locked
Explorer.exe crashes with C++ Runtime error during file search RRS feed

  • Question

  • I have been trying to troubleshoot this for days. One of my people keeps getting the following error while attempting to search for .xlsb files (unknown if it is limited to this file type only, however) on his C:\ drive in Windows Explorer (Win 7 Pro 64-bit):

    Microsoft Visual C++ Runtime Library

    This application has requested the RUntime to terminate it in an unusual way.

    Please contact the application's support team for more information.

    The following have been attemped and failed (tested error after each fix):

    • sfc /scannow (no errors found)
    • MBAM scan found 2 infections, removed.
    • Windows Defender Offline scan came back clean
    • removed all previous versions of C++ Redistributable and installed latest 2010 64 bit version

    I have checked the Application Log for the related crash details, and there appear to be 4 entries related, only one of which was shown to be an actual Error:

    • Windows Error Reporting (this did not have an actual (!) Error icon)
    • General Tab:

    Fault bucket 56146625, type 4

    Event Name: APPCRASH

    Response: Not available

    Cab Id: 0

    Problem signature:

    P1: Explorer.EXE

    P2: 6.1.7601.17567

    P3: 4d672ee4

    P4: msvcrt.dll

    P5: 7.0.7601.17744

    P6: 4eeb033f

    P7: 40000015

    P8: 000000000002a84e

    P9:

    P10:

    Attached files:

    C:\Users\[user]\AppData\Local\Temp\WERB221.tmp.WERInternalMetadata.xml

    These files may be available here:

    C:\Users\[user]\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_Explorer.EXE_48ffd1b55b5eba3ed1cdef23152253422e08_2740e763

    Analysis symbol:

    Rechecking for solution: 0

    Report Id: 9fef638d-d9fa-11e2-81e0-00a0c6000000

    Report Status: 0

    • Security -SPP Software Protection
    • Software Protection Platform Service

    • Application Error (has actual (!) error icon in log):

    Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4

    Faulting module name: msvcrt.dll, version: 7.0.7601.17744, time stamp: 0x4eeb033f

    Exception code: 0x40000015

    Fault offset: 0x000000000002a84e

    Faulting process id: 0xe14

    Faulting application start time: 0x01ce6df8268530c8

    Faulting application path: C:\Windows\Explorer.EXE

    Faulting module path: C:\Windows\system32\msvcrt.dll

    Report Id: 9fef638d-d9fa-11e2-81e0-00a0c6000000

    • VSS Idle Timeout (Shadow Copies, seems likely unrelated)

    2D20436F64653A2020434F525356434330303030303737332D2043616C6C3A2020434F525356434330303030303735352D205049443A202030303030383837362D205449443A202030303030323438382D20434D443A2020433A5C57696E646F77735C73797374656D33325C76737376632E6578652020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820

    Binary data:

    In Words

    0000: 6F43202D 203A6564 524F4320 43435653
    0008: 30303030 33373730 6143202D 203A6C6C
    0010: 524F4320 43435653 30303030 35353730
    0018: 4950202D 20203A44 30303030 36373838
    0020: 4954202D 20203A44 30303030 38383432
    0028: 4D43202D 20203A44 575C3A43 6F646E69
    0030: 735C7377 65747379 5C32336D 76737376
    0038: 78652E63 20202065 7355202D 203A7265
    0040: 656D614E 544E203A 54554120 49524F48
    0048: 535C5954 45545359 53202C4D 533A4449
    0050: 352D312D 2038312D

    In Bytes

    0000: 2D 20 43 6F 64 65 3A 20 - Code:
    0008: 20 43 4F 52 53 56 43 43 CORSVCC
    0010: 30 30 30 30 30 37 37 33 00000773
    0018: 2D 20 43 61 6C 6C 3A 20 - Call:
    0020: 20 43 4F 52 53 56 43 43 CORSVCC
    0028: 30 30 30 30 30 37 35 35 00000755
    0030: 2D 20 50 49 44 3A 20 20 - PID:
    0038: 30 30 30 30 38 38 37 36 00008876
    0040: 2D 20 54 49 44 3A 20 20 - TID:
    0048: 30 30 30 30 32 34 38 38 00002488
    0050: 2D 20 43 4D 44 3A 20 20 - CMD:
    0058: 43 3A 5C 57 69 6E 64 6F C:\Windo
    0060: 77 73 5C 73 79 73 74 65 ws\syste
    0068: 6D 33 32 5C 76 73 73 76 m32\vssv
    0070: 63 2E 65 78 65 20 20 20 c.exe
    0078: 2D 20 55 73 65 72 3A 20 - User:
    0080: 4E 61 6D 65 3A 20 4E 54 Name: NT
    0088: 20 41 55 54 48 4F 52 49 AUTHORI
    0090: 54 59 5C 53 59 53 54 45 TY\SYSTE
    0098: 4D 2C 20 53 49 44 3A 53 M, SID:S
    00a0: 2D 31 2D 35 2D 31 38 20 -1-5-18

    If the msvcrt.dll file were corrupt, I would think sfc or reinstalling the Redistributable would have fixed it, but to no avail. Malware has been pretty much eliminated as a possibility.

    Any help is appreciated!

    Friday, June 21, 2013 12:04 AM

All replies

  • Hi,

    First, please disable all the third party plug-ins in Explorer.exe via Shellviewer.

    Please Note: The third-party product discussed here is manufactured by a company that is independent of Microsoft. We make no warranty, implied or otherwise, regarding this product's performance or reliability.

    If no progress, boot into clean boot mode and safe mode for a test.

    Safe Mode - Boot into Safe Mode and see if you experience the same crashes:

    http://windows.microsoft.com/en-us/windows7/Start-your-computer-in-safe-mode

    Clean boot - If you don’t experience the same crashes in Safe Mode, it’s very likely a startup item is causing the issue. Follow the steps found on the following link to perform a clean boot and pinpoint the item causing the issue:

    http://support.microsoft.com/kb/929135


    Tracy Cai
    TechNet Community Support

    Monday, June 24, 2013 8:41 AM
  • I forgot to mention in my original post that a clean boot (msconfig->disable all non-MS services) was also tried did not help. I don't imagine that the user has any third party Explorer plugins, and they would have otherwise been disabled during the clean boot process, I suspect.

    Having left only MS services running during the clean boot process indicates that it is a MS service causing the problem. I did not actually go through the process of sytematically disabling the MS services in the fashion described in the article, however. I will move forward with that.

    Monday, June 24, 2013 10:32 PM
  • You may want to consider to try to capture a user-mode dump of the explorer.exe crash to see what files, other that the msvcrt.dll, are involved in the crash and to see if a third party file may be the issue,

    You can configure Windows to create user-mode dumps. Create a System Restore Point first.

    If you copy and paste the following in Notepad and save as a .reg file, then right-click the .reg file and select "Merge" to add to the registry, a .dmp file at the time explorer.exe crashes should be created in the C:\CrashDumps folder:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\explorer.exe]
    "DumpFolder"=hex(2):43,00,3a,00,5c,00,43,00,72,00,61,00,73,00,68,00,44,00,75,\
    00,6d,00,70,00,73,00,00,00


    After Explorer (explorer.exe) crashes, can you then make the .dmp file available (provide link) via Windows Live SkyDrive or similar site?

    The following link has information on using Windows Live SkyDrive:

    http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65


    More info on collecting user-mode dumps:

    »msdn.microsoft.com/en-us/library···85).aspx
    • Edited by auggyMVP Tuesday, June 25, 2013 11:55 PM added content
    Tuesday, June 25, 2013 11:51 PM
  • I went through the "clean boot" process of disabling the MS services (in addition to the already-disabled 3rd party services), half at a time, and eventually had all but a few disabled and still experienced the C++ runtime error. The few that I could not disable were:

    • Group Policy Client (seems unlikely)
    • Microsoft Antimalware Service (perhaps?)
    • Microsoft Network Inspection
    • RPC Endpoint Mapper
    • Task Scheduler

    I then went into Safe Mode, and also experienced the crash there before re-enabling the normal startup process.

    I will look into turning on the user-mode dump and will post the results.

    Friday, June 28, 2013 7:45 PM
  • auggy,

    Here is the link to the dump file just created about an hour ago after enabling the registy key you posted:

    http://sdrv.ms/12yYOCx

    I must admit, I have no idea what I'm looking at in there, it is all very cryptic. Thanks for your help!

    Monday, July 8, 2013 7:49 PM
  • The file that appeared to cause the crash of Explorer is the mozyproshell.dll:

    BUCKET_ID:  X64_APPLICATION_FAULT_STATUS_FATAL_APP_EXIT_AFTER_CALL_mozyproshell+1750c

    Here is some info on the mozyproshell.dll:

        Image path: C:\Program Files\MozyPro\mozyproshell.dll
        Image name: mozyproshell.dll
        Timestamp:        Mon Sep 17 12:31:52 2012 (50575078)
        CheckSum:         00610F4E
        ImageSize:        00638000
        File version:     2.16.0.215
        Product version:  2.16.0.0

    A similar dll was causing a similar crash in the following link:

    http://community.mozy.com/t5/Mozy-for-Windows/Mozy-2-8-4-0-mozyshell-dll-responsible-for-explorer-exe-crashes/td-p/29329/page/2

    What I would suggest is to uninstall MozyPro and see if the error resolves.

    Afterward you could try reinstalling MozyPro using the latest version.

    If the error persists you could try renaming the mozyproshell.dll in the C:\Program Files\MozyPro folder to mozyproshell.old or something like that or use ShellExView to disable the mozyproshell.dll shell extension.

     
       

       

     

    • Edited by auggyMVP Tuesday, July 9, 2013 3:20 AM accuracy
    Tuesday, July 9, 2013 3:17 AM
  • Wow, thanks auggy! It amazes me how often 3rd party software is causing these types of problems within our organization (a different culprit than expected in this case).

    Did you use the WDK or SDK version of the Windows Debugging Tool (windbg) to read the file? I posted the link to the dump file before discovering that tool, and hadn't downloaded it yet, nor was I sure which version is appropriate. Since it was a .dll causing the problem, I was leaning towards the WDK version.

    I tried finding the fatal app exit reference you made in the raw .dmp file using WordPad but it would seem to be in an area that is not in plain English.
    • Edited by ackthbbft Tuesday, July 9, 2013 3:34 PM Additional info
    Tuesday, July 9, 2013 3:31 PM
  • You're welcome.

    I use WinDbg (Windows Debugger) of the Debugging Tools for Windows which can be downloaded as a standalone component from the Windows SDK.

    See "Install Debugging Tools for Windows as a Standalone Component" in the following link:

    http://msdn.microsoft.com/en-us/library/windows/hardware/gg463009.aspx

    The following link has a good tutorial on debugging:

    http://www.sevenforums.com/crash-lockup-debug-how/26584-configuring-debugging-tools.html

    The tutorial is geared to kernel mode dumps but the basic commands are the same for user mode dumps such as !analyze -v for detailed analysis, lmvm with the module name to get particulars about the module and lmtn to get a list of all modules.

    Also, you can delete the C:\CrashDumps folder anytime.

    You can leave the added registry key intact but you can delete it if you wish to strop the dump creation or run the following .reg file to delete: 

    Windows Registry Editor Version 5.00

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\explorer.exe]





    • Edited by auggyMVP Wednesday, July 10, 2013 4:24 AM content
    Wednesday, July 10, 2013 4:16 AM
  • Hello,

    I had the same error. With every Update it goes more worse.

    The same results with no errors with "sfc /scannow", no viruses and so on.

    I deinstalled all runtimes, like Visual C++ Runtimes 2005-2010, Java, Silverlight, Flash player.
    I deinstalled Net Framework completely with the "Dotnetfx Cleanup Tool".

    I installed all again with "AIO-Runtimes" and do a Windows Update.

    Now I don't have the errors with Explorer Crashes.

    Wednesday, July 10, 2013 2:43 PM
  • I have the similar error:

    Faulting application name: Explorer.EXE, version: 6.1.7600.16768, time stamp: 0x4d6878c3
    Faulting module name: msvcrt.dll, version: 7.0.7600.16930, time stamp: 0x4eeaf834
    Exception code: 0x40000015
    Fault offset: 0x0005620a
    Faulting process id: 0x728
    Faulting application start time: 0x01ceabe8a0c277ad
    Faulting application path: C:\Windows\Explorer.EXE
    Faulting module path: C:\Windows\system32\msvcrt.dll
    Report Id: 8674dcb0-182b-11e3-a0ad-bcaec55c71c0

    and here is the dump file i got:

    https://dl.dropboxusercontent.com/u/73228137/explorer.exe.1832.dmp

    Could you help me to find what causes this error please? thanks :)

    Sunday, September 8, 2013 3:30 AM
  • sorry no support for torrent users who download DVDRips (Straight As 2013 Italian) ;)

    "A programmer is just a tool which converts caffeine into code"

    Sunday, September 8, 2013 6:02 AM