none
Direct Input module crashes in IE 11 - Win 10 1703 and 1709 RRS feed

  • Question

  • I have several users having issues with IE constantly crashing. Faulting module is always the same. Reliability report shows same info on every crash. This is happening 5-20 times a day for the user. They get "Internet Explorer has stopped working" and then it reloads the application. 

    I updated the user to 1703 and then 1709 in an attempt to resolve the issue with no luck. I have reset IE multiple times with no impact. Workstations are 100% up to date on patches. 

    Event Viewer: 

    Faulting application name: IEXPLORE.EXE, version: 11.0.16299.15, time stamp: 0x091f43e7
    Faulting module name: dinput8.dll, version: 10.0.16299.15, time stamp: 0x536c18e7
    Exception code: 0xc0000005
    Fault offset: 0x0000ca5d
    Faulting process id: 0x1bb0
    Faulting application start time: 0x01d3571d5cf20d38
    Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    Faulting module path: C:\WINDOWS\system32\dinput8.dll
    Report Id: 0b461f4a-7d5e-49d0-8725-bebe752739c3
    Faulting package full name: 
    Faulting package-relative application ID: 

    Info from WER:

    Version=1
    EventType=APPCRASH
    EventTime=131546361999387550
    ReportType=2
    Consent=1
    UploadTime=131546362009842732
    ReportStatus=268435456
    ReportIdentifier=542b7a96-4de9-45f6-9890-8406103a1d3a
    IntegratorReportIdentifier=bccdc702-e7d4-4827-91a6-a179185667ae
    Wow64Host=34404
    Wow64Guest=332
    NsAppName=IEXPLORE.EXE
    AppSessionGuid=00000888-0001-000f-12fc-db21b858d301
    TargetAppId=W:0000f519feec486de87ed73cb92d3cac802400000000!0000955cda1d90e962d61384193479fd1da008aa919d!iexplore.exe
    TargetAppVer=1974//11//07:08:12:23!cdc05!iexplore.exe
    BootId=4294967295
    ServiceSplit=2237045635
    TargetAsId=1433
    Response.BucketId=14a50e193c3579a0945d902f5d0e53ce
    Response.BucketTable=1
    Response.LegacyBucketId=109177117620
    Response.type=4
    Sig[0].Name=Application Name
    Sig[0].Value=IEXPLORE.EXE
    Sig[1].Name=Application Version
    Sig[1].Value=11.0.16299.15
    Sig[2].Name=Application Timestamp
    Sig[2].Value=091f43e7
    Sig[3].Name=Fault Module Name
    Sig[3].Value=dinput8.dll
    Sig[4].Name=Fault Module Version
    Sig[4].Value=10.0.16299.15
    Sig[5].Name=Fault Module Timestamp
    Sig[5].Value=536c18e7
    Sig[6].Name=Exception Code
    Sig[6].Value=c0000005
    Sig[7].Name=Exception Offset
    Sig[7].Value=0000c677
    DynamicSig[1].Name=OS Version
    DynamicSig[1].Value=10.0.16299.2.0.0.256.48
    DynamicSig[2].Name=Locale ID
    DynamicSig[2].Value=1033
    DynamicSig[22].Name=Additional Information 1
    DynamicSig[22].Value=e2a5
    DynamicSig[23].Name=Additional Information 2
    DynamicSig[23].Value=e2a5934c14e66921972cbe137a4819ff
    DynamicSig[24].Name=Additional Information 3
    DynamicSig[24].Value=7b4e
    DynamicSig[25].Name=Additional Information 4
    DynamicSig[25].Value=7b4e0424b0c0dda2d79a0bf736b96ee9
    UI[2]=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    UI[3]=Internet Explorer has stopped working
    UI[4]=Windows can check online for a solution to the problem.
    UI[5]=Check online for a solution and close the program
    UI[6]=Check online for a solution later and close the program
    UI[7]=Close the program
    LoadedModule[0]=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    LoadedModule[1]=C:\WINDOWS\SYSTEM32\ntdll.dll
    LoadedModule[2]=C:\WINDOWS\System32\KERNEL32.dll
    LoadedModule[3]=C:\Windows\System32\hmpalert.dll
    LoadedModule[4]=C:\WINDOWS\System32\KERNELBASE.dll
    LoadedModule[5]=C:\WINDOWS\System32\ADVAPI32.dll
    LoadedModule[6]=C:\WINDOWS\System32\msvcrt.dll
    LoadedModule[7]=C:\WINDOWS\System32\sechost.dll
    LoadedModule[8]=C:\WINDOWS\System32\RPCRT4.dll
    LoadedModule[9]=C:\WINDOWS\System32\SspiCli.dll
    LoadedModule[10]=C:\WINDOWS\System32\CRYPTBASE.dll
    LoadedModule[11]=C:\WINDOWS\System32\bcryptPrimitives.dll
    LoadedModule[12]=C:\WINDOWS\SYSTEM32\apphelp.dll
    LoadedModule[13]=C:\WINDOWS\System32\USER32.dll
    LoadedModule[14]=C:\WINDOWS\System32\win32u.dll
    LoadedModule[15]=C:\WINDOWS\System32\GDI32.dll
    LoadedModule[16]=C:\WINDOWS\System32\gdi32full.dll
    LoadedModule[17]=C:\WINDOWS\System32\msvcp_win.dll
    LoadedModule[18]=C:\WINDOWS\System32\ucrtbase.dll
    LoadedModule[19]=C:\WINDOWS\System32\iertutil.dll
    LoadedModule[20]=C:\WINDOWS\System32\combase.dll
    LoadedModule[21]=C:\WINDOWS\System32\shcore.dll
    LoadedModule[22]=C:\WINDOWS\System32\IMM32.DLL
    LoadedModule[23]=C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL
    LoadedModule[24]=C:\WINDOWS\System32\PSAPI.DLL
    LoadedModule[25]=C:\WINDOWS\SYSTEM32\msIso.dll
    LoadedModule[26]=C:\WINDOWS\System32\kernel.appcore.dll
    LoadedModule[27]=C:\WINDOWS\SYSTEM32\IEFRAME.dll
    LoadedModule[28]=C:\WINDOWS\System32\SHLWAPI.dll
    LoadedModule[29]=C:\WINDOWS\System32\ole32.dll
    LoadedModule[30]=C:\WINDOWS\System32\OLEAUT32.dll
    LoadedModule[31]=C:\WINDOWS\System32\SHELL32.dll
    LoadedModule[32]=C:\WINDOWS\System32\cfgmgr32.dll
    LoadedModule[33]=C:\WINDOWS\System32\windows.storage.dll
    LoadedModule[34]=C:\WINDOWS\System32\powrprof.dll
    LoadedModule[35]=C:\WINDOWS\System32\profapi.dll
    LoadedModule[36]=C:\WINDOWS\SYSTEM32\NETAPI32.dll
    LoadedModule[37]=C:\WINDOWS\SYSTEM32\VERSION.dll
    LoadedModule[38]=C:\WINDOWS\SYSTEM32\NETUTILS.DLL
    LoadedModule[39]=C:\WINDOWS\SYSTEM32\WKSCLI.DLL
    LoadedModule[40]=C:\WINDOWS\SYSTEM32\bcrypt.dll
    LoadedModule[41]=C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.19_none_1440318736920367\comctl32.dll
    LoadedModule[42]=C:\Program Files (x86)\Internet Explorer\IEShims.dll
    LoadedModule[43]=C:\WINDOWS\System32\comdlg32.dll
    LoadedModule[44]=C:\WINDOWS\system32\uxtheme.dll
    LoadedModule[45]=C:\WINDOWS\System32\urlmon.dll
    LoadedModule[46]=C:\WINDOWS\System32\imagehlp.dll
    LoadedModule[47]=C:\WINDOWS\SYSTEM32\MSHTML.dll
    LoadedModule[48]=C:\WINDOWS\System32\clbcatq.dll
    LoadedModule[49]=C:\WINDOWS\System32\WININET.dll
    LoadedModule[50]=C:\WINDOWS\SYSTEM32\tokenbinding.dll
    LoadedModule[51]=C:\WINDOWS\System32\WS2_32.dll
    LoadedModule[52]=C:\WINDOWS\SYSTEM32\ondemandconnroutehelper.dll
    LoadedModule[53]=C:\WINDOWS\SYSTEM32\IPHLPAPI.DLL
    LoadedModule[54]=C:\WINDOWS\SYSTEM32\winhttp.dll
    LoadedModule[55]=C:\WINDOWS\system32\mswsock.dll
    LoadedModule[56]=C:\WINDOWS\SYSTEM32\WINNSI.DLL
    LoadedModule[57]=C:\WINDOWS\System32\NSI.dll
    LoadedModule[58]=C:\Windows\System32\ieproxy.dll
    LoadedModule[59]=C:\WINDOWS\system32\dwmapi.dll
    LoadedModule[60]=C:\WINDOWS\System32\MSCTF.dll
    LoadedModule[61]=C:\WINDOWS\SYSTEM32\d2d1.dll
    LoadedModule[62]=C:\WINDOWS\System32\CRYPT32.dll
    LoadedModule[63]=C:\WINDOWS\System32\MSASN1.dll
    LoadedModule[64]=C:\WINDOWS\SYSTEM32\ieapfltr.dll
    LoadedModule[65]=C:\WINDOWS\SYSTEM32\CRYPTSP.dll
    LoadedModule[66]=C:\WINDOWS\SYSTEM32\DWrite.dll
    LoadedModule[67]=C:\WINDOWS\SYSTEM32\dxgi.dll
    LoadedModule[68]=C:\WINDOWS\SYSTEM32\d3d11.dll
    LoadedModule[69]=C:\WINDOWS\System32\DriverStore\FileRepository\ki124064.inf_amd64_c15f53d05810a034\igd10iumd32.dll
    LoadedModule[70]=C:\WINDOWS\SYSTEM32\ncrypt.dll
    LoadedModule[71]=C:\WINDOWS\SYSTEM32\NTASN1.dll
    LoadedModule[72]=C:\WINDOWS\System32\DriverStore\FileRepository\ki124064.inf_amd64_c15f53d05810a034\igc32.dll
    LoadedModule[73]=C:\WINDOWS\system32\dataexchange.dll
    LoadedModule[74]=C:\WINDOWS\system32\dcomp.dll
    LoadedModule[75]=C:\WINDOWS\system32\twinapi.appcore.dll
    LoadedModule[76]=C:\WINDOWS\system32\RMCLIENT.dll
    LoadedModule[77]=C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll
    LoadedModule[78]=C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.19_none_2c2d4ca717b1155e\COMCTL32.dll
    LoadedModule[79]=C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll
    LoadedModule[80]=C:\Program Files (x86)\Java\jre1.8.0_111\bin\msvcr100.dll
    LoadedModule[81]=C:\WINDOWS\SYSTEM32\DPAPI.DLL
    LoadedModule[82]=C:\WINDOWS\System32\WINTRUST.dll
    LoadedModule[83]=C:\WINDOWS\system32\rsaenh.dll
    LoadedModule[84]=C:\WINDOWS\SYSTEM32\DNSAPI.dll
    LoadedModule[85]=C:\Program Files (x86)\Bonjour\mdnsNSP.dll
    LoadedModule[86]=C:\Windows\System32\rasadhlp.dll
    LoadedModule[87]=C:\WINDOWS\System32\fwpuclnt.dll
    LoadedModule[88]=C:\Windows\System32\OneCoreCommonProxyStub.dll
    LoadedModule[89]=C:\WINDOWS\System32\schannel.dll
    LoadedModule[90]=C:\WINDOWS\SYSTEM32\IEUI.dll
    LoadedModule[91]=C:\WINDOWS\SYSTEM32\mskeyprotect.dll
    LoadedModule[92]=C:\WINDOWS\system32\ncryptsslp.dll
    LoadedModule[93]=C:\Windows\System32\cryptnet.dll
    LoadedModule[94]=C:\WINDOWS\SYSTEM32\srpapi.dll
    LoadedModule[95]=C:\WINDOWS\SYSTEM32\ninput.dll
    LoadedModule[96]=C:\WINDOWS\SYSTEM32\Secur32.dll
    LoadedModule[97]=C:\WINDOWS\SYSTEM32\MLANG.dll
    LoadedModule[98]=C:\WINDOWS\SYSTEM32\PROPSYS.dll
    LoadedModule[99]=C:\WINDOWS\SYSTEM32\WLDP.DLL
    LoadedModule[100]=C:\WINDOWS\System32\IDStore.dll
    LoadedModule[101]=C:\WINDOWS\System32\SAMLIB.dll
    LoadedModule[102]=C:\WINDOWS\System32\wlidprov.dll
    LoadedModule[103]=C:\WINDOWS\System32\samcli.dll
    LoadedModule[104]=C:\WINDOWS\SYSTEM32\tbs.dll
    LoadedModule[105]=C:\WINDOWS\system32\msimtf.dll
    LoadedModule[106]=C:\WINDOWS\system32\directmanipulation.dll
    LoadedModule[107]=C:\Windows\System32\jscript9.dll
    LoadedModule[108]=C:\Windows\System32\Dxtrans.dll
    LoadedModule[109]=C:\Windows\System32\ATL.DLL
    LoadedModule[110]=C:\Windows\System32\ddrawex.dll
    LoadedModule[111]=C:\Windows\System32\DDRAW.dll
    LoadedModule[112]=C:\Windows\System32\DCIMAN32.dll
    LoadedModule[113]=C:\Windows\System32\Dxtmsft.dll
    LoadedModule[114]=C:\WINDOWS\SYSTEM32\sxs.dll
    LoadedModule[115]=C:\WINDOWS\SYSTEM32\msls31.dll
    LoadedModule[116]=C:\WINDOWS\system32\windowscodecs.dll
    LoadedModule[117]=C:\WINDOWS\SYSTEM32\WINMM.dll
    LoadedModule[118]=C:\WINDOWS\SYSTEM32\WINMMBASE.dll
    LoadedModule[119]=C:\Windows\System32\Macromed\Flash\Flash.ocx
    LoadedModule[120]=C:\WINDOWS\SYSTEM32\DSOUND.dll
    LoadedModule[121]=C:\WINDOWS\SYSTEM32\MSIMG32.dll
    LoadedModule[122]=C:\WINDOWS\SYSTEM32\UIAutomationCore.DLL
    LoadedModule[123]=C:\WINDOWS\SYSTEM32\mscms.dll
    LoadedModule[124]=C:\WINDOWS\SYSTEM32\USERENV.dll
    LoadedModule[125]=C:\WINDOWS\system32\dinput8.dll
    LoadedModule[126]=C:\WINDOWS\SYSTEM32\atlthunk.dll
    LoadedModule[127]=C:\WINDOWS\System32\MMDevApi.dll
    LoadedModule[128]=C:\WINDOWS\System32\DEVOBJ.dll
    LoadedModule[129]=C:\WINDOWS\System32\coml2.dll
    State[0].Key=Transport.DoneStage1
    State[0].Value=1
    OsInfo[0].Key=vermaj
    OsInfo[0].Value=10
    OsInfo[1].Key=vermin
    OsInfo[1].Value=0
    OsInfo[2].Key=verbld
    OsInfo[2].Value=16299
    OsInfo[3].Key=ubr
    OsInfo[3].Value=19
    OsInfo[4].Key=versp
    OsInfo[4].Value=0
    OsInfo[5].Key=arch
    OsInfo[5].Value=9
    OsInfo[6].Key=lcid
    OsInfo[6].Value=1033
    OsInfo[7].Key=geoid
    OsInfo[7].Value=244
    OsInfo[8].Key=sku
    OsInfo[8].Value=48
    OsInfo[9].Key=domain
    OsInfo[9].Value=1
    OsInfo[10].Key=prodsuite
    OsInfo[10].Value=256
    OsInfo[11].Key=ntprodtype
    OsInfo[11].Value=1
    OsInfo[12].Key=platid
    OsInfo[12].Value=10
    OsInfo[13].Key=sr
    OsInfo[13].Value=0
    OsInfo[14].Key=tmsi
    OsInfo[14].Value=18647
    OsInfo[15].Key=osinsty
    OsInfo[15].Value=1
    OsInfo[16].Key=iever
    OsInfo[16].Value=11.15.16299.0-11.0.47
    OsInfo[17].Key=portos
    OsInfo[17].Value=0
    OsInfo[18].Key=ram
    OsInfo[18].Value=16248
    OsInfo[19].Key=svolsz
    OsInfo[19].Value=224
    OsInfo[20].Key=wimbt
    OsInfo[20].Value=0
    OsInfo[21].Key=blddt
    OsInfo[21].Value=170928
    OsInfo[22].Key=bldtm
    OsInfo[22].Value=1534
    OsInfo[23].Key=bldbrch
    OsInfo[23].Value=rs3_release
    OsInfo[24].Key=bldchk
    OsInfo[24].Value=0
    OsInfo[25].Key=wpvermaj
    OsInfo[25].Value=0
    OsInfo[26].Key=wpvermin
    OsInfo[26].Value=0
    OsInfo[27].Key=wpbuildmaj
    OsInfo[27].Value=0
    OsInfo[28].Key=wpbuildmin
    OsInfo[28].Value=0
    OsInfo[29].Key=osver
    OsInfo[29].Value=10.0.16299.19.amd64fre.rs3_release.170928-1534
    OsInfo[30].Key=buildflightid
    OsInfo[30].Value=83a64bad-d4b2-455e-921d-df15581c2777
    OsInfo[31].Key=edition
    OsInfo[31].Value=Professional
    OsInfo[32].Key=ring
    OsInfo[33].Key=containerid
    OsInfo[34].Key=containertype
    OsInfo[35].Key=edu
    OsInfo[35].Value=0
    FriendlyEventName=Stopped working
    ConsentKey=APPCRASH
    AppName=Internet Explorer
    AppPath=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    NsPartner=windows
    NsGroup=windows8
    ApplicationIdentity=0AD3EF1D2E4D079D5C2764D89DA92EDA
    MetadataHash=-2118101986


    Any help would be greatly appreciated. Been going on for awhile and need resolution. 

    Thanks, 


    Systems Administrator

    Wednesday, November 8, 2017 7:30 PM

All replies

  • Hi,

    A website you are visiting is using an unsupported version of flash.

    C:\Windows\System32\Macromed\Flash\Flash.ocx

    If it is an intranet site and you are using Enterprise Site Mode lists, you should place the domain in Enterprise Mode (aka 8) or have your programmers replace the object tag markup to use the supported version of Flash.

    Use the DOM Explorer tab of the dev tool to inspect the markup used to host the Flash control.

    Use the Emulation tab of the dev tool to determine which IE Emulation mode is being used and how it was established.

    Use Tools>Manage Addons>Show Downloaded Controls to obtain the CLSID of Macromedia Flash.

    It is unusual for Win10 to have any 'Downloaded Controls' in IE's addons lists. You could use Group Policy to prevent its installation once you have its CLSID.

    Regards.

    If possible include links to websites you are having problems with your questions. If it is an internet site you can use the Tools>Report Website problems menu to report the site to MS site outreach.


    Rob^_^

    Wednesday, November 8, 2017 8:35 PM
  • Same problem here.  We think its Windows update thats causing this.  
    Thursday, January 4, 2018 12:40 PM
  • @chi-ag,

    yes windows updates includes critical security updates for flash and other activex controls.

    Start>Programs>Administrative Tools>Report Viewer....

    LoadedModule[119]=C:\Windows\System32\Macromed\Flash\Flash.ocx


    Rob^_^

    Friday, January 5, 2018 1:47 AM
  • Same problem here:

    Description

    <dir>

    </dir>
    <dir></dir><dir></dir><dir>

    Faulting Application Path: C:\Program Files (x86)\Internet Explorer\iexplore.exe


    </dir>

    Problem signature

    <dir>

    </dir>
    <dir></dir><dir></dir><dir>

    Problem Event Name: APPCRASH

    Application Name: IEXPLORE.EXE

    Application Version: 11.0.16299.15

    Application Timestamp: 091f43e7

    Fault Module Name: dinput8.dll

    Fault Module Version: 10.0.16299.15

    Fault Module Timestamp: 536c18e7

    Exception Code: c0000005

    Exception Offset: 0000ca5d

    OS Version: 10.0.16299.2.0.0.256.48

    Locale ID: 1030

    Additional Information 1: e2a5

    Additional Information 2: e2a5934c14e66921972cbe137a4819ff

    Additional Information 3: 7b4e

    Additional Information 4: 7b4e0424b0c0dda2d79a0bf736b96ee9

    </dir>

    Monday, January 15, 2018 7:55 AM
  • Got the same problem with a few users here, has anyone managed to resolve this?
    Wednesday, January 17, 2018 2:30 PM
  • Hi We have the same issue on one computer. I have noticed in your WER report that you also have Sophos installed. We have Sophos Endpoint Protection on that specific computer. This has led me to the idea that maybe Sophos could be the troublemaker. I have now just uninstalled Sophos Antivirus and the error has gone. IE is now starting as expected. Maybe you could try to do the same so that we can further isolate the issue. I will meanwhile report the issue to Sophos support. Regards Mischa
    Monday, January 22, 2018 4:47 PM
  • Exact same issue here but we've duplicated it on a base Windows 10 1709 image with no addons or Sophos installed. This has been happening since 1703 and appears to be getting worse.
    Monday, January 22, 2018 7:23 PM
  • Hey all,

     Windows 10 version 1709 - build 16299.192

    IE crashing randomly on many different web sites - seems to be an update, anyone found a solution? or is this a new "feature" of IE

    IE - 11.192.16299.0

    We have to use IE as a business and we use Sophos anti-v cloud based, changing these is not an option (plus I hate workarounds we need a fix)

    Faulting application name: IEXPLORE.EXE, version: 11.0.16299.15, time stamp: 0x091f43e7

    Faulting module name: dinput8.dll, version: 10.0.16299.15, time stamp: 0x536c18e7

    Exception code: 0xc0000005

    Fault offset: 0x0000ca5d

    Faulting process ID: 0x37c0

    Faulting application start time: 0x01d3950c9acbfc9f

    Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

    Faulting module path: C:\WINDOWS\system32\dinput8.dll

    Report ID: 150b8951-df03-4704-ad97-0399ff7945a7

    Faulting package full name:

    Faulting package-relative application ID:

    Thanks Will

    Wednesday, January 24, 2018 12:25 PM
  • Same issue.  Running Sophos as well.  This is upper management, so high priority for me.

    Faulting application name: IEXPLORE.EXE, version: 11.0.16299.15, time stamp: 0x091f43e7

    Faulting module name: dinput8.dll, version: 10.0.16299.15, time stamp: 0x536c18e7

    Exception code: 0xc0000005

    Fault offset: 0x0000ca5d

    Faulting process id: 0x21bc

    Faulting application start time: 0x01d39573e6ea5cf7

    Faulting application path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

    Faulting module path: C:\WINDOWS\system32\dinput8.dll

    Report Id: 12f8bdd0-4d0c-41a8-a7ba-b51ed3d62b14

    Faulting package full name:

    Faulting package-relative application ID:

    Fault bucket 109177932807, type 1

    Event Name: APPCRASH

    Response: Not available

    Cab Id: 0

    Problem signature:

    P1: IEXPLORE.EXE

    P2: 11.0.16299.15

    P3: 091f43e7

    P4: dinput8.dll

    P5: 10.0.16299.15

    P6: 536c18e7

    P7: c0000005

    P8: 0000ca5d

    P9:

    P10:


    These files may be available here:

    C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_IEXPLORE.EXE_fb8cc2014b020582cbf23252a154ffb7c99cc87_82a210e5_2722abc0

    Analysis symbol:

    Rechecking for solution: 0

    Report Id: d93aa88c-3b8c-4fda-ab74-2234e01f7729

    Report Status: 268435456

    Hashed bucket: b8b01e2ad3f2bb0b3202b47bc44750fb

    Thursday, January 25, 2018 6:42 PM
  • Same here. IE crashes multiple times a day. The same error messages as described above.

    Win 10 Pro 1709

    Also with Sophos Endpoint Security installed (If that had something to do with it)

    Wednesday, January 31, 2018 8:19 AM
  • Hi

    I can now confirm that the issue is related to Sophos Exploit Protection. If you disable that specific protection module, the issue has gone. I'm in contact with Sophos support and will update this thread if I have any news.

    Regards,

    Mischa

    Monday, February 5, 2018 9:54 AM
  • Mischa,

    Have you got any updates on the issue?

    I've just raised the support case with Sophos over the exactly same issue. Would you be able to PM me your support ID so I could point the Sophos guys to it and maybe they will add two and two together?

    Thank you for your help,

    Zuzana

    Wednesday, February 7, 2018 4:09 PM
  • Do you know if disabling the options below is a temp work around to the issue?

    Mitigate exploits in vulnurable applications:

    Protect web browsers

    - Protect web browsers plugins

    ?

    • Edited by Worecx Thursday, February 8, 2018 1:38 PM
    Thursday, February 8, 2018 1:37 PM
  • Same issue, also using Sophos Endpoint and Intercept X.  Came across the link below on their community site.

    I disabled the 'Shockwave Flash Object' add-on.  IE | Tools | Manage Add-ons | Show: All add-ons.  

    So far this has corrected the issue for me, without having to disable any Sophos items.

    https://community.sophos.com/products/intercept/f/information/99914/is-there-an-issue-with-sophos-intercept-x-and-internet-explorer-11/363609

    Thursday, February 8, 2018 4:49 PM
  • Still no joy... generated a dump file but just points to an issue with dinput8 (directx) but after runing xdiag cant find any problems..

    dump file below ---


    Microsoft (R) Windows Debugger Version 10.0.16299.91 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\temp\iexplore.exe_180219_140836.dmp]
    User Mini Dump File with Full Memory: Only application data is available

    Comment: '
    *** "C:\temp\procdump.exe" -accepteula -ma -j "c:\temp" 14536 480 13D30000
    *** Just-In-Time debugger. PID: 14536 Event Handle: 480 JIT Context: .jdinfo 0x13d30000'
    Symbol search path is: srv*
    Executable search path is:
    Windows 10 Version 16299 MP (4 procs) Free x86 compatible
    Product: WinNt, suite: SingleUserTS
    16299.15.x86fre.rs3_release.170928-1534
    Machine Name:
    Debug session time: Mon Feb 19 14:08:37.000 2018 (UTC + 0:00)
    System Uptime: 0 days 5:29:06.151
    Process Uptime: 0 days 0:01:35.000
    ................................................................
    ................................................................
    ...................................................
    Loading unloaded module list
    ................................................................
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (38c8.19d0): Access violation - code c0000005 (first/second chance not available)
    eax=00000000 ebx=00000000 ecx=f60c3743 edx=00000000 esi=00000003 edi=00000003
    eip=77b6ed3c esp=0f04eba8 ebp=0f04ed38 iopl=0         nv up ei pl nz na po nc
    cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
    ntdll!NtWaitForMultipleObjects+0xc:
    77b6ed3c c21400          ret     14h
    0:025> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************

    WARNING: Thread 3910 context retrieval failure during dump writing, Win32 error 0n5
    WARNING: Thread 44c exited during dump writing (open status NTSTATUS 0xC000000B)
    WARNING: Thread 3760 exited during dump writing (open status NTSTATUS 0xC000000B)
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for hmpalert.dll -
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for Flash.ocx -
    WARNING: Thread 3910 context retrieval failure during dump writing, Win32 error 0n5
    WARNING: Teb 28 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 28 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 28 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 28 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 28 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 28 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 28 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Thread 44c exited during dump writing (open status NTSTATUS 0xC000000B)
    WARNING: Teb 32 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 32 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 32 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 32 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 32 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 32 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 32 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Thread 3760 exited during dump writing (open status NTSTATUS 0xC000000B)
    WARNING: Teb 33 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 33 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 33 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 33 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 33 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 33 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    WARNING: Teb 33 pointer is NULL - defaulting to 7ffde000
    WARNING: 7ffde000 does not appear to be a TEB
    GetUrlPageData2 (WinHttp) failed: 12030.

    DUMP_CLASS: 2

    DUMP_QUALIFIER: 400

    CONTEXT:  (.ecxr)
    eax=12714008 ebx=00000000 ecx=f60c3743 edx=00000000 esi=641d0000 edi=641d63c0
    eip=126eca5d esp=0f04f5ec ebp=0f04f630 iopl=0         nv up ei pl nz na pe nc
    cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    dinput8!__delayLoadHelper2+0x26c:
    126eca5d 8938            mov     dword ptr [eax],edi  ds:002b:12714008={dinput8!_imp_load__CreateInputHostForProcess (126ec266)}
    Resetting default scope

    FAULTING_IP:
    dinput8!__delayLoadHelper2+26c
    126eca5d 8938            mov     dword ptr [eax],edi

    EXCEPTION_RECORD:  (.exr -1)
    ExceptionAddress: 126eca5d (dinput8!__delayLoadHelper2+0x0000026c)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000001
       Parameter[1]: 12714008
    Attempt to write to address 12714008

    DEFAULT_BUCKET_ID:  INVALID_POINTER_WRITE

    PROCESS_NAME:  iexplore.exe

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

    EXCEPTION_CODE_STR:  c0000005

    EXCEPTION_PARAMETER1:  00000001

    EXCEPTION_PARAMETER2:  12714008

    FOLLOWUP_IP:
    dinput8!_tailMerge_ext_ms_win_mininput_inputhost_l1_1_1_dll+d
    126ec27d 5a              pop     edx

    WRITE_ADDRESS:  12714008

    WATSON_BKT_PROCSTAMP:  91f43e7

    WATSON_BKT_PROCVER:  11.0.16299.15

    PROCESS_VER_PRODUCT:  Internet Explorer

    WATSON_BKT_MODULE:  dinput8.dll

    WATSON_BKT_MODSTAMP:  536c18e7

    WATSON_BKT_MODOFFSET:  ca5d

    WATSON_BKT_MODVER:  6.2.16299.15

    MODULE_VER_PRODUCT:  Microsoft® Windows® Operating System

    BUILD_VERSION_STRING:  10.0.16299.15 (WinBuild.160101.0800)

    MODLIST_WITH_TSCHKSUM_HASH:  5d84016b69f6b9097b08445e9293815387aa5294

    MODLIST_SHA1_HASH:  6b4f651a4d645261d8eb51228ed0076436158750

    COMMENT: 
    *** "C:\temp\procdump.exe" -accepteula -ma -j "c:\temp" 14536 480 13D30000
    *** Just-In-Time debugger. PID: 14536 Event Handle: 480 JIT Context: .jdinfo 0x13d30000

    NTGLOBALFLAG:  0

    PROCESS_BAM_CURRENT_THROTTLED: 0

    PROCESS_BAM_PREVIOUS_THROTTLED: 0

    APPLICATION_VERIFIER_FLAGS:  0

    PRODUCT_TYPE:  1

    SUITE_MASK:  272

    DUMP_FLAGS:  8000c07

    DUMP_TYPE:  3

    ANALYSIS_SESSION_HOST:  W10LT080

    ANALYSIS_SESSION_TIME:  02-20-2018 08:44:17.0915

    ANALYSIS_VERSION: 10.0.16299.91 amd64fre

    THREAD_ATTRIBUTES:
    OS_LOCALE:  ENG

    PROBLEM_CLASSES:

        ID:     [0n301]
        Type:   [@ACCESS_VIOLATION]
        Class:  Addendum
        Scope:  BUCKET_ID
        Name:   Omit
        Data:   Omit
        PID:    [Unspecified]
        TID:    [0x19d0]
        Frame:  [0] : dinput8!__delayLoadHelper2

        ID:     [0n274]
        Type:   [INVALID_POINTER_WRITE]
        Class:  Primary
        Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
                BUCKET_ID
        Name:   Add
        Data:   Omit
        PID:    [Unspecified]
        TID:    [0x19d0]
        Frame:  [0] : dinput8!__delayLoadHelper2

    BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_WRITE

    PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

    LAST_CONTROL_TRANSFER:  from 126ec27d to 126eca5d

    STACK_TEXT: 
    0f04f630 126ec27d 12705dcc 12714008 05000000 dinput8!__delayLoadHelper2+0x26c
    0f04f664 77b4cc4b 12711210 00000000 00000000 dinput8!_tailMerge_ext_ms_win_mininput_inputhost_l1_1_1_dll+0xd
    0f04f690 76d22f37 12711210 126ec3c0 00000000 ntdll!RtlRunOnceExecuteOnce+0x7b
    0f04f6a8 126ec3e4 12711210 126ec3c0 00000000 KERNELBASE!InitOnceExecuteOnce+0x17
    0f04f6bc 77b33470 00000000 d6a5f422 00000000 dinput8!DllProcessDetach+0x106
    0f04f744 77b34059 0f04f844 08871628 d6a5fa56 ntdll!RtlpTpWorkCallback+0x120
    0f04f930 76998654 056d07b0 76998630 1e36690f ntdll!TppWorkerThread+0x7d9
    0f04f944 77b64a77 056d07b0 d6a5faea 00000000 kernel32!BaseThreadInitThunk+0x24
    0f04f98c 77b64a47 ffffffff 77b89ebe 00000000 ntdll!__RtlUserThreadStart+0x2f
    0f04f99c 00000000 77b33880 056d07b0 00000000 ntdll!_RtlUserThreadStart+0x1b


    THREAD_SHA1_HASH_MOD_FUNC:  990a82e415868202159e68f02f4a0fc8053dd098

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  be224ce181700857cc613a30669f2e05f7339859

    THREAD_SHA1_HASH_MOD:  252da8e44adbc7357ee3134979e659a2a5eb7a00

    FAULT_INSTR_CODE:  e0ff595a

    SYMBOL_STACK_INDEX:  1

    SYMBOL_NAME:  dinput8!_tailMerge_ext_ms_win_mininput_inputhost_l1_1_1_dll+d

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: dinput8

    IMAGE_NAME:  dinput8.dll

    DEBUG_FLR_IMAGE_TIMESTAMP:  536c18e7

    STACK_COMMAND:  ~25s ; .ecxr ; kb

    FAILURE_BUCKET_ID:  INVALID_POINTER_WRITE_c0000005_dinput8.dll!_tailMerge_ext_ms_win_mininput_inputhost_l1_1_1_dll

    BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_WRITE_dinput8!_tailMerge_ext_ms_win_mininput_inputhost_l1_1_1_dll+d

    FAILURE_EXCEPTION_CODE:  c0000005

    FAILURE_IMAGE_NAME:  dinput8.dll

    BUCKET_ID_IMAGE_STR:  dinput8.dll

    FAILURE_MODULE_NAME:  dinput8

    BUCKET_ID_MODULE_STR:  dinput8

    FAILURE_FUNCTION_NAME:  _tailMerge_ext_ms_win_mininput_inputhost_l1_1_1_dll

    BUCKET_ID_FUNCTION_STR:  _tailMerge_ext_ms_win_mininput_inputhost_l1_1_1_dll

    BUCKET_ID_OFFSET:  d

    BUCKET_ID_MODTIMEDATESTAMP:  536c18e7

    BUCKET_ID_MODCHECKSUM:  34a3c

    BUCKET_ID_MODVER_STR:  0.0.0.0

    BUCKET_ID_PREFIX_STR:  APPLICATION_FAULT_INVALID_POINTER_WRITE_

    FAILURE_PROBLEM_CLASS:  APPLICATION_FAULT

    FAILURE_SYMBOL_NAME:  dinput8.dll!_tailMerge_ext_ms_win_mininput_inputhost_l1_1_1_dll

    91f43e7/dinput8.dll/6.2.16299.15/536c18e7/c0000005/0000ca5d.htm?Retriage=1

    TARGET_TIME:  2018-02-19T14:08:37.000Z

    OSBUILD:  16299

    OSSERVICEPACK:  15

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    OSPLATFORM_TYPE:  x86

    OSNAME:  Windows 10

    OSEDITION:  Windows 10 WinNt SingleUserTS

    USER_LCID:  0

    OSBUILD_TIMESTAMP:  2031-10-27 02:56:14

    BUILDDATESTAMP_STR:  160101.0800

    BUILDLAB_STR:  WinBuild

    BUILDOSVER_STR:  10.0.16299.15

    ANALYSIS_SESSION_ELAPSED_TIME:  e047

    ANALYSIS_SOURCE:  UM

    FAILURE_ID_HASH_STRING:  um:invalid_pointer_write_c0000005_dinput8.dll!_tailmerge_ext_ms_win_mininput_inputhost_l1_1_1_dll

    FAILURE_ID_HASH:  {502bd972-e56d-fddf-7192-e45057a66168}

    Followup:     MachineOwner
    ---------

    0:025> lmvm dinput8
    Browse full module list
    start    end        module name
    126e0000 12718000   dinput8    (pdb symbols)          C:\ProgramData\dbg\sym\dinput8.pdb\E0FEBBB2E20390F6896FF1C15293C61C1\dinput8.pdb
        Loaded symbol image file: dinput8.dll
        Image path: C:\Windows\System32\dinput8.dll
        Image name: dinput8.dll
        Browse all global symbols  functions  data
        Image was built with /Brepro flag.
        Timestamp:        536C18E7 (This is a reproducible build file hash, not a timestamp)
        CheckSum:         00034A3C
        ImageSize:        00038000
        File version:     6.2.16299.15
        Product version:  10.0.16299.15
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     DInput8.dll
        OriginalFilename: DInput8.dll
        ProductVersion:   10.0.16299.15
        FileVersion:      10.0.16299.15 (WinBuild.160101.0800)
        FileDescription:  Microsoft DirectInput
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    Tuesday, February 20, 2018 8:55 AM
  • Did you ever find a resolution? It seems to be getting worse at my organization. We are also running Sophos, so it seems maybe that has something to do with it.  As of 3/13/2018. Are Sophos software and windows updates are all up to date. 

    Also, it seems to be random...  Some websites will work fine for a while and then randomly cause IE to crash.  Unfortunately we need IE for most of our online business apps.  Has any figured out definitively what the issue is?

    Tuesday, March 13, 2018 4:51 PM
  • I was Working on this issue. Seems the issue is with Sophos
    Saturday, April 21, 2018 1:28 AM
  • @sudhir,

    yes and no... macromedia flash,

    to correct the problem the website developers must replace their old code that references macromedia flash with adobe or generic flash object or replace it with html5 media elements or canvas/svg for gaming sites.

            <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" 
            codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0"
            width="590" height="90" 
            id="mymoviename">
            <param name="movie" value="media/Car-speakers-590x90.swf" />
            <img alt="out of date macromedia flash is disabled/blocked"/>
            </object>

    see Tools>Manage Addons>Show Downloaded controls... you will have it installed on machines that you have upgraded from XP/Vista/Win7.

    you should delete it from your downloaded programs folder.

    ref: https://blogs.msdn.microsoft.com/askie/2014/08/12/how-to-manage-the-new-blocking-out-of-date-activex-controls-feature-in-ie/

    https://www.bing.com/search?q=block+out+of+date+activex


    Rob^_^





    Saturday, April 21, 2018 2:02 AM