locked
Window Explorer Has stopped working RRS feed

  • Question

  • Hello,

    A user at my company is sometimes getting the error "Windows explorer has stopped working" when working in MS word and MS outlook.  At our company we use Windows 7 enterprise/ 32 bit OS.  I have copied the error message that occurred while they were working in MS word from the event viewer:

    General Tab:
     
    Fault bucket 2563076569, type 5
    Event Name: BEX
    Response: Not available
    Cab Id: 0
     
    Problem signature:
    P1: explorer.exe
    P2: 6.1.7601.17567
    P3: 4d6727a7
    P4: StackHash_0a9e
    P5: 0.0.0.0
    P6: 00000000
    P7: 040ff6a8
    P8: c0000005
    P9: 00000008
    P10: 
     
    Attached files:
    C:\Users\kwest\AppData\Local\Temp\WERC6B8.tmp.WERInternalMetadata.xml
     
    These files may be available here:
    C:\Users\kwest\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_explorer.exe_201bf44eef62a07df9dae2b9859548f1554f8bc1_22b538bc
     
    Analysis symbol: 
    Rechecking for solution: 0
    Report Id: f1270e49-0bae-11e6-b196-d4bed9a08802
    Report Status: 0
     
    Log Name:  Application
    Source:        Windows Error Rep   Logged     4/26/2016 9:25:39 AM
    Event:            1001                           Task Category:     None
    Level:          Information                  Keywords:      Classic
    User:        N/A             
    OpCode:
     

    Need help to understand why this is happening.
    Thank you for your help.

    Tuesday, April 26, 2016 2:51 PM

Answers

  • Hi,

    The StackHash error occurs when DEP is invoked and has an issue with whatever application you’re trying to run ,The error is related to Data Execution Prevention.

    For more information, please refer to the link:

    https://support.microsoft.com/en-sg/kb/875352

    Best Regards,

    Tao


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Friday, April 29, 2016 1:35 AM

All replies

  • Hello

    Can you look in to the below link 

    https://social.technet.microsoft.com/Forums/en-US/31262719-5d47-412e-809d-ae1d4a66cc58/windows-explorer-has-stopped-working?forum=winservergen


    Regards, Regin Ravi

    Tuesday, April 26, 2016 3:09 PM
  • Hi,

     

    Based on your description, I noticed the error report, it seems that this error report is not complete.

    I think there should be a Fault Module Name in this error report. This important information will help us troubleshoot the problem better. Would you please check it again?

     

    In addition, there are several troubleshooting methods we may try, please refer to the link:

     

    Error: Windows Explorer has stopped working:

    https://support.microsoft.com/en-sg/kb/2694911

     

    Best Regards,

    Tao

     


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Wednesday, April 27, 2016 11:56 AM
  • Also, as the faulting module is not positively identified (P4: StackHash_0a9e) I might suggest to try to obtain a user mode dump from the crash which has the potential to pinpoint the cause.

    You can configure Windows to create user-mode dumps. Create a System Restore Point first.

    If you copy and paste the following in Notepad and save as a .reg file (save with the .reg extension and give it any name such as dump.reg), then right-click the .reg file and select "Merge" to add to the registry, a .dmp file at the time explorer.exe crashes should be created in the C:\CrashDumps folder:

    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\explorer.exe]
    "DumpFolder"=hex(2):43,00,3a,00,5c,00,43,00,72,00,61,00,73,00,68,00,44,00,75,\
    00,6d,00,70,00,73,00,00,00


    After Explorer (explorer.exe) crashes, can you then make the .dmp file available (provide link) via a public folder on OneDrive (SkyDrive) or similar site?

    Here's a couple of links on using OneDrive (SkyDrive):

    http://windows.microsoft.com/en-ca/skydrive/add-photos-files-faq

    http://windows.microsoft.com/en-ca/onedrive/share-file-folder

    More info on collecting user-mode dumps:

    http://msdn.microsoft.com/en-us/library/bb787181(VS.85).aspx

    To stop the creation of the user mode dump files run the following registry file:

    Windows Registry Editor Version 5.00

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\explorer.exe]

    You can delete the C:\CrashDumps folder anytime.

    Wednesday, April 27, 2016 12:50 PM
  • This is what the problem report description detail stated:

      

    Description
    Faulting Application Path:           C:\Windows\explorer.exe

    Problem signature
    Problem Event Name:    BEX
    Application Name:          explorer.exe
    Application Version:       6.1.7601.17567
    Application Timestamp:              4d6727a7
    Fault Module Name:      StackHash_0a9e
    Fault Module Version:   0.0.0.0
    Fault Module Timestamp:           00000000
    Exception Offset:            0417f8bc
    Exception Code:              c0000005
    Exception Data:               00000008
    OS Version:        6.1.7601.2.1.0.256.4
    Locale ID:           1033
    Additional Information 1:           0a9e
    Additional Information 2:           0a9e372d3b4ad19135b953a78882e789
    Additional Information 3:           0a9e
    Additional Information 4:           0a9e372d3b4ad19135b953a78882e789

    Extra information about the problem
    Bucket ID:          2563076569

    Wednesday, April 27, 2016 1:39 PM
  • Hi,

    The StackHash error occurs when DEP is invoked and has an issue with whatever application you’re trying to run ,The error is related to Data Execution Prevention.

    For more information, please refer to the link:

    https://support.microsoft.com/en-sg/kb/875352

    Best Regards,

    Tao


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Friday, April 29, 2016 1:35 AM
  • I was finally able to get a dump file and analyze it.  Their were lots of dump file but they all had the same information:

    Loading Dump File [C:\Windows\Minidump\explorer.exe.6224.dmp]
    User Mini Dump File: Only registers, stack and portions of memory are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
    Product: WinNt, suite: SingleUserTS
    Machine Name:
    Debug session time: Mon May  9 09:14:34.000 2016 (UTC - 4:00)
    System Uptime: not available
    Process Uptime: 0 days 0:05:26.000
    ................................................................
    ................................................................
    ............................................
    Loading unloaded module list
    ..............................
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (1850.1874): Access violation - code c0000005 (first/second chance not available)
    eax=00000000 ebx=048ff204 ecx=00000400 edx=00000000 esi=00000002 edi=00000000
    eip=77606bf4 esp=048ff1b4 ebp=048ff250 iopl=0         nv up ei pl zr na pe nc
    cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
    ntdll!KiFastSystemCallRet:
    77606bf4 c3              ret
    0:012> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************

    GetPageUrlData failed, server returned HTTP status 404
    URL requested: http://watson.microsoft.com/StageOne/explorer_exe/6_1_7601_19135/56a1ba55/unknown/0_0_0_0/bbbbbbb4/c0000005/048ff960.htm?Retriage=1

    FAULTING_IP: 
    +31b
    048ff960 10fb            adc     bl,bh

    EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 048ff960
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000008
       Parameter[1]: 048ff960
    Attempt to execute non-executable address 048ff960

    DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT

    PROCESS_NAME:  explorer.exe

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1:  00000008

    EXCEPTION_PARAMETER2:  048ff960

    WRITE_ADDRESS:  048ff960 

    FOLLOWUP_IP: 
    ole32!COIDTable::ThreadCleanup+0 [d:\w7rtm\com\ole32\com\dcomrem\idobj.cxx @ 1671]
    762e90b3 8bff            mov     edi,edi

    FAILED_INSTRUCTION_ADDRESS: 
    +35f2faf02ccd84c
    048ff960 10fb            adc     bl,bh

    MOD_LIST: <ANALYSIS/>

    NTGLOBALFLAG:  0

    APPLICATION_VERIFIER_FLAGS:  0

    LAST_CONTROL_TRANSFER:  from 762b5d0f to 048ff960

    ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

    FAULTING_THREAD:  ffffffff

    PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT

    BUGCHECK_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT

    IP_ON_STACK: 
    +35f2faf02ccd84c
    048ff960 10fb            adc     bl,bh

    STACK_TEXT:  
    048ff950 048ff960 unknown!unknown+0x0
    048ff968 762b5d0f ole32!COIDTable::ThreadCleanup+0xcb
    048ffb18 762e8f32 ole32!FinishShutdown+0x9d
    048ffb5c 762e8e73 ole32!ApartmentUninitialize+0x96
    048ffb7c 762dba83 ole32!wCoUninitialize+0x153
    048ffb94 762e8898 ole32!CoUninitialize+0x72
    048ffbb0 6f2363ee fundisc!CNotificationQueue::ThreadProc+0x31b
    048ffbcc 761aef1c kernel32!BaseThreadInitThunk+0xe
    048ffbd8 77623648 ntdll!__RtlUserThreadStart+0x70
    048ffc18 7762361b ntdll!_RtlUserThreadStart+0x1b


    STACK_COMMAND:  .cxr 048FF51C ; kb ; dds 48ff950 ; kb

    SYMBOL_NAME:  ole32!COIDTable::ThreadCleanup+0

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: ole32

    IMAGE_NAME:  ole32.dll

    DEBUG_FLR_IMAGE_TIMESTAMP:  56eb2f8f

    FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_c0000005_ole32.dll!COIDTable::ThreadCleanup

    BUCKET_ID:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_BAD_IP_ole32!COIDTable::ThreadCleanup+0

    WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/explorer_exe/6_1_7601_19135/56a1ba55/unknown/0_0_0_0/bbbbbbb4/c0000005/048ff960.htm?Retriage=1

    Followup: MachineOwner
    ---------

    0:012> lmvm ole32
    start    end        module name
    762a0000 763fd000   ole32      (private pdb symbols)  c:\symbols\ole32.pdb\934D9E9611794AF8B9BAC46F08A9F8112\ole32.pdb
        Loaded symbol image file: ole32.dll
        Mapped memory image file: c:\symbols\ole32.dll\56EB2F8F15d000\ole32.dll
        Image path: C:\Windows\System32\ole32.dll
        Image name: ole32.dll
        Timestamp:        Thu Mar 17 18:28:31 2016 (56EB2F8F)
        CheckSum:         0015A665
        ImageSize:        0015D000
        File version:     6.1.7601.23392
        Product version:  6.1.7601.23392
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     OLE32.DLL
        OriginalFilename: OLE32.DLL
        ProductVersion:   6.1.7601.23392
        FileVersion:      6.1.7601.23392 (win7sp1_ldr.160317-0600)
        FileDescription:  Microsoft OLE for Windows
        LegalCopyright:   © Microsoft Corporation. All rights reserved.
    0:012> .exr 0xffffffffffffffff
    ExceptionAddress: 048ff960
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000008
       Parameter[1]: 048ff960
    Attempt to execute non-executable address 048ff960

    Looking at this it seems the problem is with the "Image name: ole32.dll".  

    Any thoughts on how to fix this?

    Wednesday, May 11, 2016 1:49 PM
  • STACK_TEXT:  
    048ff950 048ff960 unknown!unknown+0x0
    048ff968 762b5d0f ole32!COIDTable::ThreadCleanup+0xcb
    048ffb18 762e8f32 ole32!FinishShutdown+0x9d
    048ffb5c 762e8e73 ole32!ApartmentUninitialize+0x96
    048ffb7c 762dba83 ole32!wCoUninitialize+0x153
    048ffb94 762e8898 ole32!CoUninitialize+0x72
    048ffbb0 6f2363ee fundisc!CNotificationQueue::ThreadProc+0x31b
    048ffbcc 761aef1c kernel32!BaseThreadInitThunk+0xe
    048ffbd8 77623648 ntdll!__RtlUserThreadStart+0x70
    048ffc18 7762361b ntdll!_RtlUserThreadStart+0x1b


    That stack appears similar to what was reported in this topic so try the following hotfix and see if it helps any:

    http://support.microsoft.com/kb/2494427

    There is a link at the top of the article to request the hotfix.


    Wednesday, May 11, 2016 4:54 PM