XP Pro. SP2's explorer.exe crashing a lot and randomly.

July 13, 2008

Ever since 7/9/2008 according Windows' event logs, I noticed my

explorer.exe would crash randomly and I can't figure out what is causing

it and why. I tried removing, disabling, downgrading, etc.

programs/updates (e.g., SpyBot v1.6.0, KB951748 (DNS), Windows Malicious

Software Removal Tool - July 2008 (KB890830) [don't think it removed

anything], uninstalling Sun Java 6 Update 6 to install update #7,

K-Lite Codec Full Pack v4.00, and TrueCrypt v6.0 portable. These were

the products that I recall installing since then. I might have more and

need to dig and think more.

I already ran full scans with the latest definitions from Norton

AntiVirus, SpyBot, SuperAntiSpyware, Ad-Aware SE Perosonal, and

a-squared Free.

I am not a programmer/developer so I am hoping my memory dumps and logs

would help. I did notice it can take hours for the crashes to occur.

When the firs tone strike, then explorer.exe will crash randomly like

crazy. Even Start Menu will start going nuts. I have to reboot to keep

it stable for a few hours. I doubt it is temperature related because my

other software and hardware don't crash.

Here are the first two event log crashes:

Event Type: Error

Event Source: Application Error

Event Category: None

Event ID: 1000

Date: 7/9/2008

Time: 8:11:36 AM

User: N/A

Description:

Faulting application explorer.exe, version 6.0.2900.3156, faulting

module comctl32.dll, version 6.0.2900.2982, fault address 0x0002918d.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 41 70 70 6c 69 63 61 74 Applicat

0008: 69 6f 6e 20 46 61 69 6c ion Fail

0010: 75 72 65 20 20 65 78 70 ure exp

0018: 6c 6f 72 65 72 2e 65 78 lorer.ex

0020: 65 20 36 2e 30 2e 32 39 e 6.0.29

0028: 30 30 2e 33 31 35 36 20 00.3156

0030: 69 6e 20 63 6f 6d 63 74 in comct

0038: 6c 33 32 2e 64 6c 6c 20 l32.dll

0040: 36 2e 30 2e 32 39 30 30 6.0.2900

0048: 2e 32 39 38 32 20 61 74 .2982 at

0050: 20 6f 66 66 73 65 74 20 offset

0058: 30 30 30 32 39 31 38 64 0002918d

0060: 0d 0a ..

Event Type: Error

Event Source: Application Error

Event Category: (100)

Event ID: 1000

Date: 7/9/2008

Time: 8:11:40 AM

User: N/A

Description:

Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module

dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 41 70 70 6c 69 63 61 74 Applicat

0008: 69 6f 6e 20 46 61 69 6c ion Fail

0010: 75 72 65 20 20 64 72 77 ure drw

0018: 74 73 6e 33 32 2e 65 78 tsn32.ex

0020: 65 20 35 2e 31 2e 32 36 e 5.1.26

0028: 30 30 2e 30 20 69 6e 20 00.0 in

0030: 64 62 67 68 65 6c 70 2e dbghelp.

0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.

0040: 32 36 30 30 2e 32 31 38 2600.218

0048: 30 20 61 74 20 6f 66 66 0 at off

0050: 73 65 74 20 30 30 30 31 set 0001

0058: 32 39 35 64 295d

I also noticed explorer.exe doesn't return and Dr. Watson gets stuck and

crashes too. I have to kill their processes to restart Explorer manually

via Task Manager.

Any ideas? Thank you in advance. :)

--

Allah's Apostle said, "Once while a prophet amongst the prophets was

taking a rest underneath a tree, an ant bit him. He, therefore, ordered

that his luggage be taken away from underneath that tree and then

ordered that the dwelling place of the ants should be set on fire. Allah

sent him a revelation: 'Wouldn't it have been sufficient to burn a

single ant (that bit you)?'" --Translation of Sahih Bukhari, Book 54,

Number 536

/\___/\

/ /\ /\ \ Phil/Ant @ http://antfarm.home.dhs.org (Personal Web Site)

| |o o| | Ant's Quality Foraged Links (AQFL): http://aqfl.net

\ _ / Remove ANT from e-mail address: philpi@earthlink.netANT

( ) or ANTant@zimage.com

Ant is currently not listening to any songs on his home computer.

July 13, 2008

Re: XP Pro. SP2's explorer.exe crashing a lot and randomly.

And I forgot the crash dumps and logs to share:

http://alpha.zimage.com/~ant/temp/DebugDiagnosticsLogsAndDumps.zip (will

be deleted when resolved).

On 7/13/2008 10:20 AM PT, Ant typed:

> Ever since 7/9/2008 according Windows' event logs, I noticed my

> explorer.exe would crash randomly and I can't figure out what is causing

> it and why. I tried removing, disabling, downgrading, etc.

> programs/updates (e.g., SpyBot v1.6.0, KB951748 (DNS), Windows Malicious

> Software Removal Tool - July 2008 (KB890830) [don't think it removed

> anything], uninstalling Sun Java 6 Update 6 to install update #7,

> K-Lite Codec Full Pack v4.00, and TrueCrypt v6.0 portable. These were

> the products that I recall installing since then. I might have more and

> need to dig and think more.

>

> I already ran full scans with the latest definitions from Norton

> AntiVirus, SpyBot, SuperAntiSpyware, Ad-Aware SE Perosonal, and

> a-squared Free.

>

> I am not a programmer/developer so I am hoping my memory dumps and logs

> would help. I did notice it can take hours for the crashes to occur.

> When the firs tone strike, then explorer.exe will crash randomly like

> crazy. Even Start Menu will start going nuts. I have to reboot to keep

> it stable for a few hours. I doubt it is temperature related because my

> other software and hardware don't crash.

>

> Here are the first two event log crashes:

> Event Type: Error

> Event Source: Application Error

> Event Category: None

> Event ID: 1000

> Date: 7/9/2008

> Time: 8:11:36 AM

> User: N/A

> Description:

> Faulting application explorer.exe, version 6.0.2900.3156, faulting

> module comctl32.dll, version 6.0.2900.2982, fault address 0x0002918d.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

> Data:

> 0000: 41 70 70 6c 69 63 61 74 Applicat

> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

> 0010: 75 72 65 20 20 65 78 70 ure exp

> 0018: 6c 6f 72 65 72 2e 65 78 lorer.ex

> 0020: 65 20 36 2e 30 2e 32 39 e 6.0.29

> 0028: 30 30 2e 33 31 35 36 20 00.3156

> 0030: 69 6e 20 63 6f 6d 63 74 in comct

> 0038: 6c 33 32 2e 64 6c 6c 20 l32.dll

> 0040: 36 2e 30 2e 32 39 30 30 6.0.2900

> 0048: 2e 32 39 38 32 20 61 74 .2982 at

> 0050: 20 6f 66 66 73 65 74 20 offset

> 0058: 30 30 30 32 39 31 38 64 0002918d

> 0060: 0d 0a ..

>

> Event Type: Error

> Event Source: Application Error

> Event Category: (100)

> Event ID: 1000

> Date: 7/9/2008

> Time: 8:11:40 AM

> User: N/A

> Description:

> Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module

> dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

>

> For more information, see Help and Support Center at

> http://go.microsoft.com/fwlink/events.asp.

> Data:

> 0000: 41 70 70 6c 69 63 61 74 Applicat

> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

> 0010: 75 72 65 20 20 64 72 77 ure drw

> 0018: 74 73 6e 33 32 2e 65 78 tsn32.ex

> 0020: 65 20 35 2e 31 2e 32 36 e 5.1.26

> 0028: 30 30 2e 30 20 69 6e 20 00.0 in

> 0030: 64 62 67 68 65 6c 70 2e dbghelp.

> 0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.

> 0040: 32 36 30 30 2e 32 31 38 2600.218

> 0048: 30 20 61 74 20 6f 66 66 0 at off

> 0050: 73 65 74 20 30 30 30 31 set 0001

> 0058: 32 39 35 64 295d

>

> I also noticed explorer.exe doesn't return and Dr. Watson gets stuck and

> crashes too. I have to kill their processes to restart Explorer manually

> via Task Manager.

>

> Any ideas? Thank you in advance. :)

--

"... Ooh, we haven't done that in a long time. I love picnics. I'll

bring my ant jar." --The Berenstain Bears (unknown episode)

/\___/\

/ /\ /\ \ Phil/Ant @ http://antfarm.home.dhs.org (Personal Web Site)

| |o o| | Ant's Quality Foraged Links (AQFL): http://aqfl.net

\ _ / Remove ANT from e-mail address: philpi@earthlink.netANT

( ) or ANTant@zimage.com

Ant is currently not listening to any songs on his home computer.

July 13, 2008

Re: XP Pro. SP2's explorer.exe crashing a lot and randomly.

From WinDbg (will collect more later):

Microsoft ® Windows Debugger Version 6.9.0003.113 X86

Loading Dump File

[C:\Explorer__PID__1908__Date__07_13_2008__Time_09_40_09AM__561__Second_Chance_Exception_C0000005.dmp]

User Mini Dump File with Full Memory: Only application data is available

Comment: 'Dump created by DbgHost. Second_Chance_Exception_C0000005'

Symbol search path is:

srv*e:\winstuff\symbols\*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows XP Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible

Product: WinNt, suite: SingleUserTS

Debug session time: Sun Jul 13 09:40:10.000 2008 (GMT-7)

System Uptime: 0 days 12:22:07.627

Process Uptime: 0 days 12:21:17.000

...............................................................................................................................

Loading unloaded module list

.................

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(774.638): Access violation - code c0000005 (first/second chance not

available)

eax=0451f720 ebx=00000019 ecx=00090000 edx=00090240 esi=d6329417

edi=0451f718

eip=7c911629 esp=014ae274 ebp=014ae494 iopl=0 nv up ei pl nz na

po nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000

efl=00000202

ntdll!RtlAllocateHeap+0x9bb:

7c911629 8906 mov dword ptr [esi],eax

ds:0023:d6329417=????????

0:001> !analyze -v

*******************************************************************************

*

* Exception Analysis

*

*******************************************************************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols

for events.dll -

*************************************************************************

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: kernel32!pNlsUserInfo ***

*** ***

*************************************************************************

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: kernel32!pNlsUserInfo ***

*** ***

*************************************************************************

FAULTING_IP:

ntdll!RtlAllocateHeap+9bb

7c911629 8906 mov dword ptr [esi],eax

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)

ExceptionAddress: 7c911629 (ntdll!RtlAllocateHeap+0x000009bb)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000001

Parameter[1]: d6329417

Attempt to write to address d6329417

PROCESS_NAME: explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: d6329417

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer

FAULTING_THREAD: 00000638

BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_HEAP_CORRUPTION

PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ

DEFAULT_BUCKET_ID: INVALID_POINTER_READ

LAST_CONTROL_TRANSFER: from 7c8099df to 7c911629

STACK_TEXT:

014ae494 7c8099df 00090000 00140008 00000708 ntdll!RtlAllocateHeap+0x9bb

014ae4e0 7e2a545d 00000040 00000708 00000000 kernel32!LocalAlloc+0x58

014ae500 7ca303c1 01c17178 00000096 00000001 shdocvw!CMruBase::InitData+0x69

014ae530 7cac34d5 00000000 00000000 00000001

shell32!CreateSharedRecentMRUList+0xc1

014ae544 7cac38b1 014ae55c 044e8b88 00000104

shell32!CreateRecentMRUList+0x10

014aeb7c 7ca518a5 000f7490 014aee00 00000104

shell32!RecentDocs_GetDisplayName+0x2d

014af00c 7c9ec66a 044e8b98 000f7490 00000000

shell32!CFSFolder::GetDisplayNameOf+0x1c7

014af130 7ca16455 044e8b98 000f7490 00000000 shell32!DisplayNameOf+0x29

014af14c 7ca17189 000f7490 014af1a0 00000104

shell32!CSFToolbar::_ObtainPIDLName+0x1b

014af3ac 7ca168eb 00179540 00000000 00000000

shell32!CSFToolbar::_AddOrderItemTB+0x58

014af3c4 7ca17bb8 00179540 00000000 00000000

shell32!CMenuSFToolbar::_AddOrderItemTB+0x16

014af3e4 7ca17b4b 00000000 00000001 00000000

shell32!CSFToolbar::_AddPidl+0x75

014af404 7ca15fe6 000f7490 00000001 00000000

shell32!CMenuSFToolbar::_AddPidl+0xad

014af428 7ca17e62 000f7490 00000001 00000000

shell32!CSFToolbar::_OnFSNotifyAdd+0xed

014af44c 7ca17922 0011bf68 00000001 00000000

shell32!CMenuSFToolbar::_OnFSNotifyAdd+0x9e

014af49c 7ca17dcd 01bdfae0 01bdfbc4 7ca1906c

shell32!CSFToolbar::_FillToolbar+0x20f

014af4a8 7ca1906c 00000001 00000001 01c6ab60

shell32!CMenuSFToolbar::_FillToolbar+0x4b

014af4c0 7ca18dc3 00000001 00000001 01c053e8

shell32!CMenuSFToolbar::v_Show+0x4f

014af4dc 7ca18bbd 00000001 00000001 014af504 shell32!CMenuBand::ShowDW+0x18b

014af4ec 7ca18e38 01bb451c 00000001 60000000

shell32!CMenuSite::UIActivateDBC+0x21

014af504 7ca1aa2a 01c053e8 00000001 014af6e4 shell32!CBaseBar::ShowDW+0x43

014af530 0101b345 01c6ab74 014af6e4 014af6e4

shell32!CMenuDeskBar::Popup+0xa2

014af548 0101b313 014af6e4 60000000 014af6d4 explorer!CPopupMenu::Popup+0x17

014af564 0101b6b4 60000000 014af600 010069e3

explorer!CDesktopHost::OnTrackShellMenu+0xd0

014af598 7e418734 000a00c4 0000004e 00000003

explorer!CDesktopHost::WndProc+0x24d

014af5c4 7e418816 010069e3 000a00c4 0000004e user32!InternalCallWinProc+0x28

014af62c 7e41b89b 0009eb70 010069e3 000a00c4

user32!UserCallWinProcCheckWow+0x150

014af668 7e41b903 005693f0 0053aa70 00000003 user32!SendMessageWorker+0x4a5

014af688 01008f92 000a00c4 0000004e 00000003 user32!SendMessageW+0x7f

014af6b4 010403f5 00070094 000000d0 014af6d4 explorer!_SendNotify+0x3b

014af6fc 010414ef 00000001 00000000 01c15080

explorer!SFTBarHost::_OnCascade+0x82

014af718 0104160e 00000001 00000000 014af770

explorer!SFTBarHost::_ActivateItem+0x25

014af728 01029174 014af938 0000004e 00070094

explorer!SFTBarHost::_OnLVNItemActivate+0x12

014af770 0100401d 00070094 0000004e 00000000

explorer!SFTBarHost::_OnNotify+0xaa

014af790 7e418734 00070094 0000004e 00000000

explorer!SFTBarHost::_WndProc+0x31c

014af7bc 7e418816 01003fb5 00070094 0000004e user32!InternalCallWinProc+0x28

014af824 7e41b89b 0009eb70 01003fb5 00070094

user32!UserCallWinProcCheckWow+0x150

014af860 7e41b903 005c89d0 0053ac28 00000000 user32!SendMessageWorker+0x4a5

014af880 773eaff1 00070094 0000004e 00000000 user32!SendMessageW+0x7f

014af918 77420870 01c295e0 fffffffe 014af938 comctl32!CCSendNotify+0xc20

014af994 77420aa6 00070062 00000000 000000a3

comctl32!ListView_HandleMouse+0x37d

014af9b4 774214d9 01c295e0 00000000 000000a3

comctl32!ListView_OnButtonDown+0x1b

014afb24 7e418734 00070062 00000201 00000001 comctl32!ListView_WndProc+0x857

014afb50 7e418816 77420c82 00070062 00000201 user32!InternalCallWinProc+0x28

014afbb8 7e41c63f 0009eb70 77420c82 00070062

user32!UserCallWinProcCheckWow+0x150

014afbe8 7e41c665 77420c82 00070062 00000201 user32!CallWindowProcAorW+0x98

014afc08 773e1b57 77420c82 00070062 00000201 user32!CallWindowProcW+0x1b

014afc24 773e1eaa 00070062 00000201 00000001

comctl32!CallOriginalWndProc+0x1a

014afc80 773e206c 01b98b70 00070062 00000201

comctl32!CallNextSubclassProc+0x3c

014afca4 01007883 00070062 00000201 00000001 comctl32!DefSubclassProc+0x46

014afcc4 773e1eaa 00070062 00000201 00000001

explorer!CAccessible::s_SubclassProc+0x34

014afd20 773e206c 01b98b70 00070062 00000201

comctl32!CallNextSubclassProc+0x3c

014afd44 010078c5 00070062 00000201 00000001 comctl32!DefSubclassProc+0x46

014afd5c 773e1eaa 00070062 00000201 00000001

explorer!SFTBarHost::s_DropTargetSubclassProc+0x8e

014afdb8 773e20cf 01b98b70 00070062 00000201

comctl32!CallNextSubclassProc+0x3c

014afe0c 7e418734 00070062 00000201 00000001

comctl32!MasterSubclassProc+0x54

014afe38 7e418816 773e207b 00070062 00000201 user32!InternalCallWinProc+0x28

014afea0 7e4189cd 0009eb70 773e207b 00070062

user32!UserCallWinProcCheckWow+0x150

014aff00 7e418a10 014aff28 00000000 014aff44

user32!DispatchMessageWorker+0x306

014aff10 01001a35 014aff28 00000000 010460f8 user32!DispatchMessageW+0xf

014aff44 0100ff89 00000000 014affb4 77f76f42

explorer!CTray::_MessageLoop+0xd9

014aff50 77f76f42 010460f8 0000005c 0007fc04

explorer!CTray::MainThreadProc+0x29

014affb4 7c80b683 00000000 0000005c 0007fc04 shlwapi!WrapperThreadProc+0x94

014affec 00000000 77f76ed3 0007fdbc 00000000 kernel32!BaseThreadStart+0x37

STACK_COMMAND: ~1s; .ecxr ; kb

SYMBOL_NAME: heap_corruption!heap_corruption

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: heap_corruption

IMAGE_NAME: heap_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID:

INVALID_POINTER_READ_c0000005_heap_corruption!heap_corruption

BUCKET_ID:

APPLICATION_FAULT_INVALID_POINTER_READ_HEAP_CORRUPTION_heap_corruption!heap_corruption

Followup: MachineOwner

---------

0:001> lmvm heap_corruption

start end module name

On 7/13/2008 10:25 AM PT, Ant typed:

> And I forgot the crash dumps and logs to share:

> http://alpha.zimage.com/~ant/temp/DebugDiagnosticsLogsAndDumps.zip (will

> be deleted when resolved).

>

> On 7/13/2008 10:20 AM PT, Ant typed:

>

>> Ever since 7/9/2008 according Windows' event logs, I noticed my

>> explorer.exe would crash randomly and I can't figure out what is

>> causing it and why. I tried removing, disabling, downgrading, etc.

>> programs/updates (e.g., SpyBot v1.6.0, KB951748 (DNS), Windows

>> Malicious Software Removal Tool - July 2008 (KB890830) [don't think it

>> removed anything], uninstalling Sun Java 6 Update 6 to install

>> update #7, K-Lite Codec Full Pack v4.00, and TrueCrypt v6.0 portable.

>> These were the products that I recall installing since then. I might

>> have more and need to dig and think more.

>>

>> I already ran full scans with the latest definitions from Norton

>> AntiVirus, SpyBot, SuperAntiSpyware, Ad-Aware SE Perosonal, and

>> a-squared Free.

>>

>> I am not a programmer/developer so I am hoping my memory dumps and

>> logs would help. I did notice it can take hours for the crashes to

>> occur. When the firs tone strike, then explorer.exe will crash

>> randomly like crazy. Even Start Menu will start going nuts. I have to

>> reboot to keep it stable for a few hours. I doubt it is temperature

>> related because my other software and hardware don't crash.

>>

>> Here are the first two event log crashes:

>> Event Type: Error

>> Event Source: Application Error

>> Event Category: None

>> Event ID: 1000

>> Date: 7/9/2008

>> Time: 8:11:36 AM

>> User: N/A

>> Description:

>> Faulting application explorer.exe, version 6.0.2900.3156, faulting

>> module comctl32.dll, version 6.0.2900.2982, fault address 0x0002918d.

>>

>> For more information, see Help and Support Center at

>> http://go.microsoft.com/fwlink/events.asp.

>> Data:

>> 0000: 41 70 70 6c 69 63 61 74 Applicat

>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

>> 0010: 75 72 65 20 20 65 78 70 ure exp

>> 0018: 6c 6f 72 65 72 2e 65 78 lorer.ex

>> 0020: 65 20 36 2e 30 2e 32 39 e 6.0.29

>> 0028: 30 30 2e 33 31 35 36 20 00.3156

>> 0030: 69 6e 20 63 6f 6d 63 74 in comct

>> 0038: 6c 33 32 2e 64 6c 6c 20 l32.dll

>> 0040: 36 2e 30 2e 32 39 30 30 6.0.2900

>> 0048: 2e 32 39 38 32 20 61 74 .2982 at

>> 0050: 20 6f 66 66 73 65 74 20 offset

>> 0058: 30 30 30 32 39 31 38 64 0002918d

>> 0060: 0d 0a ..

>>

>> Event Type: Error

>> Event Source: Application Error

>> Event Category: (100)

>> Event ID: 1000

>> Date: 7/9/2008

>> Time: 8:11:40 AM

>> User: N/A

>> Description:

>> Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module

>> dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

>>

>> For more information, see Help and Support Center at

>> http://go.microsoft.com/fwlink/events.asp.

>> Data:

>> 0000: 41 70 70 6c 69 63 61 74 Applicat

>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

>> 0010: 75 72 65 20 20 64 72 77 ure drw

>> 0018: 74 73 6e 33 32 2e 65 78 tsn32.ex

>> 0020: 65 20 35 2e 31 2e 32 36 e 5.1.26

>> 0028: 30 30 2e 30 20 69 6e 20 00.0 in

>> 0030: 64 62 67 68 65 6c 70 2e dbghelp.

>> 0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.

>> 0040: 32 36 30 30 2e 32 31 38 2600.218

>> 0048: 30 20 61 74 20 6f 66 66 0 at off

>> 0050: 73 65 74 20 30 30 30 31 set 0001

>> 0058: 32 39 35 64 295d

>>

>> I also noticed explorer.exe doesn't return and Dr. Watson gets stuck

>> and crashes too. I have to kill their processes to restart Explorer

>> manually via Task Manager.

>>

>> Any ideas? Thank you in advance. :)

--

"The foreign policy aim of ants can be summed up as follows: restless

aggression, territorial conquest, and genocidal annihilation of

neighboring colonies whenever possible. If ants had nuclear weapons,

they would probably end the world in a week." --Journey to the Ants,

page 59. Bert Holldobler & Edward O. Wilson

/\___/\

/ /\ /\ \ Phil/Ant @ http://antfarm.home.dhs.org (Personal Web Site)

| |o o| | Ant's Quality Foraged Links (AQFL): http://aqfl.net

\ _ / Remove ANT from e-mail address: philpi@earthlink.netANT

( ) or ANTant@zimage.com

Ant is currently not listening to any songs on his home computer.

July 13, 2008

Re: XP Pro. SP2's explorer.exe crashing a lot and randomly.

Try my Explorer Shell Fix tool. Download it here

http://pcbutts1.com/downloads/tools/tools.htm

--

Ignore posts made by the person called Leythos, he is a stalker who's been

obsessed with me for years ever since I spurned his advances towards me.

"Ant" <philpi@earthlink.netANT> wrote in message

news:O$DdMOR5IHA.3420@TK2MSFTNGP05.phx.gbl...

> From WinDbg (will collect more later):

>

> Microsoft ® Windows Debugger Version 6.9.0003.113 X86

>

> Loading Dump File

> [C:\Explorer__PID__1908__Date__07_13_2008__Time_09_40_09AM__561__Second_Chance_Exception_C0000005.dmp]

> User Mini Dump File with Full Memory: Only application data is available

>

> Comment: 'Dump created by DbgHost. Second_Chance_Exception_C0000005'

> Symbol search path is:

> srv*e:\winstuff\symbols\*http://msdl.microsoft.com/download/symbols

> Executable search path is:

> Windows XP Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible

> Product: WinNt, suite: SingleUserTS

> Debug session time: Sun Jul 13 09:40:10.000 2008 (GMT-7)

> System Uptime: 0 days 12:22:07.627

> Process Uptime: 0 days 12:21:17.000

> ..............................................................................................................................

> Loading unloaded module list

> ................

> This dump file has an exception of interest stored in it.

> The stored exception information can be accessed via .ecxr.

> (774.638): Access violation - code c0000005 (first/second chance not

> available)

> eax=0451f720 ebx=00000019 ecx=00090000 edx=00090240 esi=d6329417

> edi=0451f718

> eip=7c911629 esp=014ae274 ebp=014ae494 iopl=0 nv up ei pl nz na po

> nc

> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202

> ntdll!RtlAllocateHeap+0x9bb:

> 7c911629 8906 mov dword ptr [esi],eax

> ds:0023:d6329417=????????

> 0:001> !analyze -v

> *******************************************************************************

> * *

> * Exception Analysis *

> * *

> *******************************************************************************

>

> *** ERROR: Symbol file could not be found. Defaulted to export symbols

> for events.dll -

> *************************************************************************

> *** ***

> *** Your debugger is not using the correct symbols ***

> *** ***

> *** In order for this command to work properly, your symbol path ***

> *** must point to .pdb files that have full type information. ***

> *** ***

> *** Certain .pdb files (such as the public OS symbols) do not ***

> *** contain the required information. Contact the group that ***

> *** provided you with these symbols if you need this command to ***

> *** work. ***

> *** ***

> *** Type referenced: kernel32!pNlsUserInfo ***

> *** ***

> *************************************************************************

> *** ***

> *** Your debugger is not using the correct symbols ***

> *** ***

> *** In order for this command to work properly, your symbol path ***

> *** must point to .pdb files that have full type information. ***

> *** ***

> *** Certain .pdb files (such as the public OS symbols) do not ***

> *** contain the required information. Contact the group that ***

> *** provided you with these symbols if you need this command to ***

> *** work. ***

> *** ***

> *** Type referenced: kernel32!pNlsUserInfo ***

> *** ***

> *************************************************************************

>

> FAULTING_IP:

> ntdll!RtlAllocateHeap+9bb

> 7c911629 8906 mov dword ptr [esi],eax

>

> EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)

> ExceptionAddress: 7c911629 (ntdll!RtlAllocateHeap+0x000009bb)

> ExceptionCode: c0000005 (Access violation)

> ExceptionFlags: 00000000

> NumberParameters: 2

> Parameter[0]: 00000001

> Parameter[1]: d6329417

> Attempt to write to address d6329417

>

> PROCESS_NAME: explorer.exe

>

> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"

> referenced memory at "0x%08lx". The memory could not be "%s".

>

> WRITE_ADDRESS: d6329417

>

> NTGLOBALFLAG: 0

>

> APPLICATION_VERIFIER_FLAGS: 0

>

> ADDITIONAL_DEBUG_TEXT: Enable Pageheap/AutoVerifer

>

> FAULTING_THREAD: 00000638

>

> BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_HEAP_CORRUPTION

>

> PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ

>

> DEFAULT_BUCKET_ID: INVALID_POINTER_READ

>

> LAST_CONTROL_TRANSFER: from 7c8099df to 7c911629

>

> STACK_TEXT:

> 014ae494 7c8099df 00090000 00140008 00000708 ntdll!RtlAllocateHeap+0x9bb

> 014ae4e0 7e2a545d 00000040 00000708 00000000 kernel32!LocalAlloc+0x58

> 014ae500 7ca303c1 01c17178 00000096 00000001

> shdocvw!CMruBase::InitData+0x69

> 014ae530 7cac34d5 00000000 00000000 00000001

> shell32!CreateSharedRecentMRUList+0xc1

> 014ae544 7cac38b1 014ae55c 044e8b88 00000104

> shell32!CreateRecentMRUList+0x10

> 014aeb7c 7ca518a5 000f7490 014aee00 00000104

> shell32!RecentDocs_GetDisplayName+0x2d

> 014af00c 7c9ec66a 044e8b98 000f7490 00000000

> shell32!CFSFolder::GetDisplayNameOf+0x1c7

> 014af130 7ca16455 044e8b98 000f7490 00000000 shell32!DisplayNameOf+0x29

> 014af14c 7ca17189 000f7490 014af1a0 00000104

> shell32!CSFToolbar::_ObtainPIDLName+0x1b

> 014af3ac 7ca168eb 00179540 00000000 00000000

> shell32!CSFToolbar::_AddOrderItemTB+0x58

> 014af3c4 7ca17bb8 00179540 00000000 00000000

> shell32!CMenuSFToolbar::_AddOrderItemTB+0x16

> 014af3e4 7ca17b4b 00000000 00000001 00000000

> shell32!CSFToolbar::_AddPidl+0x75

> 014af404 7ca15fe6 000f7490 00000001 00000000

> shell32!CMenuSFToolbar::_AddPidl+0xad

> 014af428 7ca17e62 000f7490 00000001 00000000

> shell32!CSFToolbar::_OnFSNotifyAdd+0xed

> 014af44c 7ca17922 0011bf68 00000001 00000000

> shell32!CMenuSFToolbar::_OnFSNotifyAdd+0x9e

> 014af49c 7ca17dcd 01bdfae0 01bdfbc4 7ca1906c

> shell32!CSFToolbar::_FillToolbar+0x20f

> 014af4a8 7ca1906c 00000001 00000001 01c6ab60

> shell32!CMenuSFToolbar::_FillToolbar+0x4b

> 014af4c0 7ca18dc3 00000001 00000001 01c053e8

> shell32!CMenuSFToolbar::v_Show+0x4f

> 014af4dc 7ca18bbd 00000001 00000001 014af504

> shell32!CMenuBand::ShowDW+0x18b

> 014af4ec 7ca18e38 01bb451c 00000001 60000000

> shell32!CMenuSite::UIActivateDBC+0x21

> 014af504 7ca1aa2a 01c053e8 00000001 014af6e4 shell32!CBaseBar::ShowDW+0x43

> 014af530 0101b345 01c6ab74 014af6e4 014af6e4

> shell32!CMenuDeskBar::Popup+0xa2

> 014af548 0101b313 014af6e4 60000000 014af6d4

> explorer!CPopupMenu::Popup+0x17

> 014af564 0101b6b4 60000000 014af600 010069e3

> explorer!CDesktopHost::OnTrackShellMenu+0xd0

> 014af598 7e418734 000a00c4 0000004e 00000003

> explorer!CDesktopHost::WndProc+0x24d

> 014af5c4 7e418816 010069e3 000a00c4 0000004e

> user32!InternalCallWinProc+0x28

> 014af62c 7e41b89b 0009eb70 010069e3 000a00c4

> user32!UserCallWinProcCheckWow+0x150

> 014af668 7e41b903 005693f0 0053aa70 00000003

> user32!SendMessageWorker+0x4a5

> 014af688 01008f92 000a00c4 0000004e 00000003 user32!SendMessageW+0x7f

> 014af6b4 010403f5 00070094 000000d0 014af6d4 explorer!_SendNotify+0x3b

> 014af6fc 010414ef 00000001 00000000 01c15080

> explorer!SFTBarHost::_OnCascade+0x82

> 014af718 0104160e 00000001 00000000 014af770

> explorer!SFTBarHost::_ActivateItem+0x25

> 014af728 01029174 014af938 0000004e 00070094

> explorer!SFTBarHost::_OnLVNItemActivate+0x12

> 014af770 0100401d 00070094 0000004e 00000000

> explorer!SFTBarHost::_OnNotify+0xaa

> 014af790 7e418734 00070094 0000004e 00000000

> explorer!SFTBarHost::_WndProc+0x31c

> 014af7bc 7e418816 01003fb5 00070094 0000004e

> user32!InternalCallWinProc+0x28

> 014af824 7e41b89b 0009eb70 01003fb5 00070094

> user32!UserCallWinProcCheckWow+0x150

> 014af860 7e41b903 005c89d0 0053ac28 00000000

> user32!SendMessageWorker+0x4a5

> 014af880 773eaff1 00070094 0000004e 00000000 user32!SendMessageW+0x7f

> 014af918 77420870 01c295e0 fffffffe 014af938 comctl32!CCSendNotify+0xc20

> 014af994 77420aa6 00070062 00000000 000000a3

> comctl32!ListView_HandleMouse+0x37d

> 014af9b4 774214d9 01c295e0 00000000 000000a3

> comctl32!ListView_OnButtonDown+0x1b

> 014afb24 7e418734 00070062 00000201 00000001

> comctl32!ListView_WndProc+0x857

> 014afb50 7e418816 77420c82 00070062 00000201

> user32!InternalCallWinProc+0x28

> 014afbb8 7e41c63f 0009eb70 77420c82 00070062

> user32!UserCallWinProcCheckWow+0x150

> 014afbe8 7e41c665 77420c82 00070062 00000201

> user32!CallWindowProcAorW+0x98

> 014afc08 773e1b57 77420c82 00070062 00000201 user32!CallWindowProcW+0x1b

> 014afc24 773e1eaa 00070062 00000201 00000001

> comctl32!CallOriginalWndProc+0x1a

> 014afc80 773e206c 01b98b70 00070062 00000201

> comctl32!CallNextSubclassProc+0x3c

> 014afca4 01007883 00070062 00000201 00000001 comctl32!DefSubclassProc+0x46

> 014afcc4 773e1eaa 00070062 00000201 00000001

> explorer!CAccessible::s_SubclassProc+0x34

> 014afd20 773e206c 01b98b70 00070062 00000201

> comctl32!CallNextSubclassProc+0x3c

> 014afd44 010078c5 00070062 00000201 00000001 comctl32!DefSubclassProc+0x46

> 014afd5c 773e1eaa 00070062 00000201 00000001

> explorer!SFTBarHost::s_DropTargetSubclassProc+0x8e

> 014afdb8 773e20cf 01b98b70 00070062 00000201

> comctl32!CallNextSubclassProc+0x3c

> 014afe0c 7e418734 00070062 00000201 00000001

> comctl32!MasterSubclassProc+0x54

> 014afe38 7e418816 773e207b 00070062 00000201

> user32!InternalCallWinProc+0x28

> 014afea0 7e4189cd 0009eb70 773e207b 00070062

> user32!UserCallWinProcCheckWow+0x150

> 014aff00 7e418a10 014aff28 00000000 014aff44

> user32!DispatchMessageWorker+0x306

> 014aff10 01001a35 014aff28 00000000 010460f8 user32!DispatchMessageW+0xf

> 014aff44 0100ff89 00000000 014affb4 77f76f42

> explorer!CTray::_MessageLoop+0xd9

> 014aff50 77f76f42 010460f8 0000005c 0007fc04

> explorer!CTray::MainThreadProc+0x29

> 014affb4 7c80b683 00000000 0000005c 0007fc04

> shlwapi!WrapperThreadProc+0x94

> 014affec 00000000 77f76ed3 0007fdbc 00000000 kernel32!BaseThreadStart+0x37

>

> STACK_COMMAND: ~1s; .ecxr ; kb

>

> SYMBOL_NAME: heap_corruption!heap_corruption

>

> FOLLOWUP_NAME: MachineOwner

>

> MODULE_NAME: heap_corruption

>

> IMAGE_NAME: heap_corruption

>

> DEBUG_FLR_IMAGE_TIMESTAMP: 0

>

> FAILURE_BUCKET_ID:

> INVALID_POINTER_READ_c0000005_heap_corruption!heap_corruption

>

> BUCKET_ID:

> APPLICATION_FAULT_INVALID_POINTER_READ_HEAP_CORRUPTION_heap_corruption!heap_corruption

>

> Followup: MachineOwner

> ---------

>

> 0:001> lmvm heap_corruption

> start end module name

>

> On 7/13/2008 10:25 AM PT, Ant typed:

>

>> And I forgot the crash dumps and logs to share:

>> http://alpha.zimage.com/~ant/temp/DebugDiagnosticsLogsAndDumps.zip (will

>> be deleted when resolved).

>>

>> On 7/13/2008 10:20 AM PT, Ant typed:

>>

>>> Ever since 7/9/2008 according Windows' event logs, I noticed my

>>> explorer.exe would crash randomly and I can't figure out what is causing

>>> it and why. I tried removing, disabling, downgrading, etc.

>>> programs/updates (e.g., SpyBot v1.6.0, KB951748 (DNS), Windows Malicious

>>> Software Removal Tool - July 2008 (KB890830) [don't think it removed

>>> anything], uninstalling Sun Java 6 Update 6 to install update #7,

>>> K-Lite Codec Full Pack v4.00, and TrueCrypt v6.0 portable. These were

>>> the products that I recall installing since then. I might have more and

>>> need to dig and think more.

>>>

>>> I already ran full scans with the latest definitions from Norton

>>> AntiVirus, SpyBot, SuperAntiSpyware, Ad-Aware SE Perosonal, and

>>> a-squared Free.

>>>

>>> I am not a programmer/developer so I am hoping my memory dumps and logs

>>> would help. I did notice it can take hours for the crashes to occur.

>>> When the firs tone strike, then explorer.exe will crash randomly like

>>> crazy. Even Start Menu will start going nuts. I have to reboot to keep

>>> it stable for a few hours. I doubt it is temperature related because my

>>> other software and hardware don't crash.

>>>

>>> Here are the first two event log crashes:

>>> Event Type: Error

>>> Event Source: Application Error

>>> Event Category: None

>>> Event ID: 1000

>>> Date: 7/9/2008

>>> Time: 8:11:36 AM

>>> User: N/A

>>> Description:

>>> Faulting application explorer.exe, version 6.0.2900.3156, faulting

>>> module comctl32.dll, version 6.0.2900.2982, fault address 0x0002918d.

>>>

>>> For more information, see Help and Support Center at

>>> http://go.microsoft.com/fwlink/events.asp.

>>> Data:

>>> 0000: 41 70 70 6c 69 63 61 74 Applicat

>>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

>>> 0010: 75 72 65 20 20 65 78 70 ure exp

>>> 0018: 6c 6f 72 65 72 2e 65 78 lorer.ex

>>> 0020: 65 20 36 2e 30 2e 32 39 e 6.0.29

>>> 0028: 30 30 2e 33 31 35 36 20 00.3156

>>> 0030: 69 6e 20 63 6f 6d 63 74 in comct

>>> 0038: 6c 33 32 2e 64 6c 6c 20 l32.dll

>>> 0040: 36 2e 30 2e 32 39 30 30 6.0.2900

>>> 0048: 2e 32 39 38 32 20 61 74 .2982 at

>>> 0050: 20 6f 66 66 73 65 74 20 offset

>>> 0058: 30 30 30 32 39 31 38 64 0002918d

>>> 0060: 0d 0a ..

>>>

>>> Event Type: Error

>>> Event Source: Application Error

>>> Event Category: (100)

>>> Event ID: 1000

>>> Date: 7/9/2008

>>> Time: 8:11:40 AM

>>> User: N/A

>>> Description:

>>> Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module

>>> dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

>>>

>>> For more information, see Help and Support Center at

>>> http://go.microsoft.com/fwlink/events.asp.

>>> Data:

>>> 0000: 41 70 70 6c 69 63 61 74 Applicat

>>> 0008: 69 6f 6e 20 46 61 69 6c ion Fail

>>> 0010: 75 72 65 20 20 64 72 77 ure drw

>>> 0018: 74 73 6e 33 32 2e 65 78 tsn32.ex

>>> 0020: 65 20 35 2e 31 2e 32 36 e 5.1.26

>>> 0028: 30 30 2e 30 20 69 6e 20 00.0 in

>>> 0030: 64 62 67 68 65 6c 70 2e dbghelp.

>>> 0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.

>>> 0040: 32 36 30 30 2e 32 31 38 2600.218

>>> 0048: 30 20 61 74 20 6f 66 66 0 at off

>>> 0050: 73 65 74 20 30 30 30 31 set 0001

>>> 0058: 32 39 35 64 295d

>>>

>>> I also noticed explorer.exe doesn't return and Dr. Watson gets stuck and

>>> crashes too. I have to kill their processes to restart Explorer manually

>>> via Task Manager.

>>>

>>> Any ideas? Thank you in advance. :)

> --

> "The foreign policy aim of ants can be summed up as follows: restless

> aggression, territorial conquest, and genocidal annihilation of

> neighboring colonies whenever possible. If ants had nuclear weapons, they

> would probably end the world in a week." --Journey to the Ants, page 59.

> Bert Holldobler & Edward O. Wilson

> /\___/\

> / /\ /\ \ Phil/Ant @ http://antfarm.home.dhs.org (Personal Web Site)

> | |o o| | Ant's Quality Foraged Links (AQFL): http://aqfl.net

> \ _ / Remove ANT from e-mail address: philpi@earthlink.netANT

> ( ) or ANTant@zimage.com

> Ant is currently not listening to any songs on his home computer.

July 13, 2008

Re: XP Pro. SP2's explorer.exe crashing a lot and randomly.

In article <bqsek.16069$jI5.973@flpi148.ffdc.sbc.com>, toidi@tpap.com

says...

> Ignore posts made by the person called Leythos, he is a stalker who's been

> obsessed with me for years ever since I spurned his advances towards me.

>

Do you really want to trust someone that was banned from posting

directly to Microsoft Usenet servers, someone that has posted links to

pornographic materials on HIS WEBSITE, who's website is in the MVP HOST

Block list, and who provides a tool for your use that will block access

to reputable anti-malware sites without telling you he's doing it?

And do you really want to trust someone that has had to change their

posting identity after being busted by MS as a fake MVP?

--

- Igitur qui desiderat pacem, praeparet bellum.

- Calling an illegal alien an "undocumented worker" is like calling a

drug dealer an "unlicensed pharmacist"

spam999free@rrohio.com (remove 999 for proper email address)

July 14, 2008

Re: XP Pro. SP2's explorer.exe crashing a lot and randomly.

Dr. Watson's log: http://alpha.zimage.com/~ant/temp/drwtsn32.txt ... I

couldn't get memory dump since Dr. Watson crashed too right after

explorer crashed. :(