Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

explorer.exe crashing constantly, no clear cause


  • Please log in to reply
9 replies to this topic

#1 rotven

rotven

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 25 January 2011 - 07:51 AM

Hi,
First off, thanks to anyone taking the time to read this. This is a problem I've been having for quite some time now and I kept ignoring it, but now I think it's time I get help with it.

I'm running Windows XP Professional Service Pack 3 on a 3-4-year-old PC (3.25GB RAM, Intel Core 2 Duo 2.13GHz CPU, 250GB+750GB HDD, nVidia GeForce 7900GS GPU) and I'm pretty satisfied with it, both the OS and the PC.

Recently I was having some issues I suspected as malware, but after running some scans and trying out different configurations I detected that there was just a collision between two anti-malware programs (NOD32 and MalwareBytes AntiMalware). Uninstalling MBAM and reinstalling NOD32 fixed it. During the process, I reinstalled XP with my XP setup CD.

I'm not sure this is all relevant to my problem, but I just know any info may help.
Anyways, the error I'm getting has been an issue since before I reinstalled XP and it continues showing up even today.

Windows Explorer has encountered a problem and needs to close. We are sorry for the inconvenience.
...
AppName: explorer.exe AppVer: 6.0.2900.5512 ModName: unknown
ModVer: 0.0.0.0 Offset: 04b29290


After I click "Send Error Report/Don't Send" I sometimes get a Dr. Watson error as well. In some cases I find that the only solution to get Explorer running again and the taskbar responsive again, is ending all explorer.exe and drwtsn instances via Task Manager.
It is a pain, though.

The weird thing about it though, is I get these errors even when an Explorer window is open in the background and I'm not doing anything. They pop up at random times, which is why I couldn't find the source of the problem on my own.

Thanks for any help! :)

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,742 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:11 PM

Posted 25 January 2011 - 11:24 AM

Let's try this :).

Download/install BlueScreenView, http://www.nirsoft.net/utils/blue_screen_view.html .

Double-click BlueScreenView.exe file.

When scanning is done, Edit/Select All...then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content and paste it into your next reply.

Louis

#3 Allan

Allan

  • BC Advisor
  • 8,589 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:10:11 PM

Posted 25 January 2011 - 11:34 AM

I don't believe he's experiencing blue screen errors, but okay - let's see :)

#4 rotven

rotven
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 25 January 2011 - 01:08 PM

I hate to deviate from your instructions, but this file is huge so I put in on TinyPaste to save room here: http://tinypaste.com/e59f4

Thank you! (BTW I'm not experiencing BSODs but I trust your judgment. Just letting you know.)

#5 Allan

Allan

  • BC Advisor
  • 8,589 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:10:11 PM

Posted 25 January 2011 - 01:13 PM

Well, please allow me to correct myself. Apparently there have been a number of bsod's of which the OP may not have been aware (they would have resulted in reboots). There are so many, and so many DIFFERENT ones, it could be anything from bad ram to bad drivers to a bad mobo, malware, or any of a number of different issues.

#6 joseibarra

joseibarra

  • Members
  • 1,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:10:11 PM

Posted 25 January 2011 - 03:15 PM

When Windows Explorer (not Internet Explorer) is misbehaving, I tend to start to suspect third party explorer extension add-ons.

Those would be Explorer extensions that do not belong to Microsoft. Explorer extensions are usually okay and installing some applications
will install Explorer extensions for you, give you a choice and sometimes they can be added sometimes without your knowledge.

An example would be a new right click option that appears in Explorer after installing some new application.

If there is a particular thing you do when Exploring that you know will cause the problem, that will help zero in on things.

You can download ShellExView from here to see which Explorer extensions you have loaded:

http://www.nirsoft.net/utils/shexview.html

ShellExView doesn't install anything on your computer, it just runs and displays.

When you launch it, the non Microsoft extensions will be in light pink, but on some systems that is a hard color to see, so click View, Choose Columns and move the Microsoft column closer to the top so you can see it on your screen without having to scroll left and right.

Next, click the column header for Microsoft to sort the display (by clicking the Microsoft column) so all the "No"s are at the top and easy to see.

The "No"s would be things you have added (non Microsoft) and are what you need to be suspecting.

I am not a trial and error advocate, but I can't think of another way to do this...

Right click and disable the non Microsoft extensions one at a time keeping a list so you can enable them again later if desired. The result of the change is immediate and no reboot is required. Test your failure condition.

If you recognize any extensions that may have been added or downloaded recently, start with those.

Disabling an extension does not uninstall the extension - it is just disabled.

You can also disable all the non Microsoft extensions, reboot and enable them one at a time until you find the one that generates the condition.

The hope is that you will find the one Extension that causes the error and then you can figure out what to do about it - usually get an update from the maker of the extension from their WWW page.

I don't have your issue but I can when you disable/enable the extensions, the Extension is immediately disabled, so disabling one does not seem to require a reboot but if you find the problem, I would reboot and retest anyway to really be sure.

If you post up a list of your non Microsoft extensions, maybe someone will recognize it as a potential problem.

If you find the extension that is the problem, please let us know what it is so I can add it to my list.

Edited by joseibarra, 25 January 2011 - 03:17 PM.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#7 rotven

rotven
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 25 January 2011 - 03:34 PM

joseibarra, I actually suspected exactly what you mentioned at some point (explorer addons), but I wasn't sure how I would find exactly what was causing the error.
This app from NirSoft (real life-saver, this Nir guy) is going to be very helpful. I've just disabled a few of the non-Microsoft extensions (which I actually think I don't need anymore) and specifically a QTTabBar addon I suspect more than the others, and if I don't see any errors in the next 24 hours (the errors really are that frequent) it's very likely I have found my culprit in one of the addons I disabled.
Now I'm just keeping my fingers crossed! Will post back as soon as I have any news.

Thanks! :)

Edited by rotven, 25 January 2011 - 03:35 PM.


#8 joseibarra

joseibarra

  • Members
  • 1,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:10:11 PM

Posted 25 January 2011 - 06:26 PM

Good job and let us know how that works out.

Some Googling for "QTTabBar explorer crash" reveals commentaries like:

Summary: Simply because it caused problems on WinXP for me, started getting explorer run errors. After I removed it, which was a complicated process, I no longer had explorer crashes.

http://download.cnet.com/QT-TabBar/3000-12512_4-10800678.html

Take another look at BlueScreenView and practice... there should not be some "huge" file to upload - just save the BSV results to a text file.

In addition to the instructions from hamluis (which I think I bogarted a long time ago :blush: ), I have my own notes too that may help you make friends with BSV:

Download BlueScreenView from here:

http://www.nirsoft.net/utils/blue_screen_view.html

Unzip and run it (BSV installs nothing) and let it finish scanning all your crash dump files.

If you double click on of the dumps, you will get some information about it (including the Caused By Driver field) and you may be able to spot the problem right away - especially if you see a pattern in the dumps where the Caused by Driver field is the same (start with that driver).

Select (highlight) one or more of the most recent dump files by clicking them and holding down the Ctrl key to select multiples files. Try to select just the most recent ones that relate to your issue (maybe five or so dump files to get started).

Click File, Save Selected Items and save the information from the dumps to a text file on your desktop called BSOD.txt. Open BSOD.txt with a text editor, copy all the text and paste it into your next reply.

Here is an example of the BSV report from a single BSOD that I initiated on purpose that shows the cause of the crash as the i8042prt.sys driver belonging to Microsoft Corporation:

==================================================
Dump File : Mini062110-01.dmp
Crash Time : 6/21/2010 11:51:31 AM
Bug Check String : MANUALLY_INITIATED_CRASH
Bug Check Code : 0x000000e2
Parameter 1 : 0x00000000
Parameter 2 : 0x00000000
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : i8042prt.sys
Caused By Address : i8042prt.sys+27fb
File Description : i8042 Port Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2108)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\minidump\Mini062110-01.dmp
==================================================

Send the information from the last 5 memory dumps.

If you do not have 5 memory dumps yet, send the text of the most recent ones you have.

Edited by joseibarra, 25 January 2011 - 06:28 PM.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#9 rotven

rotven
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 26 January 2011 - 06:08 AM

Well, the latest entry that shows up on BSV is from December 7th, 2010, so I'm not sure if it's relevant to my problem.
Here are the last few entries (I noticed that most of them relate to the win32k.sys driver):
BTW, I haven't gotten a crash since I disabled those addons before, but I think I'll need some more time to be sure it's really gone. Too early to say.

==================================================
Dump File         : Mini071210-03.dmp
Crash Time        : 7/12/2010 7:34:13 PM
Bug Check String  : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code    : 0x1000008e
Parameter 1       : 0xc0000005
Parameter 2       : 0x00000000
Parameter 3       : 0xb2deace0
Parameter 4       : 0x00000000
Caused By Driver  : win32k.sys
Caused By Address : win32k.sys+b62
File Description  : Multi-User Win32 Driver
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 5.1.2600.6046 (xpsp_sp3_gdr.101026-1628)
Processor         : 32-bit
Computer Name     : 
Full Path         : C:\WINDOWS\Minidump\Mini071210-03.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 2600
Dump File Size    : 90,112
==================================================

==================================================
Dump File         : Mini071210-02.dmp
Crash Time        : 7/12/2010 5:22:11 PM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x10000050
Parameter 1       : 0xf1072000
Parameter 2       : 0x00000000
Parameter 3       : 0xb1882c3e
Parameter 4       : 0x00000001
Caused By Driver  : awloypoc.sys
Caused By Address : awloypoc.sys+c3e
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : 32-bit
Computer Name     : 
Full Path         : C:\WINDOWS\Minidump\Mini071210-02.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 2600
Dump File Size    : 90,112
==================================================

==================================================
Dump File         : Mini071210-01.dmp
Crash Time        : 7/12/2010 10:15:17 AM
Bug Check String  : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code    : 0x100000d1
Parameter 1       : 0x00000000
Parameter 2       : 0x0000001c
Parameter 3       : 0x00000001
Parameter 4       : 0x858bb00c
Caused By Driver  : 
Caused By Address : 
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : 32-bit
Computer Name     : 
Full Path         : C:\WINDOWS\Minidump\Mini071210-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 2600
Dump File Size    : 90,112
==================================================

==================================================
Dump File         : Mini051710-01.dmp
Crash Time        : 5/16/2010 11:16:42 PM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x10000050
Parameter 1       : 0xe7c9348c
Parameter 2       : 0x00000001
Parameter 3       : 0x8053a9e0
Parameter 4       : 0x00000001
Caused By Driver  : win32k.sys
Caused By Address : win32k.sys+36ee6
File Description  : Multi-User Win32 Driver
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 5.1.2600.6046 (xpsp_sp3_gdr.101026-1628)
Processor         : 32-bit
Computer Name     : 
Full Path         : C:\WINDOWS\Minidump\Mini051710-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 2600
Dump File Size    : 98,304
==================================================

==================================================
Dump File         : Mini030710-01.dmp
Crash Time        : 3/7/2010 3:02:14 PM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x10000050
Parameter 1       : 0xba026674
Parameter 2       : 0x00000001
Parameter 3       : 0x8053a8d3
Parameter 4       : 0x00000000
Caused By Driver  : win32k.sys
Caused By Address : win32k.sys+36ee6
File Description  : Multi-User Win32 Driver
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 5.1.2600.6046 (xpsp_sp3_gdr.101026-1628)
Processor         : 32-bit
Computer Name     : 
Full Path         : C:\WINDOWS\Minidump\Mini030710-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 2600
Dump File Size    : 102,400
==================================================

==================================================
Dump File         : Mini030210-01.dmp
Crash Time        : 3/2/2010 10:30:08 PM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x10000050
Parameter 1       : 0xe583d000
Parameter 2       : 0x00000001
Parameter 3       : 0x8053a8d3
Parameter 4       : 0x00000001
Caused By Driver  : win32k.sys
Caused By Address : win32k.sys+36ee6
File Description  : Multi-User Win32 Driver
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 5.1.2600.6046 (xpsp_sp3_gdr.101026-1628)
Processor         : 32-bit
Computer Name     : 
Full Path         : C:\WINDOWS\Minidump\Mini030210-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 2600
Dump File Size    : 98,304
==================================================


Thanks!

#10 joseibarra

joseibarra

  • Members
  • 1,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:10:11 PM

Posted 26 January 2011 - 06:33 AM

Sometimes BSV will implicate Microsoft files/drivers in the "Caused By field, but I usually don't suspect the MS files. BSV does the best it can from reading the dump file, but sometimes you have to go deeper for the cause.

If that is the case, it helps to look at the BSV crash dump details lower pane a little more closely or confirm things with the Windows debugging tools.

Here is what the BSV people have to say:

Caused By Driver: The driver that probably caused this crash. BlueScreenView tries to locate the right driver or module that caused
the blue screen by looking inside the crash stack. However, be aware that the driver detection mechanism is not 100% accurate, and you
should also look in the lower pane, that display all drivers/modules found in the stack.


The awloypoc.sys in one of the old reports looks like potential malware but that was a long time ago, so when you can I would do this too:

No matter what else you are using for malware protection, please do this:

Download, install, update and do a full scan with these free malware detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

These can be uninstalled later if desired.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users