none
Explorer.exe crash - twinui.dll

    Question

  • Hello,

    When I'm in Visual Studio 2012 RTM on Windows 8 RTM I got a lot of crash for explorer.exe, it seems to come from a Desktop mode switch or something. Here' s the Event viewer details and the result of a quick analysis of the dump file. I'm not expert so if someone can look at it.... Thank you!

    Here' s a link to the dump file : http://sdrv.ms/U0KZYP

    Faulting application name: explorer.exe, version: 6.2.9200.16384, time stamp: 0x50107dbc

    Faulting module name: twinui.dll, version: 6.2.9200.16384, time stamp: 0x50109442

    Exception code: 0xc0000005

    Fault offset: 0x0000000000340849

    Faulting process id: 0x4c

    Faulting application start time: 0x01cd8d1ad64a50fe

    Faulting application path: C:\Windows\explorer.exe

    Faulting module path: C:\Windows\System32\twinui.dll

    Report Id: 349721e8-f91b-11e1-be6a-d03a544d1928

    Faulting package full name:

    Faulting package-relative application ID:

    --------------------------------------------------

    Microsoft (R) Windows Debugger Version 6.2.9200.16384 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\LocalDumps\explorer.exe.76.dmp]
    User Mini Dump File with Full Memory: Only application data is available

    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\LocalDumps
    Windows 8 Version 9200 MP (4 procs) Free x64
    Product: WinNt, suite: SingleUserTS
    Built by: 6.2.9200.16384 (win8_rtm.120725-1247)
    Machine Name:
    Debug session time: Fri Sep  7 14:38:26.000 2012 (UTC - 4:00)
    System Uptime: 0 days 4:11:14.585
    Process Uptime: 0 days 1:34:00.000
    ................................................................
    ................................................................
    ................................................................
    ............................
    Loading unloaded module list
    ................................................................
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (4c.17a0): Access violation - code c0000005 (first/second chance not available)
    ntdll!NtWaitForMultipleObjects+0xa:
    000007ff`514a315b c3              ret
    0:004> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************

    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for sppc.dll -
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for dlumd64.dll -

    FAULTING_IP:
    twinui!CApplicationManager::_TryChangeSystemModeDesktop+29 [d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cpp @ 4999]
    000007ff`3c8f0849 488b07          mov     rax,qword ptr [rdi]

    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 000007ff3c8f0849 (twinui!CApplicationManager::_TryChangeSystemModeDesktop+0x0000000000000029)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000000
    Attempt to read from address 0000000000000000

    DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

    PROCESS_NAME:  explorer.exe

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1:  0000000000000000

    EXCEPTION_PARAMETER2:  0000000000000000

    READ_ADDRESS:  0000000000000000

    FOLLOWUP_IP:
    twinui!CApplicationManager::_TryChangeSystemModeDesktop+29 [d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cpp @ 4999]
    000007ff`3c8f0849 488b07          mov     rax,qword ptr [rdi]

    NTGLOBALFLAG:  0

    APPLICATION_VERIFIER_FLAGS:  0

    APP:  explorer.exe

    FAULTING_LOCAL_VARIABLE_NAME:  hwndZbidDesktop

    MANAGED_STACK: !dumpstack -EE
    No export dumpstack found

    PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

    BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS

    LAST_CONTROL_TRANSFER:  from 000007ff3c9cddb5 to 000007ff3c8f0849

    STACK_TEXT: 
    00000000`03acf390 000007ff`3c9cddb5 : 00000000`03acf480 00000000`03acf500 00000000`00000001 00000000`00000001 : twinui!CApplicationManager::_TryChangeSystemModeDesktop+0x29
    00000000`03acf3e0 000007ff`3c5f544d : 00000000`0000001e 00000000`03acf540 00000000`00000000 00000000`00000000 : twinui!CApplicationManager::_HandleWindowChangedOwner+0x3d8955
    00000000`03acf440 000007ff`3c5b232a : 00000000`00000001 00000000`00050216 00000000`0000c02b 000007ff`3c5b1820 : twinui!CApplicationManager::OnShellHookMessage+0x426
    00000000`03acf720 000007ff`4f93171e : 00000000`00050216 00000000`0000c02b 00000000`0000001e 00000000`0036069e : twinui!CImmersiveWindowMessageService::s_MessageMsgWndProc+0x336
    00000000`03acf830 000007ff`4f9314d7 : 00000000`008311c0 00000000`03acf9a0 000007f7`579e6800 000007ff`3c5b1ff0 : user32!UserCallWinProcCheckWow+0x13a
    00000000`03acf8f0 000007ff`4b981264 : 00000000`0046cfa0 00000000`0046cfa0 00000000`00000000 00000000`00000000 : user32!DispatchMessageWorker+0x1a7
    00000000`03acf970 000007ff`4b9835c0 : 00000000`00000045 00000000`00466d40 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!CImmersiveShellController::_ImmersiveShellComponentsThreadProcInternal+0x2a6
    00000000`03acfa10 000007ff`4f7f167e : 000007ff`4b980000 00000000`00000000 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!CImmersiveShellController::s_ImmersiveShellComponentsThreadProc+0x75
    00000000`03acfa40 000007ff`514bc3f1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x1a
    00000000`03acfa70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d


    STACK_COMMAND:  ~4s; .ecxr ; kb

    FAULTING_SOURCE_LINE:  d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cpp

    FAULTING_SOURCE_FILE:  d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cpp

    FAULTING_SOURCE_LINE_NUMBER:  4999

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  twinui!CApplicationManager::_TryChangeSystemModeDesktop+29

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: twinui

    IMAGE_NAME:  twinui.dll

    DEBUG_FLR_IMAGE_TIMESTAMP:  50109442

    FAILURE_BUCKET_ID:  WRONG_SYMBOLS_c0000005_twinui.dll!CApplicationManager::_TryChangeSystemModeDesktop

    BUCKET_ID:  APPLICATION_FAULT_WRONG_SYMBOLS_twinui!CApplicationManager::_TryChangeSystemModeDesktop+29

    WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/explorer_exe/6_2_9200_16384/50107dbc/twinui_dll/6_2_9200_16384/50109442/c0000005/00340849.htm?Retriage=1

    Followup: MachineOwner
    ---------

    0:004> lmvm twinui
    start             end                 module name
    000007ff`3c5b0000 000007ff`3cf57000   twinui     (private pdb symbols)  c:\symbols\twinui.pdb\4F7F380EBAD34576834CB628C754C82E2\twinui.pdb
        Loaded symbol image file: twinui.dll
        Image path: C:\Windows\System32\twinui.dll
        Image name: twinui.dll
        Timestamp:        Wed Jul 25 20:50:10 2012 (50109442)
        CheckSum:         009A014E
        ImageSize:        009A7000
        File version:     6.2.9200.16384
        Product version:  6.2.9200.16384
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     TWINUI
        OriginalFilename: TWINUI.dll
        ProductVersion:   6.2.9200.16384
        FileVersion:      6.2.9200.16384 (win8_rtm.120725-1247)
        FileDescription:  TWINUI
        LegalCopyright:   © Microsoft Corporation. All rights reserved.


    http://wp7wonders.wordpress.com/


    Friday, September 07, 2012 7:02 PM

Answers

  • Hello,

    Thank you. I have pinpointed the cause to the newer Intel graphics drivers. So I have blocked them in Windows Update until the GA of Windows 8 in October (and since I have a MacBook Air, Apple release a new version bootcamp as well).

    Thank you again for your answer.

    Matthieu


    http://wp7wonders.wordpress.com/

    Saturday, September 15, 2012 6:54 PM

All replies

  • Hi,

    If the issue occurred after installing some applications recently, you can perform system restore for a test. Meanwhile, you can use ShellExView to check third party shell.

    Please Note: The third-party product discussed here is manufactured by a company that is independent of Microsoft. We make no warranty, implied or otherwise, regarding this product's performance or reliability.

    1.      Right-click the "shexview.zip" file, select "Extract All", the Extraction Wizard will prompt.
    2.      Click Next, input "C:\ShellExView" (without the quotation marks) in the "Files will be extracted to this directory" textbox.
    3.      Click Next and click Finnish.
    4.      Open the "C:\ShellExView" folder and double-click the "shexview.exe" file. It will scan the registry for all the shell extensions.
    5.      Select all the non-Microsoft extensions in pink by press "Ctrl" in the keyboard.
    6.      Click the "Disable Selected Items" on the toolbar and click Yes.
    7.      Restart your computer and check if the issue is resolved.

    Niki Han

    TechNet Community Support

    Tuesday, September 11, 2012 6:34 AM
  • Hello Niki,

    Thank you but I tried to use SheellExView before and it seems from the dump analysis it doesn't come from there (and I have no shell extension installed). I uninstalled the drivers coming with dlumd64.dll and I still got the crash. This times no external component seems to be related


    Microsoft (R) Windows Debugger Version 6.2.9200.16384 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\LocalDumps\explorer.exe.4752.dmp]
    User Mini Dump File with Full Memory: Only application data is available

    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\LocalDumps
    Windows 8 Version 9200 MP (4 procs) Free x64
    Product: WinNt, suite: SingleUserTS
    Built by: 6.2.9200.16384 (win8_rtm.120725-1247)
    Machine Name:
    Debug session time: Tue Sep 11 17:00:54.000 2012 (UTC - 4:00)
    System Uptime: 0 days 8:15:22.078
    Process Uptime: 0 days 1:11:26.000
    ................................................................
    ................................................................
    ................................................................
    .........................
    Loading unloaded module list
    ................................................................
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (1290.1b40): Access violation - code c0000005 (first/second chance not available)
    ntdll!NtWaitForMultipleObjects+0xa:
    000007fd`f19c315b c3              ret
    0:004> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************

    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for sppc.dll -

    FAULTING_IP:
    twinui!CApplicationManager::_TryChangeSystemModeDesktop+29 [d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cpp @ 4999]
    000007fd`db400849 488b07          mov     rax,qword ptr [rdi]

    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 000007fddb400849 (twinui!CApplicationManager::_TryChangeSystemModeDesktop+0x0000000000000029)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000000
    Attempt to read from address 0000000000000000

    DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

    PROCESS_NAME:  explorer.exe

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1:  0000000000000000

    EXCEPTION_PARAMETER2:  0000000000000000

    READ_ADDRESS:  0000000000000000

    FOLLOWUP_IP:
    twinui!CApplicationManager::_TryChangeSystemModeDesktop+29 [d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cpp @ 4999]
    000007fd`db400849 488b07          mov     rax,qword ptr [rdi]

    NTGLOBALFLAG:  2000100

    APPLICATION_VERIFIER_FLAGS:  48004

    APP:  explorer.exe

    FAULTING_LOCAL_VARIABLE_NAME:  reason

    MANAGED_STACK: !dumpstack -EE
    No export dumpstack found

    PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

    BUGCHECK_STR:  APPLICATION_FAULT_WRONG_SYMBOLS

    LAST_CONTROL_TRANSFER:  from 000007fddb4dddb5 to 000007fddb400849

    STACK_TEXT: 
    00000000`09aff330 000007fd`db4dddb5 : 00000000`09aff420 00000000`09aff400 00000000`00000001 00000000`00000001 : twinui!CApplicationManager::_TryChangeSystemModeDesktop+0x29
    00000000`09aff380 000007fd`db10544d : 00000000`0000001e 00000000`09aff4e0 00000000`00000000 00000000`00000003 : twinui!CApplicationManager::_HandleWindowChangedOwner+0x3d8955
    00000000`09aff3e0 000007fd`db0c232a : 00000000`0872dcf0 00000000`0874f2e8 00000000`0000c02b 000007fd`db0c1820 : twinui!CApplicationManager::OnShellHookMessage+0x426
    00000000`09aff6c0 000007fd`efd4171e : 00000000`0002016c 00000000`0000c02b 00000000`0000001e 00000000`00b508ee : twinui!CImmersiveWindowMessageService::s_MessageMsgWndProc+0x336
    00000000`09aff7d0 000007fd`efd414d7 : 00000000`05606c60 00000000`09aff940 000007f7`be2f6800 000007fd`db0c1ff0 : user32!UserCallWinProcCheckWow+0x13a
    00000000`09aff890 000007fd`ebc21264 : 00000000`0872c340 00000000`0872c340 00000000`00000000 00000000`00000000 : user32!DispatchMessageWorker+0x1a7
    00000000`09aff910 000007fd`ebc235c0 : 00000000`00000045 00000000`0872c3f0 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!CImmersiveShellController::_ImmersiveShellComponentsThreadProcInternal+0x2a6
    00000000`09aff9b0 000007fd`dc66653d : 000007fd`ebc20000 00000000`00000000 00000000`00000000 00000000`00000000 : windows_immersiveshell_serviceprovider!CImmersiveShellController::s_ImmersiveShellComponentsThreadProc+0x75
    00000000`09aff9e0 000007fd`ef26167e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : verifier!AVrfpStandardThreadFunction+0x3d
    00000000`09affa20 000007fd`f19dc3f1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x1a
    00000000`09affa50 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d


    STACK_COMMAND:  ~4s; .ecxr ; kb

    FAULTING_SOURCE_LINE:  d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cpp

    FAULTING_SOURCE_FILE:  d:\w8rtm\shell\twinui\appmanager\lib\appmanager.cpp

    FAULTING_SOURCE_LINE_NUMBER:  4999

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  twinui!CApplicationManager::_TryChangeSystemModeDesktop+29

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: twinui

    IMAGE_NAME:  twinui.dll

    DEBUG_FLR_IMAGE_TIMESTAMP:  50109442

    FAILURE_BUCKET_ID:  WRONG_SYMBOLS_c0000005_twinui.dll!CApplicationManager::_TryChangeSystemModeDesktop

    BUCKET_ID:  APPLICATION_FAULT_WRONG_SYMBOLS_twinui!CApplicationManager::_TryChangeSystemModeDesktop+29

    WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/explorer_exe/6_2_9200_16384/50107dbc/twinui_dll/6_2_9200_16384/50109442/c0000005/00340849.htm?Retriage=1

    Followup: MachineOwner
    ---------

     


    http://wp7wonders.wordpress.com/

    Tuesday, September 11, 2012 9:13 PM
  • Hi,

    Your question falls into the paid support category which requires a more in-depth level of support. Please visit the below link to see the various paid support options that are available to better meet your needs. http://support.microsoft.com/default.aspx?id=fh;en-us;offerprophone

    After you open a case, we'll help to debug the root cause of the explorer crash issue. Thanks for your understanding.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Friday, September 14, 2012 10:54 AM
  • Mattieu

    Before you give up on the forum, download, unzip it and run Process Monitor version 3.03 (it doesn’t need installing), from here http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx 

    Because of the huge number of activities, it can be made easier to understand by de-selecting some of the activities. The activities can be toggled on/off by clicking them on the Toolbar, they are Registry, File, Networking, Processes/Threads and Profiling. Also, click Autoscroll on the Toolbar to see the current real-time events.


    • Edited by BurrWalnut Saturday, September 15, 2012 5:31 PM
    Saturday, September 15, 2012 5:08 PM
  • Hello,

    Thank you. I have pinpointed the cause to the newer Intel graphics drivers. So I have blocked them in Windows Update until the GA of Windows 8 in October (and since I have a MacBook Air, Apple release a new version bootcamp as well).

    Thank you again for your answer.

    Matthieu


    http://wp7wonders.wordpress.com/

    Saturday, September 15, 2012 6:54 PM
  • I'm having the same problem with Win 8 Enterprise. Explorer.exe crashes any time I try and view all apps from the start screen. The application event log shows the following:

    Faulting application name: Explorer.EXE, version: 6.2.9200.16384, time stamp: 0x50107dbc

    Faulting module name: twinui.dll, version: 6.2.9200.16420, time stamp: 0x505aa9a3

    Exception code: 0xc0000005

    Fault offset: 0x000000000042c1d1

    Faulting process id: 0xd0c

    Faulting application start time: 0x01cdac13a667edfd

    Faulting application path: C:\WINDOWS\Explorer.EXE

    Faulting module path: C:\Windows\System32\twinui.dll

    Report Id: 54fa7a32-1808-11e2-bea0-60eb69147d47

    Faulting package full name:

    Faulting package-relative application ID:

    Wednesday, October 17, 2012 3:16 AM
  • Yes I got the same one again on the 13/10 because a new version of the Intel HD4000 Graphic drivers has been released. I uninstalled them (both in the device manager console and in the programs) and now the crash is not occurring anymore. Waiting for the official ones from Apple ...

    http://wp7wonders.wordpress.com/

    Wednesday, October 17, 2012 12:28 PM
  • Went back and systematically uninstalled all non-Windows defender updates for Windows 8. Turns out the big update (KB2756872) broke the start screen. Once I uninstalled it, no more twinui.dll crashes. Seems like a short term fix, as I now more updates will come, but at least I'm functional now.
    • Proposed as answer by Spartaco73 Friday, November 02, 2012 2:07 AM
    Wednesday, October 17, 2012 9:13 PM
  • Hello,

    I have an ATI graphics card installed explorer keep closing every two mins.. if you check the event viewer. some application is causing this problem. in safe mode to it has the same problem. I have upgraded from windows 7 to windows 8. my activation is failing now I have head of a toe trouble.

    Let me know what all you need.....

    Faulting application name: explorer.exe, version: 6.2.9200.16384, time stamp: 0x50107d1c
    Faulting module name: MediaShellOverlays.dll_unloaded, version: 0.0.0.0, time stamp: 0x4ff471b8
    Exception code: 0xc0000005
    Fault offset: 0x6afbc258
    Faulting process id: 0xcec
    Faulting application start time: 0x01cdb00403a7022e
    Faulting application path: C:\WINDOWS\explorer.exe
    Faulting module path: MediaShellOverlays.dll
    Report Id: 8b462a4a-1bf7-11e2-afa8-0016cff9cc2d
    Faulting package full name:
    Faulting package-relative application ID:

     

    + System

      - Provider

       [ Name]  Application Error
     
      - EventID 1000

       [ Qualifiers]  0
     
       Level 2
     
       Task 100
     
       Keywords 0x80000000000000
     
      - TimeCreated

       [ SystemTime]  2012-10-22T03:21:19.000000000Z
     
       EventRecordID 4583
     
       Channel Application
     
       Computer Lovy_Dovy-PC
     
       Security

    - EventData

       explorer.exe
       6.2.9200.16384
       50107d1c
       MediaShellOverlays.dll_unloaded
       0.0.0.0
       4ff471b8
       c0000005
       6afbc258
       cec
       01cdb00403a7022e
       C:\WINDOWS\explorer.exe
       MediaShellOverlays.dll
       8b462a4a-1bf7-11e2-afa8-0016cff9cc2d


    Jude


    • Edited by Jude Edward Monday, October 22, 2012 3:36 AM
    Monday, October 22, 2012 3:36 AM
  • Hello,

    I have an ATI graphics card installed explorer keep closing every two mins..

    Faulting application name: explorer.exe, version: 6.2.9200.16384, time stamp: 0x50107d1c
    Faulting module name: MediaShellOverlays.dll_unloaded, version: 0.0.0.0, time stamp: 0x4ff471b8

    In your case the Explorer crashes because of the file MediaShellOverlays.dll. Update or remove the tools which installs this file.

    "A programmer is just a tool which converts caffeine into code"

    Monday, October 22, 2012 8:11 AM
  • I had the same issue and uninstalling (and then hiding) update KB2756872 solved it.
    Friday, October 26, 2012 8:06 PM
  • I had the same issue and uninstalling (and then hiding) update KB2756872 solved it.

    the users had the issue with the RTM, too, so long time before this update was created.

    "A programmer is just a tool which converts caffeine into code"

    Sunday, October 28, 2012 12:37 PM