none
Event ID 1000, Explorer.exe, Crashes

    Question

  • Explorer.exe crashes from time to time. The crash seems random, but I think it happens when I open explorer or the control panel. It happens intermittently, so it's hard to tell. I get two different event ID 1000 in the logs. One error indicates the faulting module as ntdll.dll and the other as DUI70.dll. Here's a link to the dump files: http://1drv.ms/1yScTvQ I don't know how to analyze the dump files. Please help me, thank you! System Information: http://1drv.ms/15puFOb

    "Log Name:      Application
    Source:        Application Error
    Date:          11/22/2014 2:53:40 PM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      COMPUTER
    Description:
    Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
    Faulting module name: DUI70.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdf25
    Exception code: 0xc0000005
    Fault offset: 0x0000000000001098
    Faulting process id: 0x6d4
    Faulting application start time: 0x01d0069509c3cb8f
    Faulting application path: C:\Windows\Explorer.EXE
    Faulting module path: C:\Windows\system32\DUI70.dll
    Report Id: a3068706-7289-11e4-bfb8-6c626d45a41"

    "Log Name:      Application
    Source:        Application Error
    Date:          11/25/2014 7:54:57 AM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      COMPUTER
    Description:
    Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
    Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521eaf24
    Exception code: 0xc0000374
    Fault offset: 0x00000000000c4102
    Faulting process id: 0x70c
    Faulting application start time: 0x01d008b520e84613
    Faulting application path: C:\Windows\Explorer.EXE
    Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
    Report Id: a38d81ec-74aa-11e4-9900-6c626d45a415"

    Tuesday, November 25, 2014 7:52 PM

Answers

  • Hi,

    Sorry for my dilatory reply. According to these analyze results, this problem indeed caused by duser.dll which belongs to Windows DirectUI Engine.

    To resolve this problem, firstly, try to run Sfc /scannow command to fix system componments for test.

    If no use, it would be better to access Windows Recoveroy mode to make system repair.

    In addition, generally speaking, system dll file won't have problem, have you installed any app in your system that may harm to system file before this problem occures? If that it is, please try to uninstall it for test.



    Roger Lu
    TechNet Community Support

    Friday, December 5, 2014 3:17 AM
    Moderator

All replies

  • Have similar problem with windows 8.1 x64
    Thursday, November 27, 2014 3:40 PM
  • I reinstalled the following:

    Security Update for Microsoft ASP.NET MVC 4.0 (KB2993928)

    It's been 48 hours and I haven't had a crash yet, so this may have fixed my problem.

    Thursday, November 27, 2014 9:04 PM
  • It crashed again. I learned how to analyze the dump files, but I'm still not sure how to fix. The problem seems to be with the Windows DirectUI Engine (dui70.dll). I'm trying to troubleshoot further, but I can't access dui70.dll. Not even as administrator. I was planning to rename dui70.dll and try a startup repair. I also tried to copy over the one located in C:\Windows\winsxs\. Permission denied! Does anyone have any advice on this? Here is the dump:

    FAULTING_IP:
    ntdll!RtlReportCriticalFailure+62
    00000000`76fa4102 eb00            jmp     ntdll!RtlReportCriticalFailure+0x64 (00000000`76fa4104)

    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 0000000076fa4102 (ntdll!RtlReportCriticalFailure+0x0000000000000062)
       ExceptionCode: c0000374
      ExceptionFlags: 00000001
    NumberParameters: 1
       Parameter[0]: 000000007701b4b0

    CONTEXT:  0000000000000000 -- (.cxr 0x0;r)
    rax=0000000002490000 rbx=0000000000001004 rcx=0000000002490000
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=0000000076f312fa rsp=000000000f03cb08 rbp=ffffffffffffffff
     r8=0000000000000000  r9=0000000000000040 r10=0000000000000000
    r11=0000000000000286 r12=000000007700f730 r13=0000000002470000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
    ntdll!NtWaitForSingleObject+0xa:
    00000000`76f312fa c3              ret

    PROCESS_NAME:  explorer.exe

    ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.

    EXCEPTION_PARAMETER1:  000000007701b4b0

    NTGLOBALFLAG:  0

    APPLICATION_VERIFIER_FLAGS:  0

    APP:  explorer.exe

    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

    LAST_CONTROL_TRANSFER:  from 0000000076fa4746 to 0000000076fa4102

    FAULTING_THREAD:  ffffffffffffffff

    DEFAULT_BUCKET_ID:  STATUS_HEAP_CORRUPTION

    PRIMARY_PROBLEM_CLASS:  STATUS_HEAP_CORRUPTION

    BUGCHECK_STR:  APPLICATION_FAULT_STATUS_HEAP_CORRUPTION

    STACK_TEXT: 
    00000000`7701b518 00000000`76f4dc1f ntdll! ?? ::FNODOBFM::`string'+0x10c54
    00000000`7701b520 00000000`76ce1a4a kernel32!HeapFree+0xa
    00000000`7701b528 000007fe`fb0d3829 dui70!DirectUI::Element::_DisplayNodeCallback+0x795
    00000000`7701b530 000007fe`fb071df7 duser!GPCB::xwInvokeDirect+0x67
    00000000`7701b538 000007fe`fb075221 duser!DuVisual::xwBeginDestroy+0x181
    00000000`7701b540 000007fe`fb0752ad duser!DuVisual::xwDestroy+0x21
    00000000`7701b548 000007fe`fb074ccc duser!DeleteHandle+0x137
    00000000`7701b550 000007fe`fb0d38d0 dui70!DirectUI::Element::Destroy+0xb8
    00000000`7701b558 000007fe`fb0d62a7 dui70!DirectUI::Element::DestroyAll+0xab
    00000000`7701b560 000007fe`fb0d628e dui70!DirectUI::Element::DestroyAll+0x90
    00000000`7701b568 000007fe`fb0d628e dui70!DirectUI::Element::DestroyAll+0x90
    00000000`7701b570 000007fe`fb0d628e dui70!DirectUI::Element::DestroyAll+0x90
    00000000`7701b578 000007fe`fb0d628e dui70!DirectUI::Element::DestroyAll+0x90
    00000000`7701b580 000007fe`fb0d628e dui70!DirectUI::Element::DestroyAll+0x90
    00000000`7701b588 000007fe`fb0d628e dui70!DirectUI::Element::DestroyAll+0x90
    00000000`7701b590 000007fe`fb0d628e dui70!DirectUI::Element::DestroyAll+0x90
    00000000`7701b598 000007fe`fb0d628e dui70!DirectUI::Element::DestroyAll+0x90
    00000000`7701b5a0 000007fe`fdb5053a shell32!ElementWrapper::Release+0x35
    00000000`7701b5a8 000007fe`fdb50515 shell32!CDUIViewFrame::_ModuleEntryClearCB+0xbc
    00000000`7701b5b0 000007fe`fb6f0c04 comctl32!DSA_EnumCallback+0x48
    00000000`7701b5b8 000007fe`fb6f0c3f comctl32!DSA_DestroyCallback+0x13
    00000000`7701b5c0 000007fe`fda767f9 shell32!DSA_DestroyCallback+0x4d
    00000000`7701b5c8 000007fe`fdb50bbd shell32!CDUIViewFrame::DestroyFrameWindow+0x39
    00000000`7701b5d0 000007fe`f8a4c4d5 explorerframe!CShellBrowser::_CleanupFrameIfNecessary+0x39
    00000000`7701b5d8 000007fe`f8a4dbff explorerframe!CShellBrowser::_OnDestroy+0x56
    00000000`7701b5e0 000007fe`f8a4dba6 explorerframe!CShellBrowser::WndProcBS+0x28f
    00000000`7701b5e8 000007fe`f8a4c3bd explorerframe!IEFrameWndProc+0xbf
    00000000`7701b5f0 00000000`76df9bd1 user32!UserCallWinProcCheckWow+0x1ad
    00000000`7701b5f8 00000000`76df72cb user32!DispatchClientMessage+0xc3
    00000000`7701b600 00000000`76df6829 user32!_fnDWORD+0x2d
    00000000`7701b608 00000000`76f311f5 ntdll!KiUserCallbackDispatcherContinue+0x0
    00000000`7701b610 00000000`76decbfa user32!ZwUserDestroyWindow+0xa


    FOLLOWUP_IP:
    dui70!DirectUI::Element::_DisplayNodeCallback+795
    000007fe`fb0d3829 e994e3feff      jmp     dui70!DirectUI::Element::_DisplayNodeCallback+0x87a (000007fe`fb0c1bc2)

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  dui70!DirectUI::Element::_DisplayNodeCallback+795

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: dui70

    IMAGE_NAME:  dui70.dll

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bdf25

    STACK_COMMAND:  !heap ; dps 7701b518 ; kb

    FAILURE_BUCKET_ID:  STATUS_HEAP_CORRUPTION_c0000374_dui70.dll!DirectUI::Element::_DisplayNodeCallback

    BUCKET_ID:  X64_APPLICATION_FAULT_STATUS_HEAP_CORRUPTION_dui70!DirectUI::Element::_DisplayNodeCallback+795

    ANALYSIS_SOURCE:  UM

    FAILURE_ID_HASH_STRING:  um:status_heap_corruption_c0000374_dui70.dll!directui::element::_displaynodecallback

    FAILURE_ID_HASH:  {a087dded-f11c-c488-88ad-f618cd7c56ee}

    Followup: MachineOwner

    Friday, November 28, 2014 8:09 PM
  • Another crash . . .this time I believe it was the Windows DirectUser Engine(duser.dll). Now, I'm not sure how to troubleshoot this further. Here is the last crash dump:

    FAULTING_IP:
    +1
    00000000`00000000 ??              ???

    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 0000000000000000
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000008
       Parameter[1]: 0000000000000000
    Attempt to execute non-executable address 0000000000000000

    CONTEXT:  0000000000000000 -- (.cxr 0x0;r)
    rax=00000000c0000001 rbx=00000000059bd350 rcx=00000000044a0000
    rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000002
    rip=0000000077b4186a rsp=00000000059bd218 rbp=0000000000000002
     r8=00000000059bc938  r9=00000000059bcaa0 r10=0000000000000000
    r11=0000000000000246 r12=0000000000000000 r13=00000000059bd2c0
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
    ntdll!NtWaitForMultipleObjects+0xa:
    00000000`77b4186a c3              ret

    PROCESS_NAME:  explorer.exe

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1:  0000000000000008

    EXCEPTION_PARAMETER2:  0000000000000000

    WRITE_ADDRESS:  0000000000000000

    FOLLOWUP_IP:
    duser!GPCB::xwInvokeDirect+67
    000007fe`fbc81df7 448be8          mov     r13d,eax

    FAILED_INSTRUCTION_ADDRESS:
    +67
    00000000`00000000 ??              ???

    NTGLOBALFLAG:  0

    APPLICATION_VERIFIER_FLAGS:  0

    APP:  explorer.exe

    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

    FAULTING_THREAD:  00000000000012c8

    BUGCHECK_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_NULL

    PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT_NULL

    DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT_NULL

    LAST_CONTROL_TRANSFER:  from 000007fefbc81df7 to 0000000000000000

    STACK_TEXT: 
    00000000`059be398 000007fe`fbc81df7 : 00000000`06b84db0 00000000`00000000 00000000`00040001 00000bee`b6e64c36 : 0x0
    00000000`059be3a0 000007fe`fbc88c02 : 00000000`059be518 00000000`06cb6da0 00000000`059be4a0 00000000`059be410 : duser!GPCB::xwInvokeDirect+0x67
    00000000`059be450 000007fe`fbc88d56 : 00000000`06b84c70 00000000`059be9c8 000001b1`000000f3 00000000`00000000 : duser!DuVisual::xrDrawCore+0x1b1
    00000000`059be4f0 000007fe`fbc88dab : 000001b1`000000f3 00000000`06b84c70 000001b1`000000f3 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x107
    00000000`059be550 000007fe`fbc88dab : 000001b1`000000f3 00000000`06b84e50 0000019e`00000072 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be5b0 000007fe`fbc88dab : 0000019e`00000072 00000000`06b858f0 00000189`0000004e 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be610 000007fe`fbc88dab : 00000189`0000004e 00000000`06b85cb0 00000000`0000003f 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be670 000007fe`fbc88dab : 00000000`0000003f 00000000`06b8cb30 00000000`0000003f 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be6d0 000007fe`fbc88dab : 00000000`0000003f 00000000`06b8c8b0 00000000`0000003f 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be730 000007fe`fbc88dab : 00000000`0000003f 00000000`06b8c770 00000000`0000003f 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be790 000007fe`fbc88dab : 00000000`0000003f 00000000`06b8b790 00000000`0000003f 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be7f0 000007fe`fbc88dab : 00000000`0000003f 00000000`06b8b830 00000000`0000003f 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be850 000007fe`fbc88dab : 00000000`0000003f 00000000`06b90190 00000000`0000003f 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be8b0 000007fe`fbc88c5d : 00000000`0000003f 00000000`00000000 00000000`00000000 00000000`00000000 : duser!DuVisual::xrDrawTrivial+0x151
    00000000`059be910 000007fe`fbc89703 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : duser!DuVisual::xrDrawFull+0x929
    00000000`059beac0 000007fe`fbc890d0 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : duser!DuVisual::xrDrawFull+0x97d
    00000000`059bec70 000007fe`fbc88ff7 : 00000000`00000000 00000000`2a010c48 00000000`00000000 00000000`00000000 : duser!DuVisual::xrDrawStart+0x58
    00000000`059beca0 000007fe`fbc88aa7 : 00000000`00000001 00000000`06befa60 00000000`2a010c48 00000000`00000009 : duser!DuRootGadget::xrDrawTree+0x51c
    00000000`059bee80 000007fe`fbc81859 : 00000000`00000000 00000000`00000000 000004b0`00000000 00000000`00000000 : duser!HWndContainer::xdHandleMessage+0x2b4
    00000000`059bf180 00000000`77a08971 : 00000000`00000000 00000000`03d430e0 00000000`00000001 00000000`059bf238 : duser!ExtraInfoWndProc+0x8b
    00000000`059bf1e0 00000000`77a072cb : 00000000`00000000 000007fe`fbc817e4 00000000`00000000 00000000`00000000 : user32!UserCallWinProcCheckWow+0x163
    00000000`059bf2a0 00000000`77a06829 : 00000000`00000000 00000000`77a0919b 00000000`00000000 00000000`00000001 : user32!DispatchClientMessage+0xc3
    00000000`059bf300 00000000`77b411f5 : 00000000`0000000f 00000000`00000000 00000000`00000000 000001e9`000bab7a : user32!_fnDWORD+0x2d
    00000000`059bf360 00000000`77a06e5a : 00000000`77a06e6c 000007fe`f85eb550 00000000`77a0791a 00000000`03d43004 : ntdll!KiUserCallbackDispatcherContinue
    00000000`059bf3e8 00000000`77a06e6c : 000007fe`f85eb550 00000000`77a0791a 00000000`03d43004 00000000`03d430e0 : user32!NtUserDispatchMessage+0xa
    00000000`059bf3f0 000007fe`f84b04b0 : 00000000`03d43004 00000000`03d43004 000007fe`fbc817e4 00000000`00000000 : user32!DispatchMessageWorker+0x55b
    00000000`059bf470 000007fe`f84b4925 : 00000000`03d430e0 00000000`00000002 00000000`00000000 00000000`00000000 : EXPLORERFRAME!CExplorerFrame::FrameMessagePump+0x436
    00000000`059bf4f0 000007fe`f84b509b : 00000000`03d430e0 00000000`03cc8540 00000000`00000000 00000000`00000000 : EXPLORERFRAME!BrowserThreadProc+0x180
    00000000`059bf570 000007fe`f84b5032 : 100ba44a`00000001 00000000`03c97cd0 00000000`7fffffff 000007fe`fd8f2d40 : EXPLORERFRAME!BrowserNewThreadProc+0x53
    00000000`059bf5a0 000007fe`f84abe50 : 00000000`03c97bb0 00000000`03c9ffa0 00000000`00000000 000007fe`fe0bf07c : EXPLORERFRAME!CExplorerTask::InternalResumeRT+0x12
    00000000`059bf5d0 000007fe`fe0befcb : 80000000`01000000 00000000`059bf660 00000000`03c97bb0 00000000`0000000a : EXPLORERFRAME!CRunnableTask::Run+0xda
    00000000`059bf600 000007fe`fe0c2b56 : 00000000`03c97bb0 00000000`00000000 00000000`03c97bb0 00000000`00000002 : shell32!CShellTask::TT_Run+0x124
    00000000`059bf630 000007fe`fe0c2cb2 : 00000000`03d6ec20 00000000`03d6ec20 00000000`00000000 00000000`00000010 : shell32!CShellTaskThread::ThreadProc+0x1d2
    00000000`059bf6d0 000007fe`fedbc71e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shell32!CShellTaskThread::s_ThreadProc+0x22
    00000000`059bf700 00000000`778e59ed : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shlwapi!WrapperThreadProc+0x19b
    00000000`059bf800 00000000`77b1c541 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
    00000000`059bf830 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d


    SYMBOL_STACK_INDEX:  1

    SYMBOL_NAME:  duser!GPCB::xwInvokeDirect+67

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: duser

    IMAGE_NAME:  duser.dll

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bdf26

    STACK_COMMAND:  ~31s; .ecxr ; kb

    FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_NULL_c0000005_duser.dll!GPCB::xwInvokeDirect

    BUCKET_ID:  X64_APPLICATION_FAULT_SOFTWARE_NX_FAULT_NULL_NULL_IP_duser!GPCB::xwInvokeDirect+67

    ANALYSIS_SOURCE:  UM

    FAILURE_ID_HASH_STRING:  um:software_nx_fault_null_c0000005_duser.dll!gpcb::xwinvokedirect

    FAILURE_ID_HASH:  {bc29cea9-f7e5-ba9f-c14c-7ccc77c4be36}

    Followup: MachineOwner

    Saturday, November 29, 2014 4:55 PM
  • Here's another crash dump from last night. Could this be a faulty memory module? I think I should test the memory.

    FAULTING_IP:
    ntdll!RtlFreeHeap+d0
    00000000`77313290 4c8b6308        mov     r12,qword ptr [rbx+8]

    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 0000000077313290 (ntdll!RtlFreeHeap+0x00000000000000d0)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 000003a26e1819f8
    Attempt to read from address 000003a26e1819f8

    CONTEXT:  0000000000000000 -- (.cxr 0x0;r)
    rax=00000000c0000001 rbx=000000000792dba0 rcx=00000000048a0000
    rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000002
    rip=000000007731186a rsp=000000000792da68 rbp=0000000000000002
     r8=000000000792d188  r9=000000000792d2f0 r10=0000000000000000
    r11=0000000000000246 r12=0000000000000000 r13=000000000792db10
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
    ntdll!NtWaitForMultipleObjects+0xa:
    00000000`7731186a c3              ret

    PROCESS_NAME:  explorer.exe

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1:  0000000000000000

    EXCEPTION_PARAMETER2:  000003a26e1819f8

    READ_ADDRESS:  000003a26e1819f8

    FOLLOWUP_IP:
    ntdll!RtlFreeHeap+d0
    00000000`77313290 4c8b6308        mov     r12,qword ptr [rbx+8]

    NTGLOBALFLAG:  0

    APPLICATION_VERIFIER_FLAGS:  0

    APP:  explorer.exe

    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

    ADDITIONAL_DEBUG_TEXT:  Enable Pageheap/AutoVerifer ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

    LAST_CONTROL_TRANSFER:  from 00000000771c1a4a to 0000000077313290

    FAULTING_THREAD:  0000000000000fd8

    DEFAULT_BUCKET_ID:  HEAP_CORRUPTION

    PRIMARY_PROBLEM_CLASS:  HEAP_CORRUPTION

    BUGCHECK_STR:  APPLICATION_FAULT_HEAP_CORRUPTION_HEAP_CORRUPTION_INVALID_POINTER_READ

    STACK_TEXT: 
    00000000`00000000 00000000`00000000 heap_corruption!heap_corruption+0x0


    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  heap_corruption!heap_corruption

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: heap_corruption

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    STACK_COMMAND:  ** Pseudo Context ** ; kb

    FAILURE_BUCKET_ID:  HEAP_CORRUPTION_c0000005_heap_corruption!heap_corruption

    BUCKET_ID:  X64_APPLICATION_FAULT_HEAP_CORRUPTION_HEAP_CORRUPTION_INVALID_POINTER_READ_heap_corruption!heap_corruption

    IMAGE_NAME:  heap_corruption

    ANALYSIS_SOURCE:  UM

    FAILURE_ID_HASH_STRING:  um:heap_corruption_c0000005_heap_corruption!heap_corruption

    FAILURE_ID_HASH:  {bc3c2f6a-a6b5-6b17-b904-78ea927f7380}

    Followup: MachineOwner

    Sunday, November 30, 2014 8:59 PM
  • Hi,

    Sorry for my dilatory reply. According to these analyze results, this problem indeed caused by duser.dll which belongs to Windows DirectUI Engine.

    To resolve this problem, firstly, try to run Sfc /scannow command to fix system componments for test.

    If no use, it would be better to access Windows Recoveroy mode to make system repair.

    In addition, generally speaking, system dll file won't have problem, have you installed any app in your system that may harm to system file before this problem occures? If that it is, please try to uninstall it for test.



    Roger Lu
    TechNet Community Support

    Friday, December 5, 2014 3:17 AM
    Moderator
  • ok so your supposed command (sfc /scannow) isnt a command nothing happens at all wanna try again ..... win 8.1 pro 


    Faulting application name: Explorer.EXE, version: 6.3.9600.17667, time stamp: 0x54c6f7c2
    Faulting module name: DEVRTL.dll, version: 6.3.9600.17415, time stamp: 0x5450429b
    Exception code: 0xc0000005
    Fault offset: 0x0000000000001475
    Faulting process id: 0x17fc
    Faulting application start time: 0x01d0a793c0a8fa7b
    Faulting application path: C:\WINDOWS\Explorer.EXE
    Faulting module path: C:\WINDOWS\SYSTEM32\DEVRTL.dll
    Report Id: 4ab9cdea-1388-11e5-8286-f46d04e6078c
    Faulting package full name: 
    Faulting package-relative application ID: 
    Monday, June 15, 2015 6:17 PM
  • Run cmd as admin.
    Monday, February 8, 2016 6:15 PM