Sign in
 
HomeWindows 8Windows 7Windows VistaWindows XPMDOPWindows IntuneLibraryForums
Windows Client >
> 
> 
App crash: explorer.exe faulting module: fundisc

Answered App crash: explorer.exe faulting module: fundisc

  • Tuesday, November 20, 2012 11:08 PM
     
      Has Code
    Sign In to Vote
    0

    Hello.

    I've been having issues with 4 computers now. All of them Windows 7 Professional 32 bits.

    The error they're having is the same on each PC: explorer.exe fails and restarts after clicking Ok to the dialog.

    Level: Error
Source: Application Error
Event ID: 1000
Faulting application: explorer.exe, version: 6.1.7601.175xx, time stamp: <changes>
faulting module: unknown, version: 0.0.0.0, time stamp: 0x00000000
exception code : 0xc0000005
fault offset: <changes>
process id: <changes>
application start time: <changes>

    The oldest issue is november 6th (there's not a single instance of the error before that date); since then the issue is happening at least once a day but more like 5-10 times a day.

    I ran Windbg and for almost all errors it point to fundisc.dll as the culprit.

    This is one of the dumps:

    Loading Dump File [C:\Users\<user>\Desktop\<other_user>\explorer.exe.680.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: srv*;D:\WinDbg\Symbols\Win7AMD64;D:\WinDbg\Symbols\Win7x86;D:\WinDbg\Symbols\XPSP3
Executable search path is: D:\WinDbg\Image\XPSP3
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Tue Nov 20 09:43:21.000 2012 (UTC - 6:00)
System Uptime: not available
Process Uptime: 0 days 0:06:02.000
................................................................
...........................................................
Loading unloaded module list
........
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2a8.884): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=0472f040 ecx=00000400 edx=00000000 esi=00000002 edi=00000000
eip=77c57094 esp=0472eff0 ebp=0472f08c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
77c57094 c3              ret
0:012> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Unable to load image C:\Windows\System32\ieframe.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ieframe.dll

FAULTING_IP: 
+0
0472f64c fc              cld

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0472f64c
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000008
   Parameter[1]: 0472f64c
Attempt to execute non-executable address 0472f64c

DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s.

EXCEPTION_PARAMETER1:  00000008

EXCEPTION_PARAMETER2:  0472f64c

WRITE_ADDRESS:  0472f64c 

FOLLOWUP_IP: 
fundisc!CNotificationQueue::ThreadProc+31b
728963ee bfc0808a72      mov     edi,offset fundisc!WPP_GLOBAL_Control (728a80c0)

FAILED_INSTRUCTION_ADDRESS: 
+31b
0472f64c fc              cld

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

APP:  explorer.exe

LAST_CONTROL_TRANSFER:  from 76aa5d3f to 0472f64c

FAULTING_THREAD:  00000884

PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT

BUGCHECK_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT

IP_ON_STACK: 
+31b
0472f64c fc              cld

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0472f64c 76aa5d3f 00000008 03207428 fffffffe 0x472f64c
0472f7fc 76ad8f82 2246d5ac 03207428 00000000 ole32!COIDTable::ThreadCleanup+0xcb
0472f840 76ad8ec3 00000000 0472f890 76bd7724 ole32!FinishShutdown+0x9d
0472f860 76acbac3 00000000 728945f0 03207428 ole32!ApartmentUninitialize+0x96
0472f878 76ad88e8 0472f890 00000000 728a810c ole32!wCoUninitialize+0x153
0472f894 728963ee 00000000 00000000 0015c9d0 ole32!CoUninitialize+0x72
0472f8b0 77aded6c 0015c9d0 0472f8fc 77c7377b fundisc!CNotificationQueue::ThreadProc+0x31b
0472f8bc 77c7377b 0015c9d0 73c46ab8 00000000 kernel32!BaseThreadInitThunk+0xe
0472f8fc 77c7374e 72895224 0015c9d0 00000000 ntdll!__RtlUserThreadStart+0x70
0472f914 00000000 72895224 0015c9d0 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND:  .ecxr ; kb ; ~12s; .ecxr ; kb

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  fundisc!CNotificationQueue::ThreadProc+31b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: fundisc

IMAGE_NAME:  fundisc.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bd9ff

FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_c0000005_fundisc.dll!CNotificationQueue::ThreadProc

BUCKET_ID:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_BAD_IP_fundisc!CNotificationQueue::ThreadProc+31b

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/explorer_exe/6_1_7601_17567/4d6727a7/unknown/0_0_0_0/bbbbbbb4/c0000005/0472f64c.htm?Retriage=1

Followup: MachineOwner
---------

    There's another similar error but points to "NetworkItemFactory" module instead of "fundisc", but i'm not sure they're related yet.

    I already:

    1. Ran viruschecks and spywarescans and the computers are clean.
    2. clean booted and the issue persists.
    3. sfc'd and no files were corrupt.

    They all are HP Compaq 8000 series; besides that, the only other thing i can think of that could be common between those particular machines is that not all of them may had been wiped out when bought and the problems came from the bloatware and some update.

    The only updates they had installed were security and critical updates via WSUS.

    I'm starting to worry and i'm out of ideas.

    Any help will be appreciated.

    "When something is not working as it is supposed to, then it is working as expected" -R


    • Edited by Iker Höek Tuesday, November 20, 2012 11:10 PM Because
    •  
     

All Replies

  • Thursday, November 22, 2012 11:14 AM
    Moderator
     
     
    Sign In to Vote
    0
    Hi,
    Event ID: 1000; Source: Application Error; please refer to:
     
    I would recommend you try some general steps about troubleshooting explorer.exe crash Issues.
     
     
    Hope this helps.
     
    Regards.

    Spencer

    TechNet Community Support

     
  • Thursday, November 22, 2012 2:39 PM
     
     
    Sign In to Vote
    0

    Your "some general steps" link gives me an OWA login screen.

    I had already check the other ones though.

    "When something is not working as it is supposed to, then it is working as expected" -R


    • Edited by Iker Höek Thursday, November 22, 2012 2:40 PM cant type
    •  
     
  • Friday, November 23, 2012 3:09 PM
     
     
    Sign In to Vote
    0
    Can you then make the .dmp file(s) available (provide link) via Windows Live SkyDrive or similar site?

    The following link has information on using Windows Live SkyDrive:

    http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
     
  • Monday, November 26, 2012 2:49 PM
     
     
    Sign In to Vote
    0

    Hey auggy, sure thing.

    As i said before, there are two modules failing on that error 1000: "fundisc" and "NetworkItemFactory"; i'm posting a dump of each error for each machine (dunno if it's necessary)

    Computer 1

    Computer 2

    Computer 3

    As additional info, i already tried:

    1. Uninstalling all updates since the week previous to the first error.
    2. Creating a fresh new profile for the user.
    3. Reinstalling Windows.

    none of them worked, the problem persists. Yes, even after reinstalling Windows!

    Im still exploring some options but im completely open to suggestions.

    Thank you.

    "When something is not working as it is supposed to, then it is working as expected" -R



    • Edited by Iker Höek Monday, November 26, 2012 2:52 PM
    •  
     
  • Tuesday, November 27, 2012 1:09 PM
     
     
    Sign In to Vote
    1

    Looking at each dump file shows what appears to be an "unknown" module in the "STACK_TEXT" field:

    STACK_TEXT: 
    0475fc70 0475fc80 unknown!unknown+0x0
    0475fc88 77735d3f ole32!COIDTable::ThreadCleanup+0xcb
    0475fe38 77768f82 ole32!FinishShutdown+0x9d
    0475fe7c 77768ec3 ole32!ApartmentUninitialize+0x96
    0475fe9c 7775bac3 ole32!wCoUninitialize+0x153
    0475feb4 777688e8 ole32!CoUninitialize+0x72
    0475fed0 729663ee fundisc!CNotificationQueue::ThreadProc+0x31b
    0475feec 77b8ed6c kernel32!BaseThreadInitThunk+0xe
    0475fef8 77d5377b ntdll!__RtlUserThreadStart+0x70
    0475ff38 77d5374e ntdll!_RtlUserThreadStart+0x1b

    In one of the crashes this "unknown" module got the blame for the crash:

    Unable to load image C:\Windows\System32\ieframe.dll, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ieframe.dll
    Probably caused by : unknown ( unknown!noop+94f840 )

    As this error is occurring on four computers can you correlate the installation of any third party software to the appearance of the crash?

     
  • Tuesday, November 27, 2012 3:34 PM
     
     
    Sign In to Vote
    0

    I was getting that unknown module too until i ran a ".symfix; .reload", then it started to appear as "fundisc" module (my symbol's path is ".sympath SRV*D:\WinDbg\Symbols*http://msdl.microsoft.com/download/symbols").

    I just found out theres a fifth machine with the issue; again Windows 7 pro x86.

    Beyond updates, this what's on them:

    1. Office SOHO (2007 and 2010)
    2. Adobe Reader 10 or 11
    3. Flash Player 10 or 11
    4. Trend Micro OfficeScan Client 10.5.1766
    5. PDFCreator 1.x.x
    6. HP LaserJet 4250 PCL 6 Drivers (61.74.561.43)

    All of them where already installed at the time the first error happened (around november 6th)

    Thank for your help =)

    "When something is not working as it is supposed to, then it is working as expected" -R


    • Edited by Iker Höek Tuesday, November 27, 2012 5:55 PM details... always details
    •  
     
  • Friday, November 30, 2012 3:04 AM
     
     Answered
    Sign In to Vote
    2

    Perhaps try the following hotfix and see if it helps any:

    http://support.microsoft.com/kb/2494427

    There is a link at the top of the article to request the hotfix.

    Also, the following two hotfixes may also apply:

    http://support.microsoft.com/kb/2638018

    http://support.microsoft.com/kb/2541119


    • Edited by auggyMVP Friday, November 30, 2012 3:26 AM
    • Marked As Answer by Iker Höek Monday, December 03, 2012 2:54 PM
    •  
     
  • Friday, November 30, 2012 6:57 PM
     
     
    Sign In to Vote
    1

    Thanks for your response auggy.

    I requested and installed kb2494427 on two machines yesterday.

    I hadn't found the other hotfixes before.

    Will check them and report back.

     

    Thanks again, yours is the only help i've been able to get =)

    "When something is not working as it is supposed to, then it is working as expected" -R

     
  • Saturday, December 01, 2012 4:35 AM
     
     
    Sign In to Vote
    1

    You're welcome.

    Hopefully one of the hotfixes will solve the issue.

     
  • Monday, December 03, 2012 2:54 PM
     
     
    Sign In to Vote
    1

    You're welcome.

    Hopefully one of the hotfixes will solve the issue.

    I haven't had any error on the machines i installed kb2494427 since thursday.

    It's still early to tell but it seems finally fixed.

    Will try kb2494427 if anything happens again but for now we can consider this solved.

    Many thanks auggy =')

    "When something is not working as it is supposed to, then it is working as expected" -R

     
  • Tuesday, December 04, 2012 9:00 AM
     
     
    Sign In to Vote
    0

    Hello,

    We have the same issue in our company. At the moment we have 5 PC "infected".

    I tried all things as Iker Höek. But no success. I searched all forums, but not really useful information.

    UNTIL I found you guys! I'll test that Hotfix too and pray that it works! :)

    Have a nice day to you guys! Will report back.

    Regards,

    André Vieira

     
  • Saturday, December 08, 2012 1:10 PM
     
     
    Sign In to Vote
    0

    Iker Höek.

    You're welcome.

     
  • Saturday, December 08, 2012 1:10 PM
     
     
    Sign In to Vote
    0

    Andre Vieiraa,

    Good luck!

     
  • Wednesday, January 16, 2013 12:57 AM
     
     
    Sign In to Vote
    0

    Just an update.

    Everything's all right =)

    "When something is not working as it is supposed to, then it is working as expected" -R


    • Edited by Iker Höek Wednesday, January 16, 2013 12:57 AM I accidentally the post
    •  
     
  • Wednesday, January 16, 2013 1:54 PM
     
     
    Sign In to Vote
    0

    That's great!

    Thanks for the follow-up.