none
Internet Explorer 11 (No addon) Crash Application Erro 1000 iexplorer.exe RRS feed

  • Question

  • Dear all,

    on our RDS server 2008 R2 we have a problem with internet explorer 11.0.9600.18314 .

    After 5-6 new page Internet Explorer crash . In event viewer we have this error:

    Faulting application name: IEXPLORE.EXE, version: 11.0.9600.18315, time stamp: 0x571ae616

    Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000

    Exception code: 0xc0000005

    Fault offset: 0x05048833

    Faulting process id: 0x1bcc

    Faulting application start time: 0x01d1bbffa8cff88a

    Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

    Faulting module path: unknown

    When I execute with no add on "iexplore.exe -extoff" we have a same problem.

    My server is full patched, and Acrobat Reader, Flash player and silverlight is up to date .

    Thanks for tour help.

    Wednesday, June 1, 2016 12:42 PM

Answers

All replies

  • When I execute with no add on "iexplore.exe -extoff" we have a same problem.

    That means it is not an add-on which otherwise works by the rules which is causing the problem.  So, you need to go further in trying to identify one.  Google toolbar was an example interferer which could not be stopped by using No Add-ons mode.  (I don't know if it still is.)  Try booting in safe mode and see if the symptom can still be reproduced then.  If not you can compare what is being loaded in each case.  One method would be to use ResMon for its Associated Modules list.  Even if it still does occur in safe mode you should then have a much smaller list of programs to try to avoid loading with IE.  Also, you can use SysInternals AutoRuns utility (available from TechNet) to try to identify what is being loaded when and why.

    Good luck



    Robert Aldwinckle
    ---

    Wednesday, June 1, 2016 2:29 PM
    Answerer
  • Also, it may help to see what modules are loading during the crash.

    Can you download and run the following application (AppCrashView):

    http://www.nirsoft.net/utils/app_crash_view.html

    Click on one of the recent iexplore.exe errors.

    Can you copy and paste the information that appears in the lower window that has loaded modules.

    Wednesday, June 1, 2016 2:50 PM
  • Dear thanks for your answer below the log :

    Version=1
    EventType=BEX
    EventTime=131093305156090852
    ReportType=2
    Consent=1
    ReportIdentifier=dbe5be51-289d-11e6-8251-02bfc0a8e63f
    IntegratorReportIdentifier=dbe5be50-289d-11e6-8251-02bfc0a8e63f
    WOW64=1
    Response.type=4
    Sig[0].Name=Application Name
    Sig[0].Value=IEXPLORE.EXE
    Sig[1].Name=Application Version
    Sig[1].Value=11.0.9600.18315
    Sig[2].Name=Application Timestamp
    Sig[2].Value=571ae616
    Sig[3].Name=Fault Module Name
    Sig[3].Value=StackHash_0a9e
    Sig[4].Name=Fault Module Version
    Sig[4].Value=0.0.0.0
    Sig[5].Name=Fault Module Timestamp
    Sig[5].Value=00000000
    Sig[6].Name=Exception Offset
    Sig[6].Value=00000002
    Sig[7].Name=Exception Code
    Sig[7].Value=c0000005
    Sig[8].Name=Exception Data
    Sig[8].Value=00000008
    DynamicSig[1].Name=OS Version
    DynamicSig[1].Value=6.1.7601.2.1.0.144.8
    DynamicSig[2].Name=Locale ID
    DynamicSig[2].Value=2060
    DynamicSig[22].Name=Additional Information 1
    DynamicSig[22].Value=0a9e
    DynamicSig[23].Name=Additional Information 2
    DynamicSig[23].Value=0a9e372d3b4ad19135b953a78882e789
    DynamicSig[24].Name=Additional Information 3
    DynamicSig[24].Value=0a9e
    DynamicSig[25].Name=Additional Information 4
    DynamicSig[25].Value=0a9e372d3b4ad19135b953a78882e789
    UI[2]=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    UI[3]=Internet Explorer has stopped working
    UI[4]=Windows can check online for a solution to the problem.
    UI[5]=Check online for a solution and close the program
    UI[6]=Check online for a solution later and close the program
    UI[7]=Close the program
    LoadedModule[0]=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    LoadedModule[1]=C:\Windows\SysWOW64\ntdll.dll
    LoadedModule[2]=C:\Windows\syswow64\kernel32.dll
    LoadedModule[3]=C:\Windows\syswow64\KERNELBASE.dll
    LoadedModule[4]=C:\Program Files\Microsoft Application Virtualization\Client\Subsystems\AppVEntSubsystems32.dll
    LoadedModule[5]=C:\Windows\syswow64\USER32.dll
    LoadedModule[6]=C:\Windows\syswow64\GDI32.dll
    LoadedModule[7]=C:\Windows\syswow64\LPK.dll
    LoadedModule[8]=C:\Windows\syswow64\USP10.dll
    LoadedModule[9]=C:\Windows\syswow64\msvcrt.dll
    LoadedModule[10]=C:\Windows\syswow64\ADVAPI32.dll
    LoadedModule[11]=C:\Windows\SysWOW64\sechost.dll
    LoadedModule[12]=C:\Windows\syswow64\RPCRT4.dll
    LoadedModule[13]=C:\Windows\syswow64\SspiCli.dll
    LoadedModule[14]=C:\Windows\syswow64\CRYPTBASE.dll
    LoadedModule[15]=C:\Windows\syswow64\SHELL32.dll
    LoadedModule[16]=C:\Windows\syswow64\SHLWAPI.dll
    LoadedModule[17]=C:\Windows\syswow64\ole32.dll
    LoadedModule[18]=C:\Windows\syswow64\USERENV.dll
    LoadedModule[19]=C:\Windows\syswow64\profapi.dll
    LoadedModule[20]=C:\Windows\system32\VERSION.dll
    LoadedModule[21]=C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
    LoadedModule[22]=C:\Windows\syswow64\iertutil.dll
    LoadedModule[23]=C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
    LoadedModule[24]=C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
    LoadedModule[25]=C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
    LoadedModule[26]=C:\Windows\syswow64\normaliz.DLL
    LoadedModule[27]=C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    LoadedModule[28]=C:\Windows\system32\IMM32.DLL
    LoadedModule[29]=C:\Windows\syswow64\MSCTF.dll
    LoadedModule[30]=C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
    LoadedModule[31]=C:\Windows\system32\IEFRAME.dll
    LoadedModule[32]=C:\Windows\syswow64\OLEAUT32.dll
    LoadedModule[33]=C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.23403_none_2b180b30457f196c\comctl32.dll
    LoadedModule[34]=C:\Program Files (x86)\Internet Explorer\IEShims.dll
    LoadedModule[35]=C:\Windows\syswow64\comdlg32.dll
    LoadedModule[36]=C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
    FriendlyEventName=Stopped working
    ConsentKey=BEX
    AppName=Internet Explorer
    AppPath=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

    and this

    Version=1
    EventType=AppHangB1
    EventTime=131092570643859434
    ReportType=3
    Consent=1
    ReportIdentifier=d78500ca-27f2-11e6-8b70-02bfc0a8e63f
    IntegratorReportIdentifier=d78500cb-27f2-11e6-8b70-02bfc0a8e63f
    Response.type=4
    Sig[0].Name=Application Name
    Sig[0].Value=iexplore.exe
    Sig[1].Name=Application Version
    Sig[1].Value=11.0.9600.18315
    Sig[2].Name=Application Timestamp
    Sig[2].Value=571aea6f
    Sig[3].Name=Hang Signature
    Sig[3].Value=828d
    Sig[4].Name=Hang Type
    Sig[4].Value=0
    DynamicSig[1].Name=OS Version
    DynamicSig[1].Value=6.1.7601.2.1.0.144.8
    DynamicSig[2].Name=Locale ID
    DynamicSig[2].Value=2060
    DynamicSig[22].Name=Additional Hang Signature 1
    DynamicSig[22].Value=828d47a5b25c3e9c98fcebcc40204899
    DynamicSig[23].Name=Additional Hang Signature 2
    DynamicSig[23].Value=ef09
    DynamicSig[24].Name=Additional Hang Signature 3
    DynamicSig[24].Value=ef09704d1b4ee9696b7fec182497806b
    DynamicSig[25].Name=Additional Hang Signature 4
    DynamicSig[25].Value=828d
    DynamicSig[26].Name=Additional Hang Signature 5
    DynamicSig[26].Value=828d47a5b25c3e9c98fcebcc40204899
    DynamicSig[27].Name=Additional Hang Signature 6
    DynamicSig[27].Value=ef09
    DynamicSig[28].Name=Additional Hang Signature 7
    DynamicSig[28].Value=ef09704d1b4ee9696b7fec182497806b
    UI[3]=Internet Explorer is not responding
    UI[4]=Windows can check online for a solution. If you close the program, you might lose information.
    UI[5]=Check for a solution and close the program
    UI[6]=Check for a solution and close the program
    UI[7]=Close the program
    LoadedModule[0]=C:\Program Files\Internet Explorer\IEXPLORE.EXE
    LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
    LoadedModule[2]=C:\Windows\system32\kernel32.dll
    LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll
    LoadedModule[4]=C:\Program Files\Microsoft Application Virtualization\Client\Subsystems\AppVEntSubsystems64.dll
    LoadedModule[5]=C:\Windows\system32\USER32.dll
    LoadedModule[6]=C:\Windows\system32\GDI32.dll
    LoadedModule[7]=C:\Windows\system32\LPK.dll
    LoadedModule[8]=C:\Windows\system32\USP10.dll
    LoadedModule[9]=C:\Windows\system32\msvcrt.dll
    LoadedModule[10]=C:\Windows\system32\ADVAPI32.dll
    LoadedModule[11]=C:\Windows\SYSTEM32\sechost.dll
    LoadedModule[12]=C:\Windows\system32\RPCRT4.dll
    LoadedModule[13]=C:\Windows\system32\SHELL32.dll
    LoadedModule[14]=C:\Windows\system32\SHLWAPI.dll
    LoadedModule[15]=C:\Windows\system32\ole32.dll
    LoadedModule[16]=C:\Windows\system32\USERENV.dll
    LoadedModule[17]=C:\Windows\system32\profapi.dll
    LoadedModule[18]=C:\Windows\system32\VERSION.dll
    LoadedModule[19]=C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
    LoadedModule[20]=C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
    LoadedModule[21]=C:\Windows\system32\iertutil.dll
    LoadedModule[22]=C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
    LoadedModule[23]=C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
    LoadedModule[24]=C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
    LoadedModule[25]=C:\Windows\system32\normaliz.DLL
    LoadedModule[26]=C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    LoadedModule[27]=C:\Windows\system32\IMM32.DLL
    LoadedModule[28]=C:\Windows\system32\MSCTF.dll
    LoadedModule[29]=C:\Windows\system32\CRYPTBASE.DLL
    LoadedModule[30]=C:\Windows\system32\IEFRAME.dll
    LoadedModule[31]=C:\Windows\system32\OLEAUT32.dll
    LoadedModule[32]=C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.23403_none_e36ad4593102f066\comctl32.dll
    LoadedModule[33]=C:\Program Files\Internet Explorer\IEShims.dll
    LoadedModule[34]=C:\Windows\system32\comdlg32.dll
    LoadedModule[35]=C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
    LoadedModule[36]=C:\Windows\system32\urlmon.dll
    LoadedModule[37]=C:\Windows\system32\WININET.dll
    LoadedModule[38]=C:\Windows\system32\Secur32.dll
    LoadedModule[39]=C:\Windows\system32\SSPICLI.DLL
    LoadedModule[40]=C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
    LoadedModule[41]=C:\Windows\system32\WS2_32.dll
    LoadedModule[42]=C:\Windows\system32\NSI.dll
    LoadedModule[43]=C:\Windows\system32\mswsock.dll
    LoadedModule[44]=C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
    LoadedModule[45]=C:\Windows\System32\wship6.dll
    LoadedModule[46]=C:\Windows\system32\IPHLPAPI.DLL
    LoadedModule[47]=C:\Windows\system32\WINNSI.DLL
    LoadedModule[48]=C:\Windows\system32\CLBCatQ.DLL
    LoadedModule[49]=C:\Windows\System32\netprofm.dll
    LoadedModule[50]=C:\Windows\System32\nlaapi.dll
    LoadedModule[51]=C:\Windows\system32\CRYPTSP.dll
    LoadedModule[52]=C:\Windows\system32\rsaenh.dll
    LoadedModule[53]=C:\Windows\system32\RpcRtRemote.dll
    LoadedModule[54]=C:\Windows\System32\npmproxy.dll
    LoadedModule[55]=C:\Program Files\Internet Explorer\ieproxy.dll
    LoadedModule[56]=C:\Windows\system32\NETAPI32.dll
    LoadedModule[57]=C:\Windows\system32\netutils.dll
    LoadedModule[58]=C:\Windows\system32\srvcli.dll
    LoadedModule[59]=C:\Windows\system32\wkscli.dll
    LoadedModule[60]=C:\Windows\system32\apphelp.dll
    LoadedModule[61]=C:\Windows\System32\mshtml.dll
    LoadedModule[62]=C:\Windows\system32\CRYPT32.dll
    LoadedModule[63]=C:\Windows\system32\MSASN1.dll
    LoadedModule[64]=C:\Windows\system32\IEUI.dll
    LoadedModule[65]=C:\Windows\system32\UxTheme.dll
    LoadedModule[66]=C:\Windows\system32\PROPSYS.dll
    LoadedModule[67]=C:\Windows\system32\mssprxy.dll
    LoadedModule[68]=C:\Windows\system32\oleacc.dll
    LoadedModule[69]=C:\Windows\system32\windowscodecs.dll
    LoadedModule[70]=C:\Windows\system32\dwmapi.dll
    LoadedModule[71]=C:\Windows\system32\explorerframe.dll
    LoadedModule[72]=C:\Windows\system32\DUser.dll
    LoadedModule[73]=C:\Windows\system32\DUI70.dll
    FriendlyEventName=Stopped responding and was closed
    ConsentKey=AppHangXProcB1
    AppName=Internet Explorer
    AppPath=C:\Program Files\Internet Explorer\iexplore.exe
    ReportDescription=A problem caused this program to stop interacting with Windows.

    Thursday, June 2, 2016 8:53 AM
  • I don't see a particular problematic module so what I might suggest is to capture a user mode dump of a crash and see what is shows. it may be show a problematic "unloaded" module.

    You can configure Windows to create user-mode dumps. 

    If you copy and paste the following in Notepad and save as a .reg file (save with the .reg extension and give it any name such as iedump.reg), then right-click the .reg file and select "Merge" to add to the registry, a .dmp file at the time iexplore.exe crashes should be created in the C:\CrashDumps folder:

    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\iexplore.exe]
    "DumpFolder"=hex(2):43,00,3a,00,5c,00,43,00,72,00,61,00,73,00,68,00,44,00,75,\
    00,6d,00,70,00,73,00,00,00


    After Internet Explorer (iexplore.exe) crashes, can you then make the .dmp file available (provide link) via a public folder on OneDrive (SkyDrive) or similar site?

    Here's a couple of links on using OneDrive (SkyDrive):

    http://windows.microsoft.com/en-ca/skydrive/add-photos-files-faq

    http://windows.microsoft.com/en-ca/onedrive/share-file-folder

    More info on collecting user-mode dumps:

    http://msdn.microsoft.com/en-us/library/bb787181(VS.85).aspx

    To stop the creation of the user mode dump files run the following registry file:

    Windows Registry Editor Version 5.00

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\iexplore.exe]

    You can delete the C:\CrashDumps folder anytime.

     
    Thursday, June 2, 2016 9:16 AM
  • Hi Tan’s,

     

    I noticed that when you tried no add-on but the problem still persists. I suppose that there is something wrong with IE.

     

    First we may try SFC tools for system file corruption.

    https://support.microsoft.com/en-us/kb/929833

     

    Then we may try IE troubleshooting tools and check the result.

    https://support.microsoft.com/en-us/mats/ie_performance_and_safety?wa=wsignin1.0

     

    If the problem still persists, I’m afraid we need to reset IE.

    Change or reset Internet Explorer settings:

    http://windows.microsoft.com/en-sg/internet-explorer/reset-ie-settings#ie=ie-11

     

    If reset IE still doesn’t work, try new user account.

     

    Best Regards,

    Tao


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Thursday, June 2, 2016 11:20 AM
    Moderator
  • Dear Auggy,

    the files is on one drive : https://1drv.ms/f/s!An_MaIcoiDMAgVKVTtrF0rFGpofP

    Thanks.

    Thursday, June 2, 2016 12:26 PM
  • Dear Tony Tao,

    we have reset and uninstall IE11 and we have a same problem and when I can start sfc /scannow we have this logs : https://1drv.ms/f/s!An_MaIcoiDMAgVKVTtrF0rFGpofP

    Thanks.

    Thursday, June 2, 2016 1:13 PM
  • The error appears to be caused by the AppVEntSubsystems32.dll :

    Unable to load image C:\Program Files\Microsoft Application Virtualization\Client\Subsystems\AppVEntSubsystems32.dll, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for AppVEntSubsystems32.dll
    Probably caused by : AppVEntSubsystems32.dll ( appventsubsystems32!ShimEngineCleanup+1a )

    Here is some info on the AppVEntSubsystems32.dll :

    0:001> lmvm AppVEntSubsystems32
    Browse full module list
    start    end        module name
    605d0000 607ec000   AppVEntSubsystems32 T (pdb symbols)          c:\symbols\AppVEntSubsystems32.pdb\4E3BA13983D3401692CD6DC3526601C42\AppVEntSubsystems32.pdb
        Loaded symbol image file: AppVEntSubsystems32.dll
       Image path: C:\Program Files\Microsoft Application Virtualization\Client\Subsystems\AppVEntSubsystems32.dll
        Image name: AppVEntSubsystems32.dll
        Browse all global symbols  functions  data
        Timestamp:        Wed Jul 22 21:27:45 2015 (55B04311)
        CheckSum:         0021B158
        ImageSize:        0021C000
        File version:     5.1.86.0
        Product version:  5.1.86.0
        File flags:       0 (Mask 3F)
        File OS:          4 Unknown Win32
        File type:        1.0 App
        File date:        00000000.00000000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

    As the AppVEntSubsystems32.dll is a component of Microsoft Application Virtualization you may benefit from installing the following hotfix :

    https://support.microsoft.com/en-ca/kb/3115834

    There is a link at the top of the article to request the hotfix.

    The hotfix information states that :

    Issue 3

    Internet Explorer crashes when you open multiple tabs.

    Thursday, June 2, 2016 9:45 PM
  • Dear Auggy,

    thanks for your analyse so the link is down for download hotfix:

    https://support.microsoft.com/en-us/kb/3115834 hotfix 1

    or

    https://support.microsoft.com/en-us/kb/3139245 hotfix 2

    can you tell me what software you have use for read dmp file.

    thanks for your help.



    • Edited by Tan's Friday, June 3, 2016 9:27 AM
    Friday, June 3, 2016 7:12 AM
  • The hotfixes are supposed to be cumulative so you could install hotfix 2 rather than hotfix 1.

    I use WinDbg (Windows Debugger) for user-mode dumps.

    Here is a good link on the basics for debugging in Windows 10:

    http://www.tenforums.com/tutorials/5558-windbg-basics-debugging-crash-dumps-windows-10-a.html

    The tutorial is for kernel-mode dumps however the  basic commands are the same for user-mode dumps such as !analyze and !analyze -v for detailed analysis, lmvm with the module name to get particulars about the module and lmtn to get a list of all modules.

    Saturday, June 4, 2016 8:58 PM
  • Dear Auggy,

    This morning the hotfix is available ...after install hotfix Internet explorer working normally again.

    Have a nice day thanks for all.

    Monday, June 6, 2016 12:03 PM
  • Glad to see IE is working now.

    Thanks for the follow-up.

    Monday, June 6, 2016 12:05 PM