locked
Explorer.exe crashes very often RRS feed

  • Question

  • My windows 7 explorer.exe is crashing very often especially, but not always, when waking up after hibernation or sleep.

    The faulting module is usually ntdll.dll but but has happened to me on other modules as well ( user32.dll, ole32.dll, etc... ) though less often.

    I can't tell when this has started hapenning, but it's being going on for several months.

    My antivirus never found nothing and my windows is up to date.

    this is my debug diagnostics tool report:


    Table Of Contents
    \explorer.DMP
       Top 5 threads by CPU time
       Thread report
       Well-Known COM STA Threads Report Report for explorer.DMP


    Report for explorer.DMP
    Type of Analysis Performed      Hang Analysis
    Machine Name      CASANOVO-LT
    Operating System      Windows 7Service Pack 1
    Number Of Processors      4
    Process ID      1948
    Process Image      C:\Windows\explorer.exe
    System Up-Time      2 day(s) 23:39:38
    Process Up-Time      1 day(s) 03:55:40
    Processor Type      X64
    Process Bitness      64-Bit

    Top 5 Threads by CPU time
    Note - Times include both user mode and kernel mode for each thread
    Thread ID: 2        Total CPU Time: 00:00:22.370         Entry Point for Thread: shlwapi!WrapperThreadProc
    Thread ID: 7        Total CPU Time: 00:00:03.868         Entry Point for Thread: shlwapi!WrapperThreadProc
    Thread ID: 13        Total CPU Time: 00:00:00.093         Entry Point for Thread: ntdll!TppWorkerThread
    Thread ID: 1        Total CPU Time: 00:00:00.093         Entry Point for Thread: ntdll!TppWaiterpThread
    Thread ID: 6        Total CPU Time: 00:00:00.062         Entry Point for Thread: winmm!mciwindow


    Thread report

    Thread 0 - System ID 2572
    Entry point      explorer!wWinMainCRTStartup
    Create time      16-12-2013 17:29:32
    Time spent in user mode      0 Days 00:00:00.015
    Time spent in kernel mode      0 Days 00:00:00.031


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    user32!RealMsgWaitForMultipleObjectsEx+12a
    user32!MsgWaitForMultipleObjectsEx+46
    user32!MsgWaitForMultipleObjects+20
    EXPLORERFRAME!SHProcessMessagesUntilEventsEx+61
    EXPLORERFRAME!CExplorerHostCreator::RunHost+69
    explorer!wWinMain+53c
    explorer!DelayLoadFailureHook+208
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 1 - System ID 6012
    Entry point      ntdll!TppWaiterpThread
    Create time      16-12-2013 17:29:32
    Time spent in user mode      0 Days 00:00:00.015
    Time spent in kernel mode      0 Days 00:00:00.078


    Function
    ntdll!NtWaitForMultipleObjects+a
    ntdll!TppWaiterpThread+14d
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 2 - System ID 5408
    Entry point      shlwapi!WrapperThreadProc
    Create time      16-12-2013 17:29:32
    Time spent in user mode      0 Days 00:00:10.904
    Time spent in kernel mode      0 Days 00:00:11.466


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    user32!RealMsgWaitForMultipleObjectsEx+12a
    duser!CoreSC::Wait+62
    duser!CoreSC::WaitMessage+6f
    duser!MphWaitMessageEx+5c
    user32!_ClientWaitMessageExMPH+1a
    ntdll!KiUserCallbackDispatcherContinue
    user32!NtUserWaitMessage+a
    EXPLORERFRAME!CExplorerFrame::FrameMessagePump+468
    EXPLORERFRAME!BrowserThreadProc+180
    EXPLORERFRAME!BrowserNewThreadProc+53
    EXPLORERFRAME!CExplorerTask::InternalResumeRT+12
    EXPLORERFRAME!CRunnableTask::Run+da
    shell32!CShellTask::TT_Run+124
    shell32!CShellTaskThread::ThreadProc+1d2
    shell32!CShellTaskThread::s_ThreadProc+22
    shlwapi!WrapperThreadProc+19b
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 3 - System ID 6224
    Entry point      msvcrt!endthreadex+64
    Create time      16-12-2013 17:29:32
    Time spent in user mode      0 Days 00:00:00.000
    Time spent in kernel mode      0 Days 00:00:00.000


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    user32!RealMsgWaitForMultipleObjectsEx+12a
    user32!MsgWaitForMultipleObjectsEx+46
    duser!CoreSC::Wait+6a
    duser!CoreSC::xwProcessNL+ed
    duser!GetMessageExA+7b
    duser!ResourceManager::SharedThreadProc+e8
    msvcrt!endthreadex+47
    msvcrt!endthreadex+e0
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 4 - System ID 2516
    Entry point      shlwapi!WrapperThreadProc
    Create time      16-12-2013 17:29:33
    Time spent in user mode      0 Days 00:00:00.015
    Time spent in kernel mode      0 Days 00:00:00.000


    Function
    user32!ZwUserGetMessage+a
    user32!GetMessageW+34
    shell32!MessagePumpThreadProc+3e
    shlwapi!WrapperThreadProc+19b
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 5 - System ID 1236
    Entry point      ntdll!TppWorkerThread
    Create time      16-12-2013 17:29:34
    Time spent in user mode      0 Days 00:00:00.000
    Time spent in kernel mode      0 Days 00:00:00.015


    Function
    ntdll!NtWaitForWorkViaWorkerFactory+a
    ntdll!TppWorkerThread+2c9
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 6 - System ID 4552
    Entry point      winmm!mciwindow
    Create time      16-12-2013 17:29:43
    Time spent in user mode      0 Days 00:00:00.000
    Time spent in kernel mode      0 Days 00:00:00.062


    Function
    user32!ZwUserGetMessage+a
    user32!GetMessageA+c4
    winmm!mciwindow+174
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 7 - System ID 7036
    Entry point      shlwapi!WrapperThreadProc
    Create time      16-12-2013 21:42:54
    Time spent in user mode      0 Days 00:00:01.778
    Time spent in kernel mode      0 Days 00:00:02.090


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    user32!RealMsgWaitForMultipleObjectsEx+12a
    duser!CoreSC::Wait+62
    duser!CoreSC::WaitMessage+6f
    duser!MphWaitMessageEx+5c
    user32!_ClientWaitMessageExMPH+1a
    ntdll!KiUserCallbackDispatcherContinue
    user32!NtUserWaitMessage+a
    EXPLORERFRAME!CExplorerFrame::FrameMessagePump+468
    EXPLORERFRAME!BrowserThreadProc+180
    EXPLORERFRAME!BrowserNewThreadProc+53
    EXPLORERFRAME!CExplorerTask::InternalResumeRT+12
    EXPLORERFRAME!CRunnableTask::Run+da
    shell32!CShellTask::TT_Run+124
    shell32!CShellTaskThread::ThreadProc+1d2
    shell32!CShellTaskThread::s_ThreadProc+22
    shlwapi!WrapperThreadProc+19b
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 8 - System ID 1148
    Entry point      ole32!CRpcThreadCache::RpcWorkerThreadEntry
    Create time      16-12-2013 23:04:44
    Time spent in user mode      0 Days 00:00:00.000
    Time spent in kernel mode      0 Days 00:00:00.000


    Function
    ntdll!ZwDelayExecution+a
    KERNELBASE!SleepEx+ab
    ole32!CROIDTable::WorkerThreadLoop+10
    ole32!CRpcThread::WorkerLoop+1e
    ole32!CRpcThreadCache::RpcWorkerThreadEntry+1a
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 9 - System ID 7016
    Entry point      ntdll!TppWorkerThread
    Create time      17-12-2013 20:19:17
    Time spent in user mode      0 Days 00:00:00.015
    Time spent in kernel mode      0 Days 00:00:00.031


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    user32!RealMsgWaitForMultipleObjectsEx+12a
    user32!MsgWaitForMultipleObjectsEx+46
    user32!MsgWaitForMultipleObjects+20
    shell32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+51
    shell32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+ac
    shell32!CShellTaskThread::ThreadProc+257
    shell32!CShellTaskThread::s_ThreadProc+22
    shlwapi!ExecuteWorkItemThreadProc+f
    ntdll!RtlpTpWorkCallback+16b
    ntdll!TppWorkerThread+5ff
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 10 - System ID 5480
    Entry point      ntdll!TppWorkerThread
    Create time      17-12-2013 20:23:42
    Time spent in user mode      0 Days 00:00:00.015
    Time spent in kernel mode      0 Days 00:00:00.000


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    kernel32!WerpReportFaultInternal+215
    kernel32!WerpReportFault+77
    kernel32!BasepReportFault+1f
    kernel32!UnhandledExceptionFilter+1fc
    ntdll!TppExceptionFilter+a5
    ntdll!TppWorkerpInnerExceptionFilter+15
    ntdll! ?? ::FNODOBFM::`string'+2600
    ntdll!_C_specific_handler+8c
    ntdll!_GSHandlerCheck_SEH+75
    ntdll!RtlpExecuteHandlerForException+d
    ntdll!RtlDispatchException+45a
    ntdll!KiUserExceptionDispatch+2e
    ntdll!RtlFreeHeap+d0
    shell32!operator delete+21
    shell32!CAssocList::Release+63
    shell32!CAssocArray::_Reset+26
    shell32!CAssocArray::Release+38
    shell32!IsLibrary+68
    shell32!GetContainedLocationsFromSite+41
    shell32!CSyncCommandState::_GetSyncState+37
    shell32!CSyncCommandState::GetState+191
    shell32!CRegDataDrivenCommand::_CheckCommandStateHandler+116
    shell32!CRegDataDrivenCommand::GetState+172
    shell32!ExplorerCommandItem::Init+82
    shell32!CGetCommandStateTask::DoWork+25e
    shell32!CFrameTask::InternalResumeRT+17
    shell32!CRunnableTask::Run+da
    shell32!CShellTask::TT_Run+124
    shell32!CShellTaskThread::ThreadProc+1d2
    shell32!CShellTaskThread::s_ThreadProc+22
    shlwapi!ExecuteWorkItemThreadProc+f
    ntdll!RtlpTpWorkCallback+16b
    ntdll!TppWorkerThread+5ff
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 11 - System ID 3236
    Entry point      ntdll!TppWorkerThread
    Create time      17-12-2013 20:23:44
    Time spent in user mode      0 Days 00:00:00.000
    Time spent in kernel mode      0 Days 00:00:00.000


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    user32!RealMsgWaitForMultipleObjectsEx+12a
    user32!MsgWaitForMultipleObjectsEx+46
    user32!MsgWaitForMultipleObjects+20
    shell32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+51
    shell32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+ac
    shell32!CShellTaskThread::ThreadProc+257
    shell32!CShellTaskThread::s_ThreadProc+22
    shlwapi!ExecuteWorkItemThreadProc+f
    ntdll!RtlpTpWorkCallback+16b
    ntdll!TppWorkerThread+5ff
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 12 - System ID 5008
    Entry point      ntdll!TppWorkerThread
    Create time      17-12-2013 20:23:44
    Time spent in user mode      0 Days 00:00:00.015
    Time spent in kernel mode      0 Days 00:00:00.000


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    user32!RealMsgWaitForMultipleObjectsEx+12a
    user32!MsgWaitForMultipleObjectsEx+46
    user32!MsgWaitForMultipleObjects+20
    shell32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+51
    shell32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+ac
    shell32!CShellTaskThread::ThreadProc+257
    shell32!CShellTaskThread::s_ThreadProc+22
    shlwapi!ExecuteWorkItemThreadProc+f
    ntdll!RtlpTpWorkCallback+16b
    ntdll!TppWorkerThread+5ff
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 13 - System ID 4156
    Entry point      ntdll!TppWorkerThread
    Create time      17-12-2013 20:23:44
    Time spent in user mode      0 Days 00:00:00.062
    Time spent in kernel mode      0 Days 00:00:00.031


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    user32!RealMsgWaitForMultipleObjectsEx+12a
    user32!MsgWaitForMultipleObjectsEx+46
    user32!MsgWaitForMultipleObjects+20
    shell32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+51
    shell32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+ac
    shell32!CShellTaskThread::ThreadProc+257
    shell32!CShellTaskThread::s_ThreadProc+22
    shlwapi!ExecuteWorkItemThreadProc+f
    ntdll!RtlpTpWorkCallback+16b
    ntdll!TppWorkerThread+5ff
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 14 - System ID 6600
    Entry point      ntdll!TppWorkerThread
    Create time      17-12-2013 20:23:44
    Time spent in user mode      0 Days 00:00:00.046
    Time spent in kernel mode      0 Days 00:00:00.015


    Function
    ntdll!NtWaitForMultipleObjects+a
    KERNELBASE!WaitForMultipleObjectsEx+e8
    kernel32!WaitForMultipleObjectsExImplementation+b3
    user32!RealMsgWaitForMultipleObjectsEx+12a
    user32!MsgWaitForMultipleObjectsEx+46
    user32!MsgWaitForMultipleObjects+20
    shell32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+51
    shell32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+ac
    shell32!CShellTaskThread::ThreadProc+257
    shell32!CShellTaskThread::s_ThreadProc+22
    shlwapi!ExecuteWorkItemThreadProc+f
    ntdll!RtlpTpWorkCallback+16b
    ntdll!TppWorkerThread+5ff
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 15 - System ID 6400
    Entry point      ntdll!TppWorkerThread
    Create time      17-12-2013 20:23:44
    Time spent in user mode      0 Days 00:00:00.000
    Time spent in kernel mode      0 Days 00:00:00.000


    Function
    ntdll!NtWaitForWorkViaWorkerFactory+a
    ntdll!TppWorkerThread+2c9
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 16 - System ID 5824
    Entry point      ntdll!TppWorkerThread
    Create time      17-12-2013 20:23:44
    Time spent in user mode      0 Days 00:00:00.000
    Time spent in kernel mode      0 Days 00:00:00.000


    Function
    ntdll!NtWaitForWorkViaWorkerFactory+a
    ntdll!TppWorkerThread+2c9
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Thread 17 - System ID 5692
    Entry point      ntdll!TppWorkerThread
    Create time      17-12-2013 20:23:44
    Time spent in user mode      0 Days 00:00:00.000
    Time spent in kernel mode      0 Days 00:00:00.000


    Function
    ntdll!NtWaitForWorkViaWorkerFactory+a
    ntdll!TppWorkerThread+2c9
    kernel32!BaseThreadInitThunk+d
    ntdll!RtlUserThreadStart+1d


    Back to Top

    Can you help ?

    Thanks.

        
    Friday, December 27, 2013 8:49 PM

Answers

  • I am glad to announce that finally the explorer errors are over. I turns out it was nothing else than the Dropbox application that was causing it, however disabling it in shell extensions wasn't sufficient and so had me fooled for quite a while, uninstalling it fully solved the problem.

    Thanks for all your help :D. Hope it can be useful to someone.

    Friday, August 15, 2014 6:04 PM

All replies

  • The system files can be broken. Have you tried to run the System File Checker tool?

    Command prompt > sfc /scannow

    Saturday, December 28, 2013 5:57 AM
  • Yes I did. It seems it only finds a system file I've changed that has nothing to do with this matter, it simply changes a line in a gadget.xml file to remove it's screen resolution settings because of a bug introduced by a recent microsoft update on resized desktops.

    I'd show the report but it is rather extensive. How can I upload a file ?

    I've also used shellexview to remove all shell extensions other than microsoft's and nothing.

    I've also examined the minidump that windows 7 itself creates ( the other one was through task manager ),

    and it seems to point to a heap corruption problem stated in this line of the debug diagnostics report:

    In WER42F8.tmp.hdmp the assembly instruction at ntdll!RtlReportCriticalFailure+62 in C:\Windows\System32\ntdll.dll from Microsoft Corporation has caused an unknown exception (0xc0000374) on thread 10

    Sunday, December 29, 2013 2:43 PM
  • Windows Explorer crashes are mostly caused by an incompatible Shell Extension. you can set Windows Error Reporting Service,

    [HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\explorer.exe\]

    In the explorer.exe key, create a REG_EXPAND_SZ value named DumpFolder and set the data for the value to %systemdrive%\expdumps, Ensure the %systemdrive%\expdumps folder exists

    Create a Dword(32-bit)value, name “DumpType”set the value data to 2

    wait for the next crash, then zip the dump file, upload it to Skydrive or other tools for us to view the detailed information.

    How to use Skydrive

    http://www.wikihow.com/Use-SkyDrive

    Collecting User-Mode Dumps

    http://msdn.microsoft.com/en-us/library/bb787181%28VS.85%29.aspx

    NOTE This response contains a reference to a third party World Wide Web site. Microsoft
    is providing this information as a convenience to you.

    Regards


    Yolanda
    TechNet Community Support

    Monday, December 30, 2013 7:33 AM
  • Here's the Skydrive link to the dump:

    https://skydrive.live.com/redir?resid=C805D83602EE3FE3!747&authkey=!AI3wBgUNy7KotyI&ithint=file%2c.dmp

    Thanks.

    Friday, January 3, 2014 9:14 PM
  • I've just noticed that if  I leave two explorer windows open and hibernate, it never crashes.

    I've already tried it for a few days.

    How would you explain that ?

    Thursday, January 9, 2014 8:08 PM
  • WU

    This one crash was related to heap corruption (which could as Yolanda says be related to a corrupt extention).  One of the mitigating factors is the fact that your machine had been up (not rebooted) for almost 6 days and explorer had been open for over 16 hours.

    In line with what Yolanda suggests have you rebooted without extensions to see if the problem happens?

    Can you upload the event viewer logs?

    Please provide us with your Event Viewer administrative logs by following these steps:


    Click Start Menu
    Type eventvwr into Search programs and files (do not hit enter)
    Right click eventvwr.exe and click Run as administrator
    Expand Custom Views
    Click Administrative Events
    Right click Administrative Events
    Save all Events in Custom View As...
    Save them in a folder where you will remember which folder and save as Errors.evtx
    Go to where you saved Errors.evtx
    Right click Errors.evtx -> send to -> compressed (zipped) folder
    Upload the .zip file to skydrive or a file sharing service and put a link to it in your next post
    *
    If you have updated to win 8.1 and you get the error message "the system cannot find the file specified" it is a known problem.  The work around is to edit the registry.  If you are not comfortable doing this DONT.  If you are, backup the key before you do
    Press Win+"R" and input regedit

    Navigate to:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels. Delete "Microsoft-Windows-DxpTaskRingtone/Analytic"


    Wanikiya and Dyami--Team Zigzag

    Thursday, January 9, 2014 8:28 PM
  • I did try disabling all extensions except Microsoft's using shellexview and though it did not happen as often it still did. May not have restarted the pc though, should I ?

    Here's the link to my event viewer errors:

    https://skydrive.live.com/redir?resid=C805D83602EE3FE3!748&authkey=!AHHRU69oIbKwbOQ&ithint=file%2c.zip


    Thursday, January 9, 2014 9:17 PM
  • I can also add that now that I am using SONY's Battery care function ( keeping the battery at 50% ) the errors seem to have stopped, that was just coincident with the two explorer windows open but seems like the true reason was battery care turned on and not using the battery power at all. That seems to mitigate the issue, but stil got an error yesterday when disabling wifi.

    Saturday, January 11, 2014 9:51 PM
  • The errors continue even if less often.

    Can anyone help ?

    Saturday, January 18, 2014 5:41 PM
  • I am glad to announce that finally the explorer errors are over. I turns out it was nothing else than the Dropbox application that was causing it, however disabling it in shell extensions wasn't sufficient and so had me fooled for quite a while, uninstalling it fully solved the problem.

    Thanks for all your help :D. Hope it can be useful to someone.

    Friday, August 15, 2014 6:04 PM