dmp file in C:\local dump files https://skydrive.live.com/#cid=A5E572BF5C5325A5&id=A5E572BF5C5325A5%21103
ok, I got the dump. Looks like the OverlayIcons from the MS SkyDrive app causes it. use ShellExView to disable the sync icons.
APPLICATION_VERIFIER_LOCKS_LOCK_IN_FREED_HEAP (202)
Freeing heap block containing an active critical section.
This stop is generated if a heap allocation contains a critical section,
the allocation is freed and the critical section has not been deleted.
To debug this stop use the following debugger commands:
$ !cs -s parameter1 - dump information about this critical section.
$ ln parameter1 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter2 - to dump the stack trace for this critical section initialization.
$ parameter3 and parameter4 might help understand where this heap block was
allocated (the size of the allocation is probably significant).
Arguments:
Arg1: 07c4a724, Critical section address. Run !cs -s <address> to get more information.
Arg2: 008365b4, Critical section initialization stack trace. Run dps <address> to dump the stack trace.
Arg3: 07c4a6f0, Heap block address.
Arg4: 0000004c, Heap block size.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL -
FAULTING_IP:
verifier!VerifierStopMessageEx+701
7401c121 cc int 3
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7401c121 (verifier!VerifierStopMessageEx+0x00000701)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 86641d40
Parameter[2]: 0500b670
CONTEXT: 00000000 -- (.cxr 0x0;r)
eax=00000000 ebx=04fc0000 ecx=00000400 edx=00000000 esi=00000000 edi=00000000
eip=77ce6954 esp=09b1e5ac ebp=09b1e658 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!KiFastSystemCallRet:
77ce6954 c3 ret
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
CRITICAL_SECTION: 07c4a724 -- (!cs -s 07c4a724)
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 86641d40
EXCEPTION_PARAMETER3: 0500b670
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
FAULTING_THREAD: 00001504
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 74026598 to 7401c121
STACK_TEXT:
09b1ecec 74026598 74035488 00000202 07c4a724 verifier!VerifierStopMessageEx+0x701
09b1ed18 74024531 00000000 0000004c 00000000 verifier!AVrfpFreeMemLockChecks+0xc5
09b1ed38 7402ef52 00000000 0000004c 00000000 verifier!AVrfpFreeMemNotify+0x2a
09b1ed50 77dafffa 07c4a6f0 0000004c 07950000 verifier!AVrfpNtdllHeapFreeCallback+0x15
09b1ed70 740186ee 07c4a6f0 0000004c 07c40000 ntdll!AVrfInternalHeapFreeNotification+0x4a
09b1ed9c 77d66c8e 07950000 77d2c0fa 74044600 verifier!AVrfDebugPageHeapDestroy+0x16e
09b1edb0 7402f026 07950000 00000000 00000000 ntdll!RtlDestroyHeap+0x74
09b1edc4 753e2c7c 07950000 09b1ee08 6a17cd87 verifier!AVrfpRtlDestroyHeap+0x33
09b1edd0 6a17cd87 07950000 6a17a985 478c855a KERNELBASE!HeapDestroy+0xe
WARNING: Stack unwind information not available. Following frames may be wrong.
09b1ee08 6a17aacc 6a160000 00000000 00000000 MediaIconsOverlays!DllUnregisterServer+0x8f26
09b1ee48 6a17ab37 6a160000 09b1eea8 740252f1 MediaIconsOverlays!DllUnregisterServer+0x6c6b
09b1ee54 740252f1 6a160000 00000000 00000000 MediaIconsOverlays!DllUnregisterServer+0x6cd6
09b1eea8 77ceed9a 6a160000 00000000 00000000 verifier!AVrfpStandardDllEntryPointRoutine+0x9f
09b1eec8 77ceee10 74025252 6a160000 00000000 ntdll!LdrxCallInitRoutine+0x16
09b1ef10 77d2b996 74025252 6a160000 00000000 ntdll!LdrpCallInitRoutine+0x63
09b1ef7c 77d2b746 08181798 081f7750 08181798 ntdll!LdrpProcessDetachNode+0x10f
09b1efb8 77cf56e1 08181798 573b2e4f 081f7750 ntdll!LdrpUnloadNode+0x51
09b1eff0 77cf1b15 01181798 573b3187 77cf19c1 ntdll!LdrpDecrementNodeLoadCount+0x17d
09b1f038 7402573f 6a160000 09b1f638 06f254a2 ntdll!LdrUnloadDll+0x12b
09b1f04c 753dce33 6a160000 00000001 09b1f068 verifier!AVrfpLdrUnloadDll+0x61
09b1f05c 75711fae 6a160000 09b1f07c 75712013 KERNELBASE!FreeLibrary+0x15
09b1f068 75712013 00000006 6a160000 00000000 combase!FreeLibraryWithLogging+0x21
09b1f07c 756df730 09b1f458 756c42f0 00000000 combase!CClassCache::CDllPathEntry::CFinishObject::Finish+0x28
09b1f650 756de8e1 55823919 00000001 09b1f6d8 combase!CClassCache::CleanUpDllsForApartment+0x2a0
09b1f6a8 756de6c6 09b1f718 74026927 00000000 combase!FinishShutdown+0x13b
09b1f6e4 756df08d 00000000 070bff88 00000000 combase!ApartmentUninitialize+0xb4
09b1f6fc 756d96ff 00000000 01906f1c 0817e468 combase!wCoUninitialize+0x163
09b1f724 7402a1e7 09b1f738 76646454 04db72e0 combase!CoUninitialize+0x9d
09b1f72c 76646454 04db72e0 09b1f748 760e3678 verifier!AVrfpCoUninitialize+0x17
09b1f738 760e3678 0817e468 081c3d48 09b1f888 shell32!CShellTaskThread::s_ThreadProc+0x30
09b1f748 77d28ab2 04db72e0 573b3937 0188be10 SHCore!ExecuteWorkItemThreadProc+0x10
09b1f888 77cea35e 09b1f8d8 081c3d48 573b3ba7 ntdll!RtlpTpWorkCallback+0x27f
09b1fa18 75ed173e 0188be10 09b1fa68 77d068f1 ntdll!TppWorkerThread+0x538
09b1fa24 77d068f1 0188be10 573b3bd7 00000000 kernel32!BaseThreadInitThunk+0xe
09b1fa68 77d0689d ffffffff 77d95ae2 00000000 ntdll!__RtlUserThreadStart+0x4a
09b1fa78 00000000 77d0704d 0188be10 00000000 ntdll!_RtlUserThreadStart+0x1c
FOLLOWUP_IP:
MediaIconsOverlays!DllUnregisterServer+8f26
6a17cd87 83253840196a00 and dword ptr [MediaIconsOverlays!DllUnregisterServer+0x201d7 (6a194038)],0
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: mediaiconsoverlays!DllUnregisterServer+8f26
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: MediaIconsOverlays
IMAGE_NAME: MediaIconsOverlays.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5180006a
STACK_COMMAND: ~35s; .ecxr ; kb
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_MediaIconsOverlays.dll!DllUnregisterServer
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_mediaiconsoverlays!DllUnregisterServer+8f26
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_mediaiconsoverlays.dll!dllunregisterserver
FAILURE_ID_HASH: {5c7ce48a-f647-b9dc-5aab-cb3d581bdccf}
Followup: MachineOwner
---------
0:035> lmvm MediaIconsOverlays
start end module name
6a160000 6a19b000 MediaIconsOverlays (export symbols) MediaIconsOverlays.dll
Loaded symbol image file: MediaIconsOverlays.dll
Image path: C:\ProgramData\Microsoft\Media Tools\MediaIconsOverlays.dll
Image name: MediaIconsOverlays.dll
Timestamp: Tue Apr 30 19:33:30 2013 (5180006A)
CheckSum: 000411AD
ImageSize: 0003B000
File version: 1.0.0.1
Product version: 1.0.0.1
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: Microsoft
ProductName: Online files icon's overlay
ProductVersion: 1.0.2.3
FileVersion: 1.0.2.5
FileDescription: Online files icon's overlay
LegalCopyright: Microsoft
LegalTrademarks: Microsoft
Comments: Online files icon's overlay
Hi,
Same problem here for some reason. Tried to view the debug information myself, but I don't understand how to use it.
https://drive.google.com/folderview?id=0ByKen41yqyXeRDJMTnYxbzl6bkk&usp=sharing
Thanks in advance!
this Apple DLL crashes your Explorer: ShellStreams64.dll
APPLICATION_VERIFIER_HANDLES_NULL_HANDLE (303)
NULL handle passed as parameter. A valid handle must be used.
This stop is generated if the function on the top of the stack passed a
NULL handle to system routines.
Arguments:
Arg1: 0000000000000000, Not used.
Arg2: 0000000000000000, Not used.
Arg3: 0000000000000000, Not used.
Arg4: 0000000000000000, Not used.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ClassicStartMenuDLL.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL -
FAULTING_IP:
verifier!VerifierStopMessageEx+6d0
000007fd`8551a7fc cc int 3
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fd8551a7fc (verifier!VerifierStopMessageEx+0x00000000000006d0)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
FAULTING_THREAD: 0000000000000ab8
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
LAST_CONTROL_TRANSFER: from 000007fd855339ce to 000007fd8551a7fc
STACK_TEXT:
00 ntdll!NtWaitForSingleObject
01 ntdll!RtlReportExceptionEx
02 ntdll!RtlReportException
03 verifier!AVrfpVectoredExceptionHandler
04 ntdll!RtlpCallVectoredHandlers
05 ntdll!RtlDispatchException
06 ntdll!KiUserExceptionDispatch
07 verifier!VerifierStopMessageEx
08 verifier!AVrfpHandleSanityChecks
09 verifier!AVrfpNtSetEvent
0a KERNELBASE!SetEvent
0b ShellStreams64!DllCanUnloadNow
0c ShellStreams64
0d ShellStreams64
0e shell32!CRegFolder::_CreateCachedRegFolder
0f shell32!CRegFolder::BindToObject
10 shell32!CShellItem::BindToHandler
11 shell32!CShellItem::_GetPropertyStoreWorker
12 shell32!CShellItem::GetPropertyStoreForKeys
13 shell32!CShellItem::GetProperty
14 explorerframe!CNscEnumTask::InternalResumeRT
15 explorerframe!CRunnableTask::Run
16 shell32!CShellTask::TT_Run
17 shell32!CShellTaskThread::ThreadProc
18 shell32!CShellTaskThread::s_ThreadProc
19 SHCore!ExecuteWorkItemThreadProc
1a ntdll!RtlpTpWorkCallback
1b ntdll!TppWorkerThread
1c kernel32!BaseThreadInitThunk
1d ntdll!RtlUserThreadStart
0x0000000013ead738 : 0x0000000013eade50 : 0x000007fd8551a7fc : verifier!VerifierStopMessageEx+0x6d0
0x0000000013ead758 : 0x000007fd9a43dfe0 : ntdll!RtlpWalkFrameChain+0xed7
0x0000000013ead768 : 0x0000000013ead7b0 : 0x000007fd9a400000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x0000000013ead7b0 : 0x000007fd9a400000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x0000000013ead7f0 : 0x000007fd9a45d609 : ntdll!RtlUserThreadStart+0x1d
0x0000000013ead8b8 : 0x000007fd9a404bba : ntdll!KiUserExceptionDispatch+0x2e
0x0000000013ead8d0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013ead950 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013ead958 : 0x0000000013eadfd0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013ead980 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013ead9b8 : 0x000007fd8551a7fc : verifier!VerifierStopMessageEx+0x6d0
0x0000000013eada60 : 0x000007fd9a400000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x0000000013eadbc8 : 0x000007fd9a44e511 : ntdll!vsnprintf+0x11
0x0000000013eadbd8 : 0x000007fd9a485722 : ntdll!vsnprintf_l+0x98
0x0000000013eadbe8 : 0x000007fd9a44e767 : ntdll!write_string+0x48
0x0000000013eadbf0 : 0x0000000013eadfe8 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013eadc08 : 0x000007fd9a4c93bc : ntdll!RtlStringVPrintfWorkerA+0x20
0x0000000013eadc18 : 0x0000000013eadc60 : !da ""..=======================================.VERIFIER STOP 0000000000000303: pid 0x...""
0x0000000013eadc38 : 0x000007fd9a41ad81 : ntdll!vDbgPrintExWithPrefixInternal+0x89
0x0000000013eadc60 : 0x3d3d3d3d3d3d0a0a : !da ""..=======================================.VERIFIER STOP 0000000000000303: pid 0x...""
0x0000000013eadc68 : 0x3d3d3d3d3d3d3d3d : !da ""=================================.VERIFIER STOP 0000000000000303: pid 0x1D0: NUL...""
0x0000000013eadc70 : 0x3d3d3d3d3d3d3d3d : !da ""=========================.VERIFIER STOP 0000000000000303: pid 0x1D0: NULL handle...""
0x0000000013eadc78 : 0x3d3d3d3d3d3d3d3d : !da ""=================.VERIFIER STOP 0000000000000303: pid 0x1D0: NULL handle passed ...""
0x0000000013eadc80 : 0x3d3d3d3d3d3d3d3d : !da ""=========.VERIFIER STOP 0000000000000303: pid 0x1D0: NULL handle passed as param...""
0x0000000013eadc88 : 0x4946495245560a3d : !da ""=.VERIFIER STOP 0000000000000303: pid 0x1D0: NULL handle passed as parameter. A ...""
0x0000000013eadc90 : 0x20504f5453205245 : !da ""ER STOP 0000000000000303: pid 0x1D0: NULL handle passed as parameter. A valid ha...""
0x0000000013eadc98 : 0x3030303030303030 : !da ""0000000000000303: pid 0x1D0: NULL handle passed as parameter. A valid handle mus...""
0x0000000013eadca0 : 0x3330333030303030 : !da ""00000303: pid 0x1D0: NULL handle passed as parameter. A valid handle must be use...""
0x0000000013eadca8 : 0x783020646970203a : !da "": pid 0x1D0: NULL handle passed as parameter. A valid handle must be used. ...00...""
0x0000000013eadcb0 : 0x4c554e203a304431 : !da ""1D0: NULL handle passed as parameter. A valid handle must be used. ...0000000000...""
0x0000000013eadcb8 : 0x656c646e6168204c : !da ""L handle passed as parameter. A valid handle must be used. ...0000000000000000 :...""
0x0000000013eadcc0 : 0x2064657373617020 : !da "" passed as parameter. A valid handle must be used. ...0000000000000000 : Not use...""
0x0000000013eadcc8 : 0x6d61726170207361 : !da ""as parameter. A valid handle must be used. ...0000000000000000 : Not used...0000...""
0x0000000013eadcd0 : 0x2041202e72657465 : !da ""eter. A valid handle must be used. ...0000000000000000 : Not used...000000000000...""
0x0000000013eadcd8 : 0x61682064696c6176 : !da ""valid handle must be used. ...0000000000000000 : Not used...0000000000000000 : N...""
0x0000000013eadce0 : 0x73756d20656c646e : !da ""ndle must be used. ...0000000000000000 : Not used...0000000000000000 : Not used....""
0x0000000013eadce8 : 0x6573752065622074 : !da ""t be used. ...0000000000000000 : Not used...0000000000000000 : Not used...000000...""
0x0000000013eadcf0 : 0x3030090a0a202e64 : !da ""d. ...0000000000000000 : Not used...0000000000000000 : Not used...00000000000000...""
0x0000000013eadcf8 : 0x3030303030303030 : !da ""00000000000000 : Not used...0000000000000000 : Not used...0000000000000000 : Not...""
0x0000000013eadd00 : 0x3a20303030303030 : !da ""000000 : Not used...0000000000000000 : Not used...0000000000000000 : Not used......""
0x0000000013eadd08 : 0x65737520746f4e20 : !da "" Not used...0000000000000000 : Not used...0000000000000000 : Not used...00000000...""
0x0000000013eadd10 : 0x30303030090a2e64 : !da ""d...0000000000000000 : Not used...0000000000000000 : Not used...0000000000000000...""
0x0000000013eadd18 : 0x3030303030303030 : !da ""000000000000 : Not used...0000000000000000 : Not used...0000000000000000 : Not u...""
0x0000000013eadd20 : 0x4e203a2030303030 : !da ""0000 : Not used...0000000000000000 : Not used...0000000000000000 : Not used....=...""
0x0000000013eadd28 : 0x2e6465737520746f : !da ""ot used...0000000000000000 : Not used...0000000000000000 : Not used....=""
0x0000000013eadd30 : 0x303030303030090a : !da ""..0000000000000000 : Not used...0000000000000000 : Not used....=""
0x0000000013eadd38 : 0x3030303030303030 : !da ""0000000000 : Not used...0000000000000000 : Not used....=""
0x0000000013eadd40 : 0x746f4e203a203030 : !da ""00 : Not used...0000000000000000 : Not used....=""
0x0000000013eadd48 : 0x090a2e6465737520 : !da "" used...0000000000000000 : Not used....=""
0x0000000013eadd50 : 0x3030303030303030 : !da ""0000000000000000 : Not used....=""
0x0000000013eadd58 : 0x3030303030303030 : !da ""00000000 : Not used....=""
0x0000000013eadd60 : 0x7520746f4e203a20 : !da "" : Not used....=""
0x0000000013eadd68 : 0x3d0a0a0a2e646573 : !da "sed....="
0x0000000013eadda8 : 0x6e6f632073692070 : !da ""p is con""
0x0000000013eaddc0 : 0x000007fd8551a7fc : verifier!VerifierStopMessageEx+0x6d0
0x0000000013eade48 : 0x6573752074692067 : !da ""g it use""
0x0000000013eade50 : 0x000007fd8551a7fc : verifier!VerifierStopMessageEx+0x6d0
0x0000000013eade68 : 0x0000000013eadfd0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadec8 : 0x0000000013eadc60 : !da ""..=======================================.VERIFIER STOP 0000000000000303: pid 0x...""
0x0000000013eaded8 : 0x000007fd9a44e57f : ntdll!vsnprintf_l+0x75
0x0000000013eadf08 : 0x000007fd8553a940 : verifier!VfProviderHandlesLayerDescriptor
0x0000000013eadf10 : 0x000007fd8555568d : verifier!VrfDbgOutputBuffer+0x1ad
0x0000000013eadf20 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013eadf30 : 0x000007fd8554fb78 : verifier!AVrfpLogEntryMessageEx+0x258
0x0000000013eadf48 : 0x000007fd9a44e511 : ntdll!vsnprintf+0x11
0x0000000013eadf78 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadf88 : 0x000007fd9a4407a4 : ntdll!DbgPrintEx+0x30
0x0000000013eadf90 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadfb0 : 0x0000000013eadfe8 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013eadfc0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadfc8 : 0x000007fd8551a7e7 : verifier!VerifierStopMessageEx+0x6bb
0x0000000013eadfd0 : 0x000007fd8554efe8 : verifier!VfProviderHandlesBreakDescriptors+0x198
0x0000000013eadfe8 : 0x000007fd855554e0 : verifier!VrfDbgOutputBuffer
0x0000000013eadff8 : 0x0000000004153df0 : !du ""NULL handle passed as parameter. A valid handle must be used.""
0x0000000013eae008 : 0x0000000004153ee0 : !du ""Not used.""
0x0000000013eae018 : 0x0000000004153f70 : !du ""Not used.""
0x0000000013eae028 : 0x0000000004154010 : !du ""Not used.""
0x0000000013eae038 : 0x00000000041540a0 : !du ""Not used.""
0x0000000013eae040 : 0x000007fd8554fb78 : verifier!AVrfpLogEntryMessageEx+0x258
0x0000000013eae048 : 0x0000000004183820 : !du ""This verifier stop is continuable..After debugging it use `go' to continue..""
0x0000000013eae098 : 0x0000000004183820 : !du ""This verifier stop is continuable..After debugging it use `go' to continue..""
0x0000000013eae0a0 : 0x000007fd8555568d : verifier!VrfDbgOutputBuffer+0x1ad
0x0000000013eae0b8 : 0x000007fd8554fb78 : verifier!AVrfpLogEntryMessageEx+0x258
0x0000000013eae100 : 0x000007fd8553205c : verifier!AVrfpHeapFree+0xf4
0x0000000013eae118 : 0x000007fd85515f90 : verifier!AVrfSetHeapPathCaller+0xc
0x0000000013eae138 : 0x000007fd9a4054c0 : ntdll!RtlFreeHeap
0x0000000013eae148 : 0x000007fd855305fc : verifier!AVrfpLeaveHeapCall+0x14
0x0000000013eae150 : 0x000007fd994e1330 : kernel32!HeapFreeStub
0x0000000013eae168 : 0x000007fd9a4eddee : ntdll!RtlpValidateHeap+0x32
0x0000000013eae1a8 : 0x000007fd855261fc : verifier!AVrfpIncrementOwnedCriticalSections+0x30
0x0000000013eae1b8 : 0x000007fd85525394 : verifier!AVrfpVerifyInitializedCriticalSection+0xfc
0x0000000013eae1f8 : 0x000007fd9a4ef051 : ntdll!RtlDebugSizeHeap+0x119
0x0000000013eae228 : 0x000007fd8552c6e6 : verifier!AVrfpSRWLockFreeMemoryChecks+0x16a
0x0000000013eae280 : 0x0000000013eae298 : 0x000007fd8551873d : verifier!AVrfDebugPageHeapSize+0x89
0x0000000013eae298 : 0x000007fd8551873d : verifier!AVrfDebugPageHeapSize+0x89
0x0000000013eae2a8 : 0x0000000002048ba8 : 0x000007fd985405f4 : shell32!CUserFilesDescriptionEnum::Next+0x3c
0x0000000013eae2c8 : 0x000007fd9a43e915 : ntdll!RtlWalkFrameChain+0x29
0x0000000013eae2f8 : 0x000007fd9a43e8a8 : ntdll!RtlCaptureStackBackTrace+0x44
0x0000000013eae340 : 0x000007fd9a402cc0 : ntdll!NtSetEvent
0x0000000013eae348 : 0x000007fd855339ce : verifier!AVrfpHandleSanityChecks+0x3a
0x0000000013eae350 : 0x000007fd9a4054c0 : ntdll!RtlFreeHeap
0x0000000013eae398 : 0x000007fd85533d58 : verifier!AVrfpNtSetEvent+0x34
0x0000000013eae3b0 : 0x000007fd99d41172 : combase!CoTaskMemFree+0x36
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ShellStreams64.dll -
0x0000000013eae3c8 : 0x000007fd9749152c : KERNELBASE!SetEvent+0xc
0x0000000013eae3e8 : 0x000007fd9a4054c0 : ntdll!RtlFreeHeap
0x0000000013eae3f8 : 0x0000000180013241 : ShellStreams64!DllCanUnloadNow+0x541
Loaded symbol image file: ShellStreams64.dll
Image path: C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
Image name: ShellStreams64.dll
Browse all global symbols functions data
Timestamp: Tue Dec 18 01:38:54 2012
Thanks for the help!this Apple DLL crashes your Explorer: ShellStreams64.dll
hi andre, i found this .dmp file in C:\local dump files https://skydrive.live.com/#cid=A5E572BF5C5325A5&id=A5E572BF5C5325A5%21103
ok, I got the dump. Looks like the OverlayIcons from the MS SkyDrive app causes it. use ShellExView to disable the sync icons.
APPLICATION_VERIFIER_LOCKS_LOCK_IN_FREED_HEAP (202) Freeing heap block containing an active critical section. This stop is generated if a heap allocation contains a critical section, the allocation is freed and the critical section has not been deleted. To debug this stop use the following debugger commands: $ !cs -s parameter1 - dump information about this critical section. $ ln parameter1 - to show symbols near the address of the critical section. This should help identify the leaked critical section. $ dps parameter2 - to dump the stack trace for this critical section initialization. $ parameter3 and parameter4 might help understand where this heap block was allocated (the size of the allocation is probably significant). Arguments: Arg1: 07c4a724, Critical section address. Run !cs -s <address> to get more information. Arg2: 008365b4, Critical section initialization stack trace. Run dps <address> to dump the stack trace. Arg3: 07c4a6f0, Heap block address. Arg4: 0000004c, Heap block size. *** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for GROOVEEX.DLL - FAULTING_IP: verifier!VerifierStopMessageEx+701 7401c121 cc int 3 EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 7401c121 (verifier!VerifierStopMessageEx+0x00000701) ExceptionCode: 80000003 (Break instruction exception) ExceptionFlags: 00000000 NumberParameters: 3 Parameter[0]: 00000000 Parameter[1]: 86641d40 Parameter[2]: 0500b670 CONTEXT: 00000000 -- (.cxr 0x0;r) eax=00000000 ebx=04fc0000 ecx=00000400 edx=00000000 esi=00000000 edi=00000000 eip=77ce6954 esp=09b1e5ac ebp=09b1e658 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 ntdll!KiFastSystemCallRet: 77ce6954 c3 ret DEFAULT_BUCKET_ID: STATUS_BREAKPOINT PROCESS_NAME: explorer.exe CRITICAL_SECTION: 07c4a724 -- (!cs -s 07c4a724) ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht. EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig. EXCEPTION_PARAMETER1: 00000000 EXCEPTION_PARAMETER2: 86641d40 EXCEPTION_PARAMETER3: 0500b670 NTGLOBALFLAG: 2000100 APPLICATION_VERIFIER_FLAGS: 48004 APP: explorer.exe ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre FAULTING_THREAD: 00001504 PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT LAST_CONTROL_TRANSFER: from 74026598 to 7401c121 STACK_TEXT: 09b1ecec 74026598 74035488 00000202 07c4a724 verifier!VerifierStopMessageEx+0x701 09b1ed18 74024531 00000000 0000004c 00000000 verifier!AVrfpFreeMemLockChecks+0xc5 09b1ed38 7402ef52 00000000 0000004c 00000000 verifier!AVrfpFreeMemNotify+0x2a 09b1ed50 77dafffa 07c4a6f0 0000004c 07950000 verifier!AVrfpNtdllHeapFreeCallback+0x15 09b1ed70 740186ee 07c4a6f0 0000004c 07c40000 ntdll!AVrfInternalHeapFreeNotification+0x4a 09b1ed9c 77d66c8e 07950000 77d2c0fa 74044600 verifier!AVrfDebugPageHeapDestroy+0x16e 09b1edb0 7402f026 07950000 00000000 00000000 ntdll!RtlDestroyHeap+0x74 09b1edc4 753e2c7c 07950000 09b1ee08 6a17cd87 verifier!AVrfpRtlDestroyHeap+0x33 09b1edd0 6a17cd87 07950000 6a17a985 478c855a KERNELBASE!HeapDestroy+0xe WARNING: Stack unwind information not available. Following frames may be wrong. 09b1ee08 6a17aacc 6a160000 00000000 00000000 MediaIconsOverlays!DllUnregisterServer+0x8f26 09b1ee48 6a17ab37 6a160000 09b1eea8 740252f1 MediaIconsOverlays!DllUnregisterServer+0x6c6b 09b1ee54 740252f1 6a160000 00000000 00000000 MediaIconsOverlays!DllUnregisterServer+0x6cd6 09b1eea8 77ceed9a 6a160000 00000000 00000000 verifier!AVrfpStandardDllEntryPointRoutine+0x9f 09b1eec8 77ceee10 74025252 6a160000 00000000 ntdll!LdrxCallInitRoutine+0x16 09b1ef10 77d2b996 74025252 6a160000 00000000 ntdll!LdrpCallInitRoutine+0x63 09b1ef7c 77d2b746 08181798 081f7750 08181798 ntdll!LdrpProcessDetachNode+0x10f 09b1efb8 77cf56e1 08181798 573b2e4f 081f7750 ntdll!LdrpUnloadNode+0x51 09b1eff0 77cf1b15 01181798 573b3187 77cf19c1 ntdll!LdrpDecrementNodeLoadCount+0x17d 09b1f038 7402573f 6a160000 09b1f638 06f254a2 ntdll!LdrUnloadDll+0x12b 09b1f04c 753dce33 6a160000 00000001 09b1f068 verifier!AVrfpLdrUnloadDll+0x61 09b1f05c 75711fae 6a160000 09b1f07c 75712013 KERNELBASE!FreeLibrary+0x15 09b1f068 75712013 00000006 6a160000 00000000 combase!FreeLibraryWithLogging+0x21 09b1f07c 756df730 09b1f458 756c42f0 00000000 combase!CClassCache::CDllPathEntry::CFinishObject::Finish+0x28 09b1f650 756de8e1 55823919 00000001 09b1f6d8 combase!CClassCache::CleanUpDllsForApartment+0x2a0 09b1f6a8 756de6c6 09b1f718 74026927 00000000 combase!FinishShutdown+0x13b 09b1f6e4 756df08d 00000000 070bff88 00000000 combase!ApartmentUninitialize+0xb4 09b1f6fc 756d96ff 00000000 01906f1c 0817e468 combase!wCoUninitialize+0x163 09b1f724 7402a1e7 09b1f738 76646454 04db72e0 combase!CoUninitialize+0x9d 09b1f72c 76646454 04db72e0 09b1f748 760e3678 verifier!AVrfpCoUninitialize+0x17 09b1f738 760e3678 0817e468 081c3d48 09b1f888 shell32!CShellTaskThread::s_ThreadProc+0x30 09b1f748 77d28ab2 04db72e0 573b3937 0188be10 SHCore!ExecuteWorkItemThreadProc+0x10 09b1f888 77cea35e 09b1f8d8 081c3d48 573b3ba7 ntdll!RtlpTpWorkCallback+0x27f 09b1fa18 75ed173e 0188be10 09b1fa68 77d068f1 ntdll!TppWorkerThread+0x538 09b1fa24 77d068f1 0188be10 573b3bd7 00000000 kernel32!BaseThreadInitThunk+0xe 09b1fa68 77d0689d ffffffff 77d95ae2 00000000 ntdll!__RtlUserThreadStart+0x4a 09b1fa78 00000000 77d0704d 0188be10 00000000 ntdll!_RtlUserThreadStart+0x1c FOLLOWUP_IP: MediaIconsOverlays!DllUnregisterServer+8f26 6a17cd87 83253840196a00 and dword ptr [MediaIconsOverlays!DllUnregisterServer+0x201d7 (6a194038)],0 SYMBOL_STACK_INDEX: 9 SYMBOL_NAME: mediaiconsoverlays!DllUnregisterServer+8f26 FOLLOWUP_NAME: MachineOwner MODULE_NAME: MediaIconsOverlays IMAGE_NAME: MediaIconsOverlays.dll DEBUG_FLR_IMAGE_TIMESTAMP: 5180006a STACK_COMMAND: ~35s; .ecxr ; kb FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_MediaIconsOverlays.dll!DllUnregisterServer BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_mediaiconsoverlays!DllUnregisterServer+8f26 ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_mediaiconsoverlays.dll!dllunregisterserver FAILURE_ID_HASH: {5c7ce48a-f647-b9dc-5aab-cb3d581bdccf} Followup: MachineOwner --------- 0:035> lmvm MediaIconsOverlays start end module name 6a160000 6a19b000 MediaIconsOverlays (export symbols) MediaIconsOverlays.dll Loaded symbol image file: MediaIconsOverlays.dll Image path: C:\ProgramData\Microsoft\Media Tools\MediaIconsOverlays.dll Image name: MediaIconsOverlays.dll Timestamp: Tue Apr 30 19:33:30 2013 (5180006A) CheckSum: 000411AD ImageSize: 0003B000 File version: 1.0.0.1 Product version: 1.0.0.1 File flags: 0 (Mask 3F) File OS: 4 Unknown Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04e4 CompanyName: Microsoft ProductName: Online files icon's overlay ProductVersion: 1.0.2.3 FileVersion: 1.0.2.5 FileDescription: Online files icon's overlay LegalCopyright: Microsoft LegalTrademarks: Microsoft Comments: Online files icon's overlay
upload the new dumps
i uninstalled skydrive but the problem still exist....
i dont know which .dmp file to choose because every minute its crashing
this is in my event viewer
Faulting application name: explorer.exe, version: 6.2.9200.16433, time stamp: 0x50763130run the uninstal.reg:
to stop the dump creation.
Now zip the latest 4-5 dumps and upload the zip.
is there any way to makethe zip smaller files because each dump is 200 mb and above
i dont know which .dmp file to choose because every minute its crashing
this is in my event viewer
Faulting application name: explorer.exe, version: 6.2.9200.16433, time stamp: 0x50763130I am having the exact same problem. I added the dump creator registry edit, and this by itself (!?) made the problem even worse, for no sooner Explorer would start than it would crash again! I uninstalled the dump creator and zipped the last five .dmp files into a single zip file, which you can access at
https://skydrive.live.com/redir?resid=1F5A053A208BFF69!728&authkey=!AEowqWxKPSdllcY
Thank you very much in advance for your help!
I uninstalled the dump creator and zipped the last five .dmp files into a single zip file, which you can access at
https://skydrive.live.com/redir?resid=1F5A053A208BFF69!728&authkey=!AEowqWxKPSdllcY
Thank you very much in advance for your help!
the 3D Shellextension from nVIDIA causes the crashes:
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
APPLICATION_VERIFIER_LOCKS_LOCK_IN_UNLOADED_DLL (201)
Unloading DLL containing an active critical section.
This stop is generated if a DLL has a global variable containing a critical section
and the DLL is unloaded but the critical section has not been deleted. To debug
this stop use the following debugger commands:
$ du parameter3 - to dump the name of the culprit DLL.
$ .reload dllname or .reload dllname = parameter4 - to reload the symbols for that DLL.
$ !cs -s parameter1 - dump information about this critical section.
$ ln parameter1 - to show symbols near the address of the critical section.
This should help identify the leaked critical section.
$ dps parameter2 - to dump the stack trace for this critical section initialization.
Arguments:
Arg1: 000007fc3a8c4db0, Critical section address. Run !cs -s <address> to get more information.
Arg2: 0000000000d73f30, Critical section initialization stack trace. Run dps <address> to dump the stack trace.
Arg3: 00000000176fd8f8, DLL name address.
Arg4: 000007fc3a7d0000, DLL base address.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fc4301a7fc (verifier!VerifierStopMessageEx+0x00000000000006d0)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 1
Parameter[0]: 0000000000000000
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT
PROCESS_NAME: explorer.exe
CRITICAL_SECTION: 000007fc3a8c4db0 -- (!cs -s 000007fc3a8c4db0)
IMAGE_NAME: nv3dappshext.dll
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 0000000000000000
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
FAULTING_THREAD: ffffffffffffffff
PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT
BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT
STACK_TEXT:
00000000`00000000 00000000`00000000 nv3dappshext.dll!Unknown+0x0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nv3dappshext.dll!Unknown
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nv3dappshext
DEBUG_FLR_IMAGE_TIMESTAMP: 51c41b68
STACK_COMMAND: ** Pseudo Context ** ; kb
BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_nv3dappshext.dll!Unknown
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_nv3dappshext.dll!unknown
FAILURE_ID_HASH: {3725e68e-35d6-912a-5613-c20eefdd7ebf}
Followup: MachineOwner
---------
0:059> !cs -s 000007fc3a8c4db0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for nv3dappshext.dll -
-----------------------------------------
Critical section = 0x000007fc3a8c4db0 (nv3dappshext!DllInstall+0xE9354)
DebugInfo = 0x00000000176f30f0
NOT LOCKED
LockSemaphore = 0x0
SpinCount = 0x00000000020007d0
Stack trace for DebugInfo = 0x00000000176f30f0:
0x000007fc535715d0: ntdll!RtlInitializeCriticalSectionAndSpinCount+0xEFBC0
0x000007fc43025be5: verifier!AVrfpInitializeCriticalSectionCommon+0x115
0x000007fc3a7e032c: nv3dappshext!DllInstall+0x48D0
0x000007fc3a7e0653: nv3dappshext!DllInstall+0x4BF7
0x000007fc3a7e02ce: nv3dappshext!DllInstall+0x4872
0x000007fc3a7df927: nv3dappshext!DllInstall+0x3ECB
0x000007fc3a7defb6: nv3dappshext!DllInstall+0x355A
0x000007fc516e9077: shell32!IShellExtInit_Initialize+0x47
0x000007fc516eb3ed: shell32!HDXA_QueryContextMenu+0x2DD
0x000007fc516ea56f: shell32!CDefFolderMenu::QueryContextMenu+0x41B
0x000007fc50867531: shlwapi!SHInvokeCommandOnContextMenu2+0xE5
0x000007fc5087a639: shlwapi!SHInvokeCommandWithFlagsAndSite+0xA9
0x000007f71443936a: explorer!LaunchNewInstanceWithOptionalElevate+0xE6
0x000007f71446bbb3: explorer!CTaskBand::CLauncherTask::_Launch+0x137
0x000007f71446bc37: explorer!CTaskBand::CLauncherTask::_ThreadProc+0x17
0x000007f71446eee6: explorer!CTaskBand::CLauncherTask::s_ThreadProc+0xE
0x000007fc4f3840bc: SHCore!COplockFileHandle::v_GetHandlerCLSID+0x12C
0x000007fc4303653d: verifier!AVrfpStandardThreadFunction+0x3D
0x000007fc51331832: kernel32!BaseThreadInitThunk+0x1A
0x000007fc534cd609: ntdll!RtlUserThreadStart+0x1D
0:059> dps 0000000000d73f30
00000000`00d73f30 00000000`00b07680
00000000`00d73f38 00140d55`00009801
00000000`00d73f40 000007fc`535715d0 ntdll!RtlInitializeCriticalSectionAndSpinCount+0xefbc0
00000000`00d73f48 000007fc`43025be5 verifier!AVrfpInitializeCriticalSectionCommon+0x115
00000000`00d73f50 000007fc`3a7e032c nv3dappshext!DllInstall+0x48d0
00000000`00d73f58 000007fc`3a7e0653 nv3dappshext!DllInstall+0x4bf7
00000000`00d73f60 000007fc`3a7e02ce nv3dappshext!DllInstall+0x4872
00000000`00d73f68 000007fc`3a7df927 nv3dappshext!DllInstall+0x3ecb
00000000`00d73f70 000007fc`3a7defb6 nv3dappshext!DllInstall+0x355a
00000000`00d73f78 000007fc`516e9077 shell32!IShellExtInit_Initialize+0x47
00000000`00d73f80 000007fc`516eb3ed shell32!HDXA_QueryContextMenu+0x2dd
00000000`00d73f88 000007fc`516ea56f shell32!CDefFolderMenu::QueryContextMenu+0x41b
00000000`00d73f90 000007fc`50867531 shlwapi!SHInvokeCommandOnContextMenu2+0xe5
00000000`00d73f98 000007fc`5087a639 shlwapi!SHInvokeCommandWithFlagsAndSite+0xa9
00000000`00d73fa0 000007f7`1443936a explorer!LaunchNewInstanceWithOptionalElevate+0xe6
00000000`00d73fa8 000007f7`1446bbb3 explorer!CTaskBand::CLauncherTask::_Launch+0x137
0:059> lmvm nv3dappshext
start end module name
000007fc`3a7d0000 000007fc`3a8df000 nv3dappshext (export symbols) nv3dappshext.dll
Loaded symbol image file: nv3dappshext.dll
Image path: C:\Windows\System32\nv3dappshext.dll
Image name: nv3dappshext.dll
Timestamp: Fri Jun 21 11:22:48 2013 (51C41B68)
CheckSum: 0010733B
ImageSize: 0010F000
File version: 8.17.13.2049
Product version: 8.17.13.2049
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04e4
CompanyName: NVIDIA Corporation
ProductName: NVIDIA Shell Extensions
InternalName: Nv3DAppShExt.dll
OriginalFilename: Nv3DAppShExt.dll
ProductVersion: 8.17.13.2049
FileVersion: 8.17.13.2049
FileDescription: NVIDIA Shell Extensions
LegalCopyright: (C) 2013 NVIDIA Corporation. All rights reserved.
this time you get a crash causes by Google Drive. This is a known issue. Disable the sync icons in the Google drive options, this fixes the issue.
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for googledrivesync64.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for inffv1.dll -
FAULTING_IP:
ntdll!RtlReportCriticalFailure+89
000007fd`3951bd59 eb00 jmp ntdll!RtlReportCriticalFailure+0x8b (000007fd`3951bd5b)
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fd3951bd59 (ntdll!RtlReportCriticalFailure+0x0000000000000089)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000007fd395705f0
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=0000000003b10000 rbx=0000000000000000 rcx=0000000003b10000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000003aa0000
rip=000007fd39432c2a rsp=00000000048dd8f8 rbp=00000000048de4a0
r8=0000000000000000 r9=0000000000000040 r10=0000000000000000
r11=0000000000000286 r12=0000000000000000 r13=0000000000000000
r14=0000000003aa0000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!NtWaitForSingleObject+0xa:
000007fd`39432c2a c3 ret
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_PARAMETER1: 000007fd395705f0
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
LAST_CONTROL_TRANSFER: from 000007fd39520b74 to 000007fd3951bd59
FAULTING_THREAD: ffffffffffffffff
BUGCHECK_STR: APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy
PRIMARY_PROBLEM_CLASS: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy
DEFAULT_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy
STACK_TEXT:
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
ntdll!RtlReportCriticalFailure$filt$0
ntdll!_C_specific_handler
ntdll!_GSHandlerCheck_SEH
ntdll!RtlpExecuteHandlerForException
ntdll!RtlDispatchException
ntdll!RtlRaiseException
ntdll!RtlReportCriticalFailure
ntdll!RtlpLogHeapFailure
ntdll!RtlFreeHeap
msvcr90!free
googledrivesync64!DllCanUnloadNow
shell32!CFSIconOverlayManager::_GetFileOverlayInfo
shell32!CFSIconOverlayManager::GetFileOverlayInfo
shell32!CFSFolder::_GetOverlayInfo
shell32!CIconOverlayTask::InternalResumeRT
shell32!CRunnableTask::Run
shell32!CShellTask::TT_Run
shell32!CShellTaskThread::ThreadProc
shell32!CShellTaskThread::s_ThreadProc
SHCore!ExecuteWorkItemThreadProc
ntdll!RtlpTpWorkCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
FAILURE_ID_HASH_STRING: um:actionable_heap_corruption_heap_failure_block_not_busy_c0000374_googledrivesync64.dll!dllcanunloadnow
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Timestamp: Fri Jun 07 08:55:22 2013 (51B183DA)
CheckSum: 000CAC91
ImageSize: 000C0000
File version: 1.10.4769.632
Product version: 1.10.4769.632
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Google
ProductName: Google Drive
ProductVersion: 1.10.4769.0632
FileVersion: 1.10.4769.0632
FileDescription: Google Drive shell extension
LegalCopyright: Google
I have been reading this forum trying to find why my explorer is crashing. I followed the directions and have zipped three dump files. I would really appreciate it if you could tell me what is causing it to crash. The url is:
https://skydrive.live.com/#cid=1E42D14E22003BBC&id=1E42D14E22003BBC%21130
Thanks for your help....
I have been reading this forum trying to find why my explorer is crashing. I followed the directions and have zipped three dump files. I would really appreciate it if you could tell me what is causing it to crash.
for you google Drive is also the cause. Disable the sync icons:
0:060> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for googledrivesync64.dll -
*** WARNING: Unable to verify checksum for mscorlib.ni.dll
Cannot find frame 0xf, previous scope unchanged
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
FAULTING_IP:
ntdll!RtlReportCriticalFailure+89
000007fc`7b7dbd59 eb00 jmp ntdll!RtlReportCriticalFailure+0x8b (000007fc`7b7dbd5b)
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 000007fc7b7dbd59 (ntdll!RtlReportCriticalFailure+0x0000000000000089)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000007fc7b8305f0
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - Ein Heap wurde besch digt.
EXCEPTION_PARAMETER1: 000007fc7b8305f0
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0x7dc (60)
Current frame:
Child-SP RetAddr Caller, Callee
PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS
BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS
LAST_CONTROL_TRANSFER: from 000007fc7b7e0b74 to 000007fc7b7dbd59
STACK_TEXT:
ntdll!RtlReportExceptionEx
ntdll!RtlReportException
ntdll!RtlReportCriticalFailure$filt$0
ntdll!_C_specific_handler
ntdll!_GSHandlerCheck_SEH
ntdll!RtlpExecuteHandlerForException
ntdll!RtlDispatchException
ntdll!RtlRaiseException
ntdll!RtlReportCriticalFailure
ntdll!RtlpLogHeapFailure
ntdll!RtlFreeHeap
msvcr90!free
googledrivesync64!DllCanUnloadNow
shell32!CFSIconOverlayManager::_GetFileOverlayInfo
shell32!CFSIconOverlayManager::GetFileOverlayInfo
shell32!CFSFolder::_GetOverlayInfo
SearchFolder!CDBFolder::GetOverlayIndex
shell32!CLibraryFolder::GetOverlayIndex
shell32!CIconOverlayTask::InternalResumeRT
shell32!CRunnableTask::Run
shell32!CShellTask::TT_Run
shell32!CShellTaskThread::ThreadProc
shell32!CShellTaskThread::s_ThreadProc
SHCore!ExecuteWorkItemThreadProc
ntdll!RtlpTpWorkCallback
ntdll!TppWorkerThread
kernel32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
FOLLOWUP_IP:
googledrivesync64!DllCanUnloadNow+dc0
000007fc`695c30e0 488d542430 lea rdx,[rsp+30h]
IMAGE_NAME: googledrivesync64.dll
FAILURE_BUCKET_ID: WRONG_SYMBOLS_c0000374_googledrivesync64.dll!DllCanUnloadNow
BUCKET_ID: APPLICATION_FAULT_WRONG_SYMBOLS_googledrivesync64!DllCanUnloadNow+dc0
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/6_2_9200_16628/51a94434/ntdll_dll/6_2_9200_16579/51637f77/c0000374/000ebd59.htm?Retriage=1
Loaded symbol image file: googledrivesync64.dll
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Timestamp: Fri Jun 07 08:55:22 2013 (51B183DA)
CheckSum: 000CAC91
ImageSize: 000C0000
File version: 1.10.4769.632
Product version: 1.10.4769.632
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Google
ProductName: Google Drive
ProductVersion: 1.10.4769.0632
FileVersion: 1.10.4769.0632
FileDescription: Google Drive shell extension
LegalCopyright: Google
I'm having the same problem, I analyzed the dump, I had problem with the nvidia drive, the problem has changed, but now I do not know what to do to solve.
Follows the last dump
https://skydrive.live.com/redir?resid=C27B86A8E7E38C87!422&authkey=!ANsXQaa0vOAgeuM
Regards
I'm having the same problem, I analyzed the dump, I had problem with the nvidia drive, the problem has changed, but now I do not know what to do to solve.
Follows the last dumphttps://skydrive.live.com/redir?resid=C27B86A8E7E38C87!422&authkey=!ANsXQaa0vOAgeuM
Regards
it is again the nVIDIA DLL (nv3dappshext.dll). Use ShellExView to disable the ShellExtension:
http://www.nirsoft.net/utils/shexview.html
I encountered this problem when PC Google Drive was running in background.
There are 2 options to bypass this bug (see also in Google Drive Forum):
1. Remove the "System file" and "Hidden File" attributes from the desktop.ini file in "My documents" folder.Andre, I had difficulty creating the dump file ... does this link provide the appropriate info to diagnose the explorer crash problem.
https://www.dropbox.com/s/nszx360x8hm9ih9/explorer.7z
Thank you in advance
Andre, I had difficulty creating the dump file ... does this link provide the appropriate info to diagnose the explorer crash problem.
https://www.dropbox.com/s/nszx360x8hm9ih9/explorer.7z
Thank you in advance
Hi,
I'm having the same problem - explorer.exe crashing frequently. I hope Andre can help me nail the cause.
I'm using Windows 8 Pro, couldn't find a localdumps folder, but found several explorer.exe.dmp files in Crashdumps folder inside Local folder inside AppData. Is this the same as Localdumps?
Anyway, I zipped several of the most recent explorer dump files and posted them here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!440&authkey=!AB5n-s_bcHzGArc
Thanks in advance.
Jeremy Angel
Hi,
I'm having the same problem - explorer.exe crashing frequently. I hope Andre can help me nail the cause.
disable the sync icons of google drive:
STACK_TEXT:
000007fa`be6e0658 000007fa`be640f09 ntdll!RtlFreeHeap+0x87
000007fa`be6e0660 00000000`6213cabc msvcr90!free+0x1c
000007fa`be6e0668 000007fa`a7af30e0 googledrivesync64+0x30e0
000007fa`be6e0670 000007fa`bc35f44a shell32!CFSIconOverlayManager::_GetFileOverlayInfo+0xca
000007fa`be6e0678 000007fa`bc41e958 shell32!CFSIconOverlayManager::GetFileOverlayInfo+0x48
000007fa`be6e0680 000007fa`bc35fa17 shell32!CFSFolder::_GetOverlayInfo+0xdf
000007fa`be6e0688 000007fa`bc41e9d1 shell32!CRegFolder::_GetOverlayInfo+0xed
000007fa`be6e0690 000007fa`bc35f863 shell32!CRegFolder::GetOverlayIndex+0x47
000007fa`be6e0698 000007fa`ac531236 explorerframe!CNscOverlayTask::InternalResumeRT+0xa0
000007fa`be6e06a0 000007fa`ac50a6d4 explorerframe!CRunnableTask::Run+0x102
000007fa`be6e06a8 000007fa`bc28194c shell32!CShellTask::TT_Run+0x3c
000007fa`be6e06b0 000007fa`bc28154c shell32!CShellTaskThread::ThreadProc+0xd7
000007fa`be6e06b8 000007fa`bc281753 shell32!CShellTaskThread::s_ThreadProc+0x33
000007fa`be6e06c0 000007fa`b9de157f shcore!ExecuteWorkItemThreadProc+0xf
000007fa`be6e06c8 000007fa`be5b5639 ntdll!RtlpTpWorkCallback+0x189
000007fa`be6e06d0 000007fa`be5a8552 ntdll!TppWorkerThread+0x604
000007fa`be6e06d8 000007fa`bd6b1832 kernel32!BaseThreadInitThunk+0x1a
000007fa`be6e06e0 000007fa`be5fd609 ntdll!RtlUserThreadStart+0x1d
Image path: C:\Program Files (x86)\Google\Drive\googledrivesync64.dll
Image name: googledrivesync64.dll
Browse all global symbols functions data
Timestamp: Fri Jun 28 01:09:04 2013
I encountered this problem when PC Google Drive was running in background.
There are 2 options to bypass this bug (see also in Google Drive Forum)
I PREFER THE 2ND WAY:
1. Remove the "System file" and "Hidden File" attributes from the desktop.ini file in "My documents" folder.Thanks very muchnice to hear this :)
I've gone a whole day without an Explorer crash, so it appears to be working.
Hi,
I feel really bad coming here again to pester you people, but all of a sudden, I'm getting explorer crashes again. I tried various ways of reading the dmp files, but to no avail.
I've posted one here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!443
I would be extremely grateful for any pointers.
Hi,
I also have the same issue - explorer.exe crash frequently - and I hope Andre can help me to find what is the problem. I'm using a Dell Precision M4700 and Windows 8. Can you have a look to my dump please? Here my public skydrive where I have loaded the dump relative to one of the last crash:
https://skydrive.live.com/?cid=54cc7c49e531c33b&id=54CC7C49E531C33B%211991&authkey=!AMojerlEujdrW38
Thanks in advance.
Paolo Bozzoli
Hi,
I also have the same issue - explorer.exe crash frequently - and I hope Andre can help me to find what is the problem. I'm using a Dell Precision M4700 and Windows 8. Can you have a look to my dump please? Here my public skydrive where I have loaded the dump relative to one of the last crash:
https://skydrive.live.com/?cid=54cc7c49e531c33b&id=54CC7C49E531C33B%211991&authkey=!AMojerlEujdrW38
Thanks in advance.
Paolo B
Hi,
I also have the same issue - explorer.exe crash frequently - and I hope Andre can help me to find what is the problem. I'm using a Dell Precision M4700 and Windows 8. Can you have a look to my dump please? Here my public skydrive where I have loaded the dump relative to one of the last crash:
https://skydrive.live.com/?cid=54cc7c49e531c33b&id=54CC7C49E531C33B%211991&authkey=!AMojerlEujdrW38
Thanks in advance.
Paolo B
Hi,
I also have the same issue - explorer.exe crash frequently - and I hope Andre can help me to find what is the problem. I'm using a Dell Precision M4700 and Windows 8. Can you have a look to my dump please? Here my public skydrive where I have loaded the dump relative to one of the last crash:
https://skydrive.live.com/?cid=54cc7c49e531c33b&id=54CC7C49E531C33B%211991&authkey=!AMojerlEujdrW38
Thanks in advance.
Paolo B
Hi,
My plea for help appears to have been buried under Paolo's, so now that Andre (a saint in my eyes) appears to have nailed Paolo's problem, please allow me to draw attention to my problem once again.
I feel really bad coming here again to pester you people, but all of a sudden, I'm getting explorer crashes again. I tried various ways of reading the dmp files, but to no avail.
I've posted one here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!443
I would be extremely grateful for any pointers.
Hi,
My plea for help appears to have been buried under Paolo's, so now that Andre (a saint in my eyes) appears to have nailed Paolo's problem, please allow me to draw attention to my problem once again.
I feel really bad coming here again to pester you people, but all of a sudden, I'm getting explorer crashes again. I tried various ways of reading the dmp files, but to no avail.
I've posted one here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!443
I would be extremely grateful for any pointers.
Jeremy, my notes regarding FineReader were initially referred to you. I am sorry to Paolo and you for messing the dumps. The links to FineReader's shell extensions are in your dump indeed and surprisingly, there's a dozen of copies of various versions of its extensions:
0:052> lmvm frintegration.x64*
start end module name
Unloaded modules:
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.1.dll
Timestamp: Tue Nov 01 12:55:15 2011 (4EAFB3F3)
Checksum: 00006D35
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.14.dll
Timestamp: Tue Nov 01 12:55:32 2011 (4EAFB404)
Checksum: 0001265E
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.15.dll
Timestamp: Tue Nov 01 12:55:24 2011 (4EAFB3FC)
Checksum: 000064FA
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.16.dll
Timestamp: Tue Nov 01 12:55:24 2011 (4EAFB3FC)
Checksum: 000065BC
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.17.dll
Timestamp: Tue Nov 01 12:55:15 2011 (4EAFB3F3)
Checksum: 0000D82D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.2.dll
Timestamp: Tue Nov 01 12:55:22 2011 (4EAFB3FA)
Checksum: 00005243
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.20.dll
Timestamp: Tue Nov 01 12:55:32 2011 (4EAFB404)
Checksum: 0000B497
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.22.dll
Timestamp: Tue Nov 01 12:55:37 2011 (4EAFB409)
Checksum: 00012280
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.23.dll
Timestamp: Tue Nov 01 12:55:28 2011 (4EAFB400)
Checksum: 00004867
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.24.dll
Timestamp: Tue Nov 01 12:55:26 2011 (4EAFB3FE)
Checksum: 0000870D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.27.dll
Timestamp: Tue Nov 01 12:55:26 2011 (4EAFB3FE)
Checksum: 00010B38
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.3.dll
Timestamp: Tue Nov 01 12:55:19 2011 (4EAFB3F7)
Checksum: 0000960E
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.4.dll
Timestamp: Tue Nov 01 12:55:17 2011 (4EAFB3F5)
Checksum: 00009B26
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.5.dll
Timestamp: Tue Nov 01 12:55:19 2011 (4EAFB3F7)
Checksum: 000070D1
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.6.dll
Timestamp: Tue Nov 01 12:55:17 2011 (4EAFB3F5)
Checksum: 00003DDD
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.63.dll
Timestamp: Tue Nov 01 12:55:36 2011 (4EAFB408)
Checksum: 00011C0D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.64.dll
Timestamp: Tue Nov 01 12:55:22 2011 (4EAFB3FA)
Checksum: 00011546
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.65.dll
Timestamp: Tue Nov 01 12:55:28 2011 (4EAFB400)
Checksum: 0000F716
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.7.dll
Timestamp: Tue Nov 01 12:55:30 2011 (4EAFB402)
Checksum: 00010A74
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.8.dll
Timestamp: Tue Nov 01 12:55:30 2011 (4EAFB402)
Checksum: 00011490
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.9.dll
Timestamp: Tue Nov 01 12:55:34 2011 (4EAFB406)
Checksum: 0000690A
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.1.dll
Timestamp: Tue Nov 01 12:55:15 2011 (4EAFB3F3)
Checksum: 00006D35
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.14.dll
Timestamp: Tue Nov 01 12:55:32 2011 (4EAFB404)
Checksum: 0001265E
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.15.dll
Timestamp: Tue Nov 01 12:55:24 2011 (4EAFB3FC)
Checksum: 000064FA
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.16.dll
Timestamp: Tue Nov 01 12:55:24 2011 (4EAFB3FC)
Checksum: 000065BC
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.17.dll
Timestamp: Tue Nov 01 12:55:15 2011 (4EAFB3F3)
Checksum: 0000D82D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.2.dll
Timestamp: Tue Nov 01 12:55:22 2011 (4EAFB3FA)
Checksum: 00005243
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.20.dll
Timestamp: Tue Nov 01 12:55:32 2011 (4EAFB404)
Checksum: 0000B497
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.22.dll
Timestamp: Tue Nov 01 12:55:37 2011 (4EAFB409)
Checksum: 00012280
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.23.dll
Timestamp: Tue Nov 01 12:55:28 2011 (4EAFB400)
Checksum: 00004867
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.24.dll
Timestamp: Tue Nov 01 12:55:26 2011 (4EAFB3FE)
Checksum: 0000870D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.27.dll
Timestamp: Tue Nov 01 12:55:26 2011 (4EAFB3FE)
Checksum: 00010B38
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.3.dll
Timestamp: Tue Nov 01 12:55:19 2011 (4EAFB3F7)
Checksum: 0000960E
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.4.dll
Timestamp: Tue Nov 01 12:55:17 2011 (4EAFB3F5)
Checksum: 00009B26
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.5.dll
Timestamp: Tue Nov 01 12:55:19 2011 (4EAFB3F7)
Checksum: 000070D1
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.6.dll
Timestamp: Tue Nov 01 12:55:17 2011 (4EAFB3F5)
Checksum: 00003DDD
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.63.dll
Timestamp: Tue Nov 01 12:55:36 2011 (4EAFB408)
Checksum: 00011C0D
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.64.dll
Timestamp: Tue Nov 01 12:55:22 2011 (4EAFB3FA)
Checksum: 00011546
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.65.dll
Timestamp: Tue Nov 01 12:55:28 2011 (4EAFB400)
Checksum: 0000F716
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.7.dll
Timestamp: Tue Nov 01 12:55:30 2011 (4EAFB402)
Checksum: 00010A74
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.8.dll
Timestamp: Tue Nov 01 12:55:30 2011 (4EAFB402)
Checksum: 00011490
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.9.dll
Timestamp: Tue Nov 01 12:55:34 2011 (4EAFB406)
Checksum: 0000690A
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.26.dll
Timestamp: Tue Nov 01 12:55:35 2011 (4EAFB407)
Checksum: 00004DF6
ImageSize: 00006000
00000000`2f970000 00000000`2f976000 frintegration.x64.0.dll
Timestamp: Tue Nov 01 12:55:13 2011 (4EAFB3F1)
Checksum: 000092AB
ImageSize: 00006000
I would check with ShellExView by NirSoft for ABBYY's extension and disable it temporary.
Here's where it sits in your system:
0:052> lmvm FRIntegration_x64
start end module name
00000000`2f980000 00000000`2fa5f000 FRIntegration_x64 (deferred)
Image path: C:\Program Files (x86)\ABBYY FineReader 11\FRIntegration.x64.dll
Image name: FRIntegration.x64.dll
Timestamp: Sat Oct 29 05:51:56 2011 (4EAB5C3C)
CheckSum: 000E9130
ImageSize: 000DF000
File version: 11.0.102.536
Product version: 11.0.102.536
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
I would also recommend turning on full dumps, here is how. Andre has had a good page of its own with a list of registry files that enable/disable extended dumps using application verifier and driver verifier, but I've forgotten the link... Let's wait for
Thanks very much, EH. Yes, I do get FineReader error messages occasionally, but nothing perturbing enough to force me to take further action - or so I thought. I used ShellExView to disable FRIntegration_x64, and will monitor behavior. I'm afraid that while I was able to navigate to Localdumps folder using regedit, I couldn't figure how to turn on full dumps, despite the link you provided. I much appreciate your help.
If you still unhappy with manually changing registry settings, you can download the WER_Explorer_full.reg file from the Repository of registry settings to manage Windows diagnostic and configure Windows Error Reporting (WER).
When downloaded, just double-click the REG file and confirm adding settings from there. Registry settings will be imported to registry. Use WER_Explorer_full_uninstall.reg to remove settings and disable extended diagnostic.
yeah, that's my skydrive folder. The full creates full dumps with AppVerifier enabled. The other only minis without AppVerifier.
If you still unhappy with manually changing registry settings, you can download the WER_Explorer_full.reg file from the Repository of registry settings to manage Windows diagnostic and configure Windows Error Reporting (WER).
Thanks very much, EH, and to Andre for providing that resource.
I have done as instructed.
The reason I was having problems is that I couldn't find any explorer.exe folder among all the folders within LocalDumps when viewed using regedit on my computer. There is still no such folder, even after doing as told above. Moreover, all of the folders in LocalDumps give C:\ProgramData\Norton\LocalDumps, but the explorer dumps actually go to C:\Users\Jeremy\AppData\Local\CrashDumps. (I use Norton 360.)
When using regedit, should I be able to find an explorer.exe folder under Microsoft\Windows\Windows Error Reporting\LocalDumps\?
I suspect that I just don't know where to look or what I'm talking about, and I don't want to use up any more of your valuable time, but it's still something of a mystery to me.
Thanks, Andre. Worked like a charm, and so I now have full explorer.exe dumps enabled.
Much indebted.
Hi Andre,
Thanks for getting in touch.
I did in fact had 2 explorer crashes this morning, but having switched to full dumps, the dump files are HUGE. I followed your advice and used 7-zip to compress them individually (set at Ultra), but even then, one is 175 MB, the other 336 MB. Skydrive refused
to take the latter, but the former is here:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!446&authkey=!AAAr2yiIisIRq1U
I'm now facing a different problem. I don't know whether this has anything to do with installing 7-zip (which I did to upload the full dump above), but since then, I've been having frequent explorer crashes, and always when I right-click on a blank space in the rh pane of an explorer window (which makes explorer very difficult to use.) For example, I right click on a couple of attachments in an email in Outlook and press copy, then go to Explorer to paste them into the required folder, but the moment I right-click, explorer crashes.
Because I was having problems uploading full dumps, I used regedit to switch back to the (1) setting. Then I reproduced a number of the crashes by right-clicking in an explorer window. I don't know whether these dumps will be of any help, but I've uploaded them too:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!449&authkey=!ACrT4IWAAfy61j4
This is definitely an issue that I have to resolve urgently, so I look forward to your response (and those of anyone else able to help me) with bated breath!
Thanks in advance.
Andre,
Further to my post above, I switched back to full dumps to see if I could create a full dump of the latest explorer crashes (that occur when right-clicking in explorer) that would pass Skydrive's limits. It came to under 90 MB, and so was just about uploadable. Here it is:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!450&authkey=!AJW7B4Jr5g9kzwM
BTW, I tried compressing using LZMA2 at ultra level, but failed, getting an error message that the "system cannot allocate sufficient memory". So this and the previous 7z file uploaded to my skydrive were both compressed using LZMA an ultra level.
Anyway, I hope this second full dump helps you to nail the problem.
Again, thanks in advance.
BTW, I tried compressing using LZMA2 at ultra level, but failed, getting an error message that the "system cannot allocate sufficient memory".
LZMA2 / Ultra requires a lot of RAM. 7-zip tells you have much RAm you need, make sure you have enough free RAM.
You get the well known Intel driver crash:
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
0000000022cd4590 0008 0000 [00] 0000000022cd45e0 00004 - (busy)
7fe9c0f81ab verifier!AVrfDebugPageHeapAllocate+0x000000000000039f
7feaceef108 ntdll!RtlDebugAllocateHeap+0x0000000000000038
7feacead679 ntdll!RtlpAllocateHeap+0x00000000000a6f59
7feace06704 ntdll!RtlAllocateHeap+0x00000000000001ae
7fe9c1106eb verifier!AVrfpRtlAllocateHeap+0x00000000000000d7
2176addb hccutils!DllUnregisterServer+0x0000000000002f9f
2176a217 hccutils!DllUnregisterServer+0x00000000000023db
21761378 hccutils!GetCUICustomizationKey+0x0000000000000190
21761936 hccutils!GetCUICustomizationKey+0x000000000000074e
2176320b hccutils!CreateThisKey+0x00000000000003f3
217635f8 hccutils!FindResources+0x0000000000000108
21763a11 hccutils!LoadSTRING+0x00000000000002f1
22acfc0d igfxpph+0x000000000000fc0d
22acfffe igfxpph+0x000000000000fffe
7feab109077 shell32!IShellExtInit_Initialize+0x0000000000000047
7feab10b3ed shell32!HDXA_QueryContextMenu+0x00000000000002dd
7feab10a56f shell32!CDefFolderMenu::QueryContextMenu+0x000000000000041b
7feab6ad3b9 shell32!CContextMenuOnContextMenuArray::_QueryNthContextMenu+0x0000000000000035
7feab6ad21c shell32!CContextMenuOnContextMenuArray::QueryContextMenu+0x00000000000000b0
7feab416ff7 shell32!CDefView::_DoContextMenuPopup+0x00000000000001ab
7feab416c77 shell32!CDefView::OnBackgroundContextMenu+0x00000000000001ab
7fe9ae89c2e explorerframe!UIItemsView::ShowContextMenu+0x0000000000000292
7fe9ae8335f explorerframe!CItemsView::ShowContextMenu+0x0000000000000017
7feab416e29 shell32!CDefView::_DoContextMenu+0x0000000000000081
7feab410a55 shell32!CDefView::_OnContextMenu+0x00000000000000e9
7feab7465bb shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x000000000001bf5a
7feab0647b9 shell32!CDefView::s_WndProc+0x0000000000000071
7feaa82171e user32!UserCallWinProcCheckWow+0x000000000000013a
7feaa82432b user32!CallWindowProcW+0x0000000000000093
7fea7b812ed comctl32!CallOriginalWndProc+0x000000000000001d
7fea7b811e6 comctl32!CallNextSubclassProc+0x0000000000000082
7fea7b812a7 comctl32!DefSubclassProc+0x0000000000000077
Image path: C:\Windows\System32\igfxpph.dll
Image name: igfxpph.dll
Timestamp: Tue Jul 31 23:14:59 2012 (50184AD3)
CheckSum: 0006E71C
ImageSize: 00065000
File version: 8.15.10.2828
Product version: 8.15.10.2828
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: IGFXPPH
OriginalFilename: IGFXPPH.DLL
ProductVersion: 8.15.10.2828
FileVersion: 8.15.10.2828
PrivateBuild: 8.15.10.2828
SpecialBuild: 8.15.10.2828
FileDescription: igfxpph Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
Image path: C:\Windows\System32\hccutils.dll
Image name: hccutils.dll
Timestamp: Tue Jul 31 23:14:26 2012 (50184AB2)
CheckSum: 000295E3
ImageSize: 0001F000
File version: 8.15.10.2828
Product version: 8.15.10.2828
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Intel Corporation
ProductName: Intel(R) Common User Interface
InternalName: HCCUTILS
OriginalFilename: HCCUTILS.DLL
ProductVersion: 8.15.10.2828
FileVersion: 8.15.10.2828
PrivateBuild: 8.15.10.2828
SpecialBuild: 8.15.10.2828
FileDescription: hccutils Module
LegalCopyright: Copyright 1999-2006, Intel Corporation
LegalTrademarks: Copyright 1999-2006, Intel Corporation
Comments: Copyright 1999-2006, Intel Corporation
0x000000000f2cb968 : 0x000007feace1b679 : ntdll!RtlRaiseException+0x27e
0x000000000f2cb990 : 0x000007fea7b812ed : comctl32!CallOriginalWndProc+0x1d
0x000000000f2cba10 : 0x000007fea7d63c20 : comctl32!ShellTraceId_ComCtl32_Wizard_Open_Stop+0x8
0x000000000f2cbae0 : 0x000007feace1b46e : ntdll!RtlRaiseException+0x4e
0x000000000f2cbb20 : 0x000000000f2cbae0 : 0x000007feace1b46e : ntdll!RtlRaiseException+0x4e
0x000000000f2cbb28 : 0x000007feace00000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x000000000f2cbb60 : 0x000007feace1b46e : ntdll!RtlRaiseException+0x4e
0x000000000f2cbba0 : 0x000000000f2cbb60 : 0x000007feace1b46e : ntdll!RtlRaiseException+0x4e
0x000000000f2cbba8 : 0x000007feace00000 : "ntdll!NtDllUserStubs <PERF> (ntdll+0x0)"
0x000000000f2cbbc8 : 0x000007fea7d7c000 : "comctl32!Microsoft::WRL::Details::ModuleBase::module_ <PERF> (comctl32+0x1fc000)"
0x000000000f2cbcb8 : 0x000007feace04bba : ntdll!KiUserExceptionDispatch+0x2e
0x000000000f2cbdb8 : 0x000007fe9c0fa088 : verifier!VerifierStopMessage+0x1fc
0x000000000f2cbe70 : 0x0000000002556a90 : 0x000007fe9c11205c : verifier!AVrfpHeapFree+0xf4
0x000000000f2cbf70 : 0x000000000f2cc618 : 0x000007feac6e1330 : kernel32!HeapFreeStub
0x000000000f2cbfa0 : 0x000007feab8b3b9c : shell32!_NULL_IMPORT_DESCRIPTOR+0x49c
0x000000000f2cbfb8 : 0x000007feab8b3b9c : shell32!_NULL_IMPORT_DESCRIPTOR+0x49c
0x000000000f2cbfe0 : 0x000000001e36d670 : dt ntshrui!COnlineIdFilter
0x000000000f2cc068 : 0x000007feace4e57f : ntdll!vsnprintf_l+0x75
0x000000000f2cc070 : 0x000007feab10b3ed : shell32!HDXA_QueryContextMenu+0x2dd
0x000000000f2cc088 : 0x000007feab6ad21c : shell32!CContextMenuOnContextMenuArray::QueryContextMenu+0xb0
0x000000000f2cc090 : 0x3030303030303030 : !da "0000000022CD45E0T"
0x000000000f2cc098 : 0x3045353444433232 : !da "22CD45E0T"
0x000000000f2cc0d8 : 0x000007feace4e511 : ntdll!vsnprintf+0x11
0x000000000f2cc0e8 : 0x000007feace85722 : ntdll!vsnprintf_l+0x98
0x000000000f2cc0f8 : 0x000007fe9c0f7152 : verifier!AVrfpDphPlaceOnDelayFree+0x1f2
0x000000000f2cc100 : 0x000000000f2cc3f8 : 0x000007fe9c0f1760 : !da ""This verifier stop is not continuable. Process will be terminated .when you use ...""
0x000000000f2cc118 : 0x000007feacec93bc : ntdll!RtlStringVPrintfWorkerA+0x20
0x000000000f2cc148 : 0x000007feace1ad81 : ntdll!vDbgPrintExWithPrefixInternal+0x89
0x000000000f2cc1a8 : 0x736968540a3d3d3d : !da "===.This"
0x000000000f2cc1c0 : 0x000007fe9c0fa088 : verifier!VerifierStopMessage+0x1fc
0x000000000f2cc248 : 0x3d3d3d3d3d3d3d3d : !da "========"
0x000000000f2cc250 : 0x000007fe9c0fa088 : verifier!VerifierStopMessage+0x1fc
0x000000000f2cc258 : 0x206c6c6977207373 : !da ""ss will be termi""
0x000000000f2cc260 : 0x696d726574206562 : !da ""be termi""
0x000000000f2cc308 : 0x000007feaceeddee : ntdll!RtlpValidateHeap+0x32
0x000000000f2cc388 : 0x000007fe9c0f1760 : !da ""This verifier stop is not continuable. Process will be terminated .when you use ...""
0x000000000f2cc398 : 0x000007feace407a4 : ntdll!DbgPrintEx+0x30
0x000000000f2cc3b8 : 0x000007feaceeddee : ntdll!RtlpValidateHeap+0x32
0x000000000f2cc3c0 : 0x000000000f2cc3f8 : 0x000007fe9c0f1760 : !da ""This verifier stop is not continuable. Process will be terminated .when you use ...""
0x000000000f2cc3c8 : 0x000007fe9c10c601 : verifier!AVrfpSRWLockFreeMemoryChecks+0x85
0x000000000f2cc3d8 : 0x000007fe9c0fa07b : verifier!VerifierStopMessage+0x1ef
0x000000000f2cc3f0 : 0x000007fe9c0f1860 : !da "===========================================================.%s.=================..."
0x000000000f2cc3f8 : 0x000007fe9c0f1760 : !da ""This verifier stop is not continuable. Process will be terminated .when you use ...""
0x000000000f2cc408 : 0x000007fe9c0f14a8 : !da ""corrupted suffix pattern""
0x000000000f2cc418 : 0x000007fe9c0f11c0 : !da ""Heap handle""
0x000000000f2cc428 : 0x000007fe9c0f13c8 : !da ""Heap block""
0x000000000f2cc438 : 0x000007fe9c0f13b8 : !da ""Block size""
0x000000000f2cc448 : 0x000007fe9c0f1408 : !da ""corruption address""
0x000000000f2cc450 : 0x000007fe9c0f13c8 : !da ""Heap block""
0x000000000f2cc458 : 0x000007fe9c0f13b8 : !da ""Block size""
0x000000000f2cc460 : 0x000007fe9c0f1408 : !da ""corruption address""
0x000000000f2cc468 : 0x000007fe9c0f11c0 : !da ""Heap handle""
0x000000000f2cc488 : 0x000007fe9c0f8f68 : verifier!AVrfpDphReportCorruptedBlock+0x224
0x000000000f2cc498 : 0x000007fe9c0f14a8 : !da ""corrupted suffix pattern""
0x000000000f2cc4a8 : 0x000007fe9c0f11c0 : !da ""Heap handle""
0x000000000f2cc4b8 : 0x000007fe9c0f13c8 : !da ""Heap block""
0x000000000f2cc4c8 : 0x000007fe9c0f13b8 : !da ""Block size""
0x000000000f2cc4d8 : 0x000007fe9c0f1408 : !da ""corruption address""
0x000000000f2cc520 : 0x000007feac6e1330 : kernel32!HeapFreeStub
0x000000000f2cc548 : 0x000007fe9c0f92a4 : verifier!AVrfpDphCheckNormalHeapBlock+0xc8
0x000000000f2cc598 : 0x000007fe9c0fd59b : verifier!VerifierCheckPageHeapAllocation+0x6b
0x000000000f2cc5c8 : 0x000007fe9c111fcd : verifier!AVrfpHeapFree+0x65
*** ERROR: Symbol file could not be found. Defaulted to export symbols for hccutils.dll -
0x000000000f2cc618 : 0x000007feac6e1330 : kernel32!HeapFreeStub
0x000000000f2cc688 : 0x0000000021761286 : hccutils!GetCUICustomizationKey+0x9e
0x000000000f2cc6b8 : 0x000000002176162d : hccutils!GetCUICustomizationKey+0x445
0x000000000f2cc728 : 0x0000000021761936 : hccutils!GetCUICustomizationKey+0x74e
0x000000000f2cc750 : 0x000000000f2ccf00 : !da "igfxres.dll"
0x000000000f2cc758 : 0x000000002176320b : hccutils!CreateThisKey+0x3f3
0x000000000f2cc760 : 0x000000000f2ccf00 : !da "igfxres.dll"
0x000000000f2cc7b8 : 0x0000000022cd44d0 : !da "C:\windows\system32\igfxr"
0x000000000f2cc7d8 : 0x000007feaceeef6e : ntdll!RtlDebugSizeHeap+0x36
0x000000000f2cc7e0 : 0x0000000022cd4440 : !da "C:\windows\system32\igfxres.dll"
0x000000000f2cc7e8 : 0x000007fea9dcd429 : KERNELBASE!GetLocaleInfoHelper+0x279
0x000000000f2cc850 : 0x6f646e69775c3a43 : !da "C:\windows\system32"
0x000000000f2cc858 : 0x65747379735c7377 : !da "ws\system32"
*** ERROR: Symbol file could not be found. Defaulted to export symbols for igfxpph.dll -
0x000000000f2ccc70 : 0x0000000022ac0000 : igfxpph
0x000000000f2ccc88 : 0x0000000022ac0000 : igfxpph
0x000000000f2ccca8 : 0x00000000217635f8 : hccutils!FindResources+0x108
0x000000000f2ccf00 : 0x2e73657278666769 : !da "igfxres.dll"
0x000000000f2cd038 : 0x0000000021763a11 : hccutils!LoadSTRING+0x2f1
0x000000000f2cd090 : 0x6572617774666f53 : !da "Software\Intel\Display\igfxcui\igfxpph\resources"
0x000000000f2cd098 : 0x445c6c65746e495c : !da "\Intel\Display\igfxcui\igfxpph\resources"
0x000000000f2cd0a0 : 0x695c79616c707369 : !da "isplay\igfxcui\igfxpph\resources"
0x000000000f2cd0a8 : 0x695c697563786667 : !da "gfxcui\igfxpph\resources"
0x000000000f2cd0b0 : 0x725c687070786667 : !da "gfxpph\resources"
0x000000000f2cd0b8 : 0x73656372756f7365 : !da "esources"
0x000000000f2cd1f8 : 0x000007feab062996 : shell32!_SHCoCreateInstance+0x1a6
0x000000000f2cd238 : 0x000007feab0fb318 : shell32!GUID_000214e4_0000_0000_c000_000000000046
0x000000000f2cd258 : 0x000007fea9dc3839 : KERNELBASE!BaseRegGetKeySemantics+0x1b9
0x000000000f2cd260 : 0x004200410033007b : !du "{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}"
0x000000000f2cd268 : 0x0035003700360031 : !du "1675A-CCFF-11D2-8B20-00A0C93CB1F4}"
0x000000000f2cd270 : 0x00430043002d0041 : !du "A-CCFF-11D2-8B20-00A0C93CB1F4}"
0x000000000f2cd278 : 0x0031002d00460046 : !du "FF-11D2-8B20-00A0C93CB1F4}"
0x000000000f2cd280 : 0x002d003200440031 : !du "1D2-8B20-00A0C93CB1F4}"
0x000000000f2cd288 : 0x0030003200420038 : !du "8B20-00A0C93CB1F4}"
0x000000000f2cd290 : 0x004100300030002d : !du "-00A0C93CB1F4}"
0x000000000f2cd298 : 0x0033003900430030 : !du "0C93CB1F4}"
0x000000000f2cd2a0 : 0x0046003100420043 : !du "CB1F4}"
0x000000000f2cd3b8 : 0x000007fe9c0f5f90 : verifier!AVrfSetHeapPathCaller+0xc
0x000000000f2cd3c0 : 0x6572617774666f53 : !da "Software\Intel\Display\igfxcui\igfxpph\resources"
0x000000000f2cd3c8 : 0x445c6c65746e495c : !da "\Intel\Display\igfxcui\igfxpph\resources"
0x000000000f2cd3d0 : 0x695c79616c707369 : !da "isplay\igfxcui\igfxpph\resources"
0x000000000f2cd3d8 : 0x695c697563786667 : !da "gfxcui\igfxpph\resources"
0x000000000f2cd3e0 : 0x725c687070786667 : !da "gfxpph\resources"
0x000000000f2cd3e8 : 0x73656372756f7365 : !da "esources"
Hi Andre,
Thanks for getting back so quickly. I updated the Intel driver, but the problem remains. Right-clicking in any blank space in the rh pane of explorer results in a crash. Right-clicking any of the folders in the folder tree in the left pane also does the same. Also had huge problems opening device manager to update the Intel driver, with frequent crashes, eventually got to it through launching Computer Management.
I've uploaded the latest full dump created after updating the Intel graphics driver. (No matter how much RAM I tired to create, it was insufficient for LZMA2/ultra, and the 7z file created with LMZA/Ultra is about 135 MB). Here it is:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!451&authkey=!AFHy516UjEjYQqo
As far as I know, I never installed AppVerifier/dump creation, unless this refers to the WER_Explorer_full.reg file that I downloaded and installed from your Skydrive. Should I now download and install WER_Explorer_full_uninstall.reg?
Sorry to pester you with what probably strike you as very beginner level questions.
still the same Intel driver issue.
Use ShellExView and disable the Intel driver shell extension. Also add the intel .cpl (igfxcpl.cpl) to the don't load list:
Andre,
Thanks very much for the advice. I have done as instructed, with great trepidation as I had to do things and go place I have never been before. I kept getting error messages trying to add the intel .cpl to the effect that I didn't have permission (despite administrator status), so for the first time ever, I went through various contortions to give myself full permission to edit don't load. I had to change ownership from Trustedinstaller to Administrators, and was unable to switch it back after adding the intel .cpl.
Anyway, I'm glad to say that I can now right-click in Explorer without crashing.
Microsoft Management Console (MMC) still crashes for some reason after a few minutes, and device manager seems to take far longer than it should to load. Otherwise, no problems for the time being.
Last time I asked about AppVerifier. Should I ignore?:
************************************
As far as I know, I never installed AppVerifier/dump creation, unless this refers to the WER_Explorer_full.reg file that I downloaded and installed from your Skydrive. Should I now download and install WER_Explorer_full_uninstall.reg?
*************************************
Thanks again for all your help.
yes run the WER_Explorer_full_uninstall.reg to disable AppVerifier and stop dump creation.
Download the WER_MMC.reg and import it. Create a new topic about the MMC issue and upload the MMC dump.
Hi Andre,
Thanks, I'll create a new topic for the MMC issue. I have the dumps already uploaded.
I was hoping that I had seen the last of explorer crashes thanks to you, but I did suffer another while opening the device manager - an explorer window just closed, without the shell crashing as it had in the past. For some reason even after running WER_Explorer_full_uninstall.reg , I got a pretty large dump. I've uploaded it just in case you're interested:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!553&authkey=!AB0KJIxdFOd3Zsw
Hello
I have a Lenovo Y500 Laptop with the original Win 8 on it.After a month of working with it I had the problem of windows explorer crashing and restarting.So I used the backup and restore pre-installed software and restored it to the beginning of device usage.After a while I had the same problem again.I've tried to create the dumb file but the size is arround 400 MB so I can't upload it by skydrive.What should I do.PLEASE HELP ME.MY HEAD IS GONNA BE EXPLODED.
Thanks for your attention
Time to pass on the favors I received here from Andre and Exotic Hadron (though I'm still suffering Explorer crashes). You can use 7zip (http://www.7-zip.org/) to compress the dump file considerably. Use Add to archive, and set to LZMA/ultra, or even better, LZMA2/ultra if you have enough memory, and then upload the 7z file. I managed to upload a dump of over 600 MB by this method, using LZMA/ultra.
@Mehdi_ID
zip the dump
@Jeremy Angel
upload new dumps.
Thanks
This is mine : https://skydrive.live.com/redir?resid=9F0DA8F031098F3!159&authkey=!ACN_hYALKFw6njw
Thanks
This is mine
Autodesk causes the crash:
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for sppc.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for IDMShellExt64.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for SugarSyncShellExt_x64.dll -
FAULTING_IP:
QtCore_Ad_SyncNs_4!QThread::start+3fb
00000000`521966ab 488b98c0000000 mov rbx,qword ptr [rax+0C0h]
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00000000521966ab (QtCore_Ad_SyncNs_4!QThread::start+0x00000000000003fb)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000000000000c0
Attempt to read from address 00000000000000c0
CONTEXT: 0000000000000000 -- (.cxr 0x0;r)
rax=0000000000000000 rbx=0000000000000000 rcx=bb3caf7046380000
rdx=0000000000000000 rsi=000000002294e9d8 rdi=0000000000000001
rip=000007fbf012319b rsp=000000002294e5d8 rbp=0000000000000002
r8=000000002294de78 r9=000000002294df80 r10=0000000000000000
r11=0000000000000000 r12=0000000000000008 r13=000000002294e9d8
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!NtWaitForMultipleObjects+0xa:
000007fb`f012319b c3 ret
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_READ
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00000000000000c0
READ_ADDRESS: 00000000000000c0
FOLLOWUP_IP:
QtCore_Ad_SyncNs_4!QThread::start+3fb
00000000`521966ab 488b98c0000000 mov rbx,qword ptr [rax+0C0h]
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APP: explorer.exe
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
FAULTING_THREAD: 00000000000016a4
PRIMARY_PROBLEM_CLASS: NULL_CLASS_PTR_READ
BUGCHECK_STR: APPLICATION_FAULT_NULL_CLASS_PTR_READ
LAST_CONTROL_TRANSFER: from 000007fbe49e653d to 00000000521966ab
STACK_TEXT:
00 ntdll!NtWaitForMultipleObjects
01 verifier!AVrfpNtWaitForMultipleObjects
02 KERNELBASE!WaitForMultipleObjectsEx
03 verifier!AVrfpWaitForMultipleObjectsExCommon
04 verifier!AVrfpKernelbaseWaitForMultipleObjectsEx
05 kernel32!WerpReportFaultInternal
06 kernel32!WerpReportFault
07 KERNELBASE!UnhandledExceptionFilter
08 ntdll!RtlUserThreadStart$filt$0
09 ntdll!_C_specific_handler
0a ntdll!RtlpExecuteHandlerForException
0b ntdll!RtlDispatchException
0c ntdll!KiUserExceptionDispatch
0d QtCore_Ad_SyncNs_4!QThread::start
0e verifier!AVrfpStandardThreadFunction
0f kernel32!BaseThreadInitThunk
10 ntdll!RtlUserThreadStart
IMAGE_NAME: QtCore_Ad_SyncNs_4.dll
FAILURE_BUCKET_ID: NULL_CLASS_PTR_READ_c0000005_QtCore_Ad_SyncNs_4.dll!QThread::start
FAILURE_ID_HASH_STRING: um:null_class_ptr_read_c0000005_qtcore_ad_syncns_4.dll!qthread::start
Image path: C:\Program Files\Autodesk\Autodesk Sync\QtCore_Ad_SyncNs_4.dll
Image name: QtCore_Ad_SyncNs_4.dll
Browse all global symbols functions data
Timestamp: Fri Dec 21 07:07:35 2012 (50D3FCA7)
CheckSum: 002DC7EA
ImageSize: 002D7000
File version: 4.8.2.0
Product version: 4.8.2.0
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Digia Plc and/or its subsidiary(-ies)
ProductName: Qt4
OriginalFilename: QtCore_Ad_SyncNs_4.dll
ProductVersion: 4.8.2.0
FileVersion: 4.8.2.0
FileDescription: C++ application development framework.
LegalCopyright: Copyright (C) 2012 Digia Plc and/or its subsidiary(-ies).
update Autodesk or remove it. After doing this import the uninstall.reg to stop dump creation.
Andre,
Thanks. I was hesitating to pester you again, especially as these are only very small dumps since I turned off full dumps. The full dumps I was getting were over 800 MB, so doubtful whether I could upload the 7z file.
Let me know if these aren't useful:
https://skydrive.live.com/redir?resid=F9A7377418B487C5!557&authkey=!ABduTOfKBvZTGWo
the small dumps are an issue because they don't contain all data.
Disable the Dropbox Shell Extension and look if this fixes it.
Hi, Andre
Looks you help may guys solved the issue. thanks very much.
Sorry to say, I hit the same issue, during last two month. one time, I tried to uninstall some program by time, it works. but those two days, I hit it again, but cannot find any clue again.
So, I will try to dump the file, and to analysis, so look to see if you can share how you use the Windbg to analyze the dump file. so that maybe may guys can help themselves.
thanks again.
And below is a dump from my crash. can you help to have a look firstly, thanks.
http://sdrv.ms/14vnTF3
Thanks
Darren
below stack is got by analyze -v, but I don't know how to get more details.
0:033> !analyze -vPlease run a chkdsk. The action center does some NTFS/File History logging while the explorer crashes.And below is a dump from my crash. can you help to have a look firstly, thanks.
Hi,
i was having the explorer crash sometiems per day and then i found this topic. I've downloaded the reg file from your skydrive and i've added it to the registry. After i restarted my computer and my explorer never loaded again. i can still open programms through the tasks manager but when i load the windows i just get a black screen and the mouse pointer. How can i solve this problem? i've already tried to use the system restore a couple of a times and still the same...If i start in safe mode then the explorer turns on and works normally, but when i make a normal boot even i start it trough the tasks manager i get the error: "The application failed to initialize properly (0xc0000142)"
boot into safe mode and apply the uninstall reg file:
now reboot, zip and upload the dmp files.
I've managed to go the "events viewer" in the "administrative tools" of windows and we can see there a log file with some informations. I've uploaded it to my skydrive(3 files) and you can see it in the following link:
https://skydrive.live.com/redir?resid=181F7339F4ADBBC0!3443
I'm not any computer geek but i've noticed that the problem may be an autodesk file which is specified in the error. I would be very thankful if you could help me solving this problem or at least suggest me something.
Note that my system is in portuguese, so a few fields will be written in portuguese, but all directories, codes, etc are "understandable"
after googling a few words i've probably found what the problem is and it's explained in the microsft forum and also in autodesk forum. you can easily find it by googling with this name"QtCore_Ad_SyncNs_4.dll". IT's probably caused by a product called "autodesk 360". I hope that unninstalling it will solve the explorer crash problem.
i am using windows 8 os 64-bit and i am facing really severe issues every time my all apps are crashing then i keep on refreshing the pc and installing the programs again and again please anyone tell me the solution for this issue and one more thing every time when i open the store graphics are not loading properly my internet plan is decent but still the graphics are not loading,another issue is screen turns into black and makes windows 8 app permission sound every time please help.
thanks and regards
Hello Andre,
We too have an isue where explorer (and taskbar) crashes. I made a fresh re-install of windows 8, but the laptop keeps crashing. I made a dumpfile as sugested in your post. I hope you can help and/or advice me.
https://skydrive.live.com/redir?resid=4E5E698947364C8D%21105
Thanks in advance
>>We too have an isue where explorer (and taskbar) crashes. I made a fresh re-install of windows 8, but the laptop >>keeps crashing. I made a dumpfile as sugested in your post. I hope you can help and/or advice me.
Hey, please update driver and software for your Intel network interface card. Its control library is crashing.
>>https://skydrive.live.com/redir?resid=4E5E698947364C8D%21105
after the last update for win8.1 pro i have a lot of problem like my computer get slow and explorer.exe sometimes crashed help me plez
i try to make "Refresh My PC" but he side some files are not available
explorer.exe now crashing on a number of PCs after the new updates after 8.1.
Haven't been able to track this down to a single cause. Happening on PCs with completely different software installed. I'm pretty sure this is a MS bug.
This topic is archived. No further replies will be accepted.
Other recent topics
Click here to get your free copy of Network Administrator. Over 25 plugins to make your life easier