locked
Random crashes on MSHTML.dll due to windows upgrade KB3156421 (Dated 5/11/2016) - DLL Version 11.0.9600.18315 RRS feed

  • Question

  • The following issue started only after windows auto-upgraded itself with KB3156421 (Dated 5/11/2016) which modified the MSHTML.dll on the system and resulting in random crashes. (We still don't have the simulation steps)

    DLL Version 11.0.9600.18315 is crashing IE which is also logged into windows event viewer logs. Below is the log

    Faulting application name: 3CLogicStarter_5.6.24.26526.exe, version: 5.6.24.26526, time stamp: 0x56c2f68c

    Faulting module name: MSHTML.dll, version: 11.0.9600.18315, time stamp: 0x571af57d

    Exception code: 0xc0000005

    Fault offset: 0x0016c349

    Faulting process id: 0x1730

    Faulting application start time: 0x01d1b1f89e640c83

    Faulting application path: C:\Program Files (x86)\3CLogic\Common\3CLogicStarter_5.6.24.26526.exe

    Faulting module path: C:\Windows\system32\MSHTML.dll

    Report Id: fec0f762-1dee-11e6-9009-08d40c04fe6a

    We saw this happen on Windows 7 and 10 

    We tried to restore to previous version but that did not work. 

    Thursday, May 26, 2016 12:54 PM

Answers

  • Hi 3CLogic,

    The crashing application is 3CLogic Client, not Internet Explorer.

    Faulting application name: 3CLogicStarter_5.6.24.26526.exe, version: 5.6.24.26526, time stamp: 0x56c2f68c

    Please contact the application software also, then check to see if they have any newer version that could be updated.

    If not, uninstall and then re-install it to check this out.

    Regards


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Friday, May 27, 2016 6:23 AM

All replies

  • Hi 3CLogic,

    The crashing application is 3CLogic Client, not Internet Explorer.

    Faulting application name: 3CLogicStarter_5.6.24.26526.exe, version: 5.6.24.26526, time stamp: 0x56c2f68c

    Please contact the application software also, then check to see if they have any newer version that could be updated.

    If not, uninstall and then re-install it to check this out.

    Regards


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Friday, May 27, 2016 6:23 AM
  • The faulting application may be registered in the .evt as 3clogic but that does not mean I.E. is not the source of the problem. I have no less than five applications running over IE at patch KB3154070 and all register as crashing on the mshtml.dll.

    I am able to reproduce the issue and crash just on iexplore.exe by browsing through random external websites. We upgraded and reverted .net, even disabling ALL third party plugins including Flash and while it reduces the crashing it still occurs.

    We have a case open with MS on this and have been trying to figure out what is going on for at least two months now. The problem has gained visibility all the way to our IT director.

    
    Friday, June 10, 2016 1:42 PM
  • The faulting application may be registered in the .evt as 3clogic but that does not mean I.E. is not the source of the problem. I have no less than five applications running over IE at patch KB3154070 and all register as crashing on the mshtml.dll. 

    Can you reproduce it in a safe mode boot?  Can you reproduce it with a clean boot (e.g. uninstalling possible interferers if necessary)?

    Take a look at the Stack Back Trace for the possibility that there may be a module in there which is now incompatible with the new security configuration.  Uninstall the product which brought that module.  Test without it being installed.  Re-install it to see if it can set it hooks better in the new environment. 

    Unfortunately Stack Back Trace is something that you will need to get by formatting a dump of the crash.  A possible alternative which would not be as conclusive a diagnostic is the list of Loaded modules which the crash event's Report.WER file would show.  Another alternative would be to run ProcMon and use its pseudo Stack information just before the crash.  Unfortunately ProcMon does not give the actual crash information that WER gets any more.

    Good luck



    Robert Aldwinckle
    ---

    Friday, June 10, 2016 3:55 PM