Explorer crashed

Hello everyone!

I tried to analyze on a website but the results are quite a bit advanced for my level of expertise and I did not really understand how to read a crash dump, so if I may, I will upload it here for you guys/girls to analyze it for me.

The culprit is Windows Explorer, it crashed and automatically restarted. At that time, I was browsing on chrome with multiple tabs open (~12), but I don't think that's the main problem.

The OS is installed on the SSD and the HDD is used for storage, mainly everything that is not related to video games, but right now the drive is fairly free (moved everything to the external HDD for backup).

I have 2 partitions, 1 for the SSD and the other for the HDD.

My Specs:

OS: Windows 10 Education/Enterprise 64-bit 1703 (Creators Update)

CPU: AMD Ryzen 5 1400

Motherboard: MSI B350 Tomahawk

Graphics Card: MSI GeForce GTX 750 Ti N750TI-2GD5OC/V1

Memory: Corsair Vengeance LPX Black 1x8GB DDR4 2400 MHz C16

SSD: Samsung 850 EVO 120GB SATA-III

HDD: Seagate Desktop 1TB 7200 RPM

Feel free to tell me if there's anything else you need to know. Thank you!

Edited by robertul, 15 April 2017 - 05:58 AM.

I'm not real good with user mode dumps (such as this)

And, there aren't any symbols available for the Creators Update build (15063) yet.

Regardless, I'll give this my best attempt.........

The dump file says it has problems with nvwgf2umx_cfg.dll

While this is not a definite diagnostic result, IMO it implies a difficulty with an nVidia program.

So, the first step would be to:

- download a fresh set of the latest, W10 compatible drivers for your video card from nVidia.com

- uninstall the current video card software and drivers from Control Panel...Programs and Features.

- install the freshly downloaded nVidia drivers

- test for further explorer crashes.

In the event that that doesn't help, try this free tool:  http://www.nirsoft.net/utils/shexview.html

Use it to disable ALL non-Microsoft Windows shell extensions (DO NOT DELETE THEM!), then reboot and see if that helps.

If it does help, then re-enable the shell extensions a few at a time until you find the culprit.

If it doesn't help, then post back for further suggestions.

Just FYI - here's the WinDbg output (w/ !analyze -v):

 

Microsoft ® Windows Debugger Version 10.0.14321.1024 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\john\SysnativeBSODApps\explorer.exe.5424.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*c:\symbols*https://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Version 15063 MP (8 procs) Free x64
Product: WinNt, suite: SingleUserTS
Built by: 15063.0.amd64fre.rs2_release.170317-1834
Machine Name:
Debug session time: Sat Apr 15 06:14:54.000 2017 (UTC - 4:00)
System Uptime: not available
Process Uptime: 0 days 2:18:47.000
................................................................
................................................................
................................................................
................................................................
....................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(1530.1e24): Access violation - code c0000005 (first/second chance not available)
ntdll!NtWaitForMultipleObjects+0x14:
00007ffd`09e95f04 c3              ret
0:203> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify timestamp for sppc.dll
*** ERROR: Module load completed but symbols could not be loaded for sppc.dll
*** WARNING: Unable to verify timestamp for nvwgf2umx_cfg.dll
*** ERROR: Module load completed but symbols could not be loaded for nvwgf2umx_cfg.dll

DUMP_CLASS: 2

DUMP_QUALIFIER: 400

CONTEXT:  (.ecxr)
rax=00007ffcfa6f1ac8 rbx=000000000eb19fa0 rcx=000000000eb19fa0
rdx=00007ffd09a70a10 rsi=0000000000000001 rdi=0000000000000023
rip=00007ffd098a90bf rsp=000000003d7ee0c0 rbp=000000000eb19fa0
 r8=000000003d7ee1a0  r9=0000000000000023 r10=000000001446d760
r11=0000000000000000 r12=0000000000000000 r13=000000000056f828
r14=000000000d1c40b8 r15=0000000000000023
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
combase!ObtainStdIDFromUnk+0x33:
00007ffd`098a90bf 488b00          mov     rax,qword ptr [rax] ds:00007ffc`fa6f1ac8={UserLanguagesCpl!ATL::CComObjectNoLock<CSearchCompletedCallback>::QueryInterface (00007ffc`fa6e6bd0)}
Resetting default scope

FAULTING_IP:
combase!ObtainStdIDFromUnk+33 [onecore\com\combase\dcomrem\stdid.cxx @ 2158]
00007ffd`098a90bf 488b00          mov     rax,qword ptr [rax]

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffd098a90bf (combase!ObtainStdIDFromUnk+0x0000000000000033)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00007ffcfa6f1ac8
Attempt to read from address 00007ffcfa6f1ac8

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

PROCESS_NAME:  explorer.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00007ffcfa6f1ac8

FOLLOWUP_IP:
UserLanguagesCpl!ATL::CComObjectNoLock<CSearchCompletedCallback>::`vftable'+0
00007ffc`fa6f1ac8 d06b6e          shr     byte ptr [rbx+6Eh],1

READ_ADDRESS:  00007ffcfa6f1ac8

BUGCHECK_STR:  INVALID_POINTER_READ

WATSON_BKT_PROCSTAMP:  a25b6083

WATSON_BKT_PROCVER:  10.0.15063.0

PROCESS_VER_PRODUCT:  Microsoft® Windows® Operating System

WATSON_BKT_MODULE:  combase.dll

WATSON_BKT_MODSTAMP:  3a54a041

WATSON_BKT_MODOFFSET:  790bf

WATSON_BKT_MODVER:  10.0.15063.0

MODULE_VER_PRODUCT:  Microsoft® Windows® Operating System

BUILD_VERSION_STRING:  10.0.15063.0 (WinBuild.160101.0800)

MODLIST_WITH_TSCHKSUM_HASH:  4e4acbd216b03b2ccf344d634a7327d5298006a4

MODLIST_SHA1_HASH:  5110cf475cf97fd6ef5b31afe4a88ce147d33180

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

DUMP_FLAGS:  94

DUMP_TYPE:  1

ANALYSIS_SESSION_HOST:  LAPTOP-05JCUB11

ANALYSIS_SESSION_TIME:  04-16-2017 09:05:26.0158

ANALYSIS_VERSION: 10.0.14321.1024 amd64fre

THREAD_ATTRIBUTES:
ADDITIONAL_DEBUG_TEXT:  Followup set based on attribute [UnloadedModule_Arch_DX] from Frame:[0] on thread:[1e24] ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]

LAST_CONTROL_TRANSFER:  from 00007ffd099063aa to 00007ffd098a90bf

FAULTING_THREAD:  ffffffff

THREAD_SHA1_HASH_MOD_FUNC:  fa7f8bcc5729792da4a9819de6be03e5e4aaa18e

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  fff5411abf5dc9acbb2ef10b11cb086072de9719

OS_LOCALE:  ENU

PROBLEM_CLASSES:



INVALID_POINTER_READ
    Tid    [0x1e24]
    Frame  [0x00]: combase!ObtainStdIDFromUnk


STACK_TEXT:  
00000000`00000000 00000000`00000000 UserLanguagesCpl!ATL::CComObjectNoLock_CSearchCompletedCallback_::_vftable_+0x0


THREAD_SHA1_HASH_MOD:  148e81ba6966957114f348e07e7bd1e2f701cdd9

FAULT_INSTR_CODE:  fa6e6bd0

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  UserLanguagesCpl!ATL::CComObjectNoLock_CSearchCompletedCallback_::_vftable_+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: UserLanguagesCpl

IMAGE_NAME:  UserLanguagesCpl.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5163c45f

STACK_COMMAND:  .ecxr ; ~~[0x1e24]s ; .frame 0 ; ** Pseudo Context ** ; kb

BUCKET_ID:  INVALID_POINTER_READ_UserLanguagesCpl!ATL::CComObjectNoLock_CSearchCompletedCallback_::_vftable_+0

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ_UserLanguagesCpl!ATL::CComObjectNoLock_CSearchCompletedCallback_::_vftable_+0

FAILURE_EXCEPTION_CODE:  c0000005

FAILURE_IMAGE_NAME:  UserLanguagesCpl.dll

BUCKET_ID_IMAGE_STR:  UserLanguagesCpl.dll

FAILURE_MODULE_NAME:  UserLanguagesCpl

BUCKET_ID_MODULE_STR:  UserLanguagesCpl

FAILURE_FUNCTION_NAME:  ATL::CComObjectNoLock_CSearchCompletedCallback_::_vftable_

BUCKET_ID_FUNCTION_STR:  ATL::CComObjectNoLock_CSearchCompletedCallback_::_vftable_

BUCKET_ID_OFFSET:  0

BUCKET_ID_MODTIMEDATESTAMP:  5163c45f

BUCKET_ID_MODCHECKSUM:  a981c

BUCKET_ID_MODVER_STR:  0.0.0.0

BUCKET_ID_PREFIX_STR:  INVALID_POINTER_READ_

FAILURE_PROBLEM_CLASS:  INVALID_POINTER_READ

FAILURE_SYMBOL_NAME:  UserLanguagesCpl.dll!ATL::CComObjectNoLock_CSearchCompletedCallback_::_vftable_

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_UserLanguagesCpl.dll!ATL::CComObjectNoLock_CSearchCompletedCallback_::_vftable_

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/explorer.exe/10.0.15063.0/a25b6083/combase.dll/10.0.15063.0/3a54a041/c0000005/000790bf.htm?Retriage=1

TARGET_TIME:  2017-04-15T10:14:54.000Z

OSBUILD:  15063

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  256

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt SingleUserTS

USER_LCID:  0

OSBUILD_TIMESTAMP:  1982-07-26 22:10:05

BUILDDATESTAMP_STR:  160101.0800

BUILDLAB_STR:  WinBuild

BUILDOSVER_STR:  10.0.15063.0

ANALYSIS_SESSION_ELAPSED_TIME: 1364c

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:invalid_pointer_read_c0000005_userlanguagescpl.dll!atl::ccomobjectnolock_csearchcompletedcallback_::_vftable_

FAILURE_ID_HASH:  {fbebb2f4-6a80-85fa-8a5c-6bb032fd848f}

Followup:     MachineOwner
---------
 

Edited by usasma, 16 April 2017 - 08:17 AM.

Hello,

First of all, I would like to thank you for trying to help me. Secondly, I apologize for the delay in response, I was quite busy and couldn't really had the chance of getting here.

Now, onto the topic: I just reinstalled windows fresh including the drivers after I changed the platform to AM4 (Ryzen) and that crash happened with a fresh install. It must have been something that is not really worrying as it did never happened to me ever again. Who knows what happened? But it's fine now.

I was just curious what might have caused it, so if it will ever happen again, at least I have an idea of what might be causing it, so that's why I started this thread!

Thank you and I wish you all the best! Take care!

Sincerely,

Botezat Robert-Andrei

Edited by robertul, 21 April 2017 - 11:01 AM.

Unfortunately, I really don't know what caused this.
I would suggest setting a System Restore point and making a full-image backup of your system while it's working well.
That way, should this problem come back, you'll be able to revert without having to reinstall everything.

More info on backup strategies here:  http://www.bleepingcomputer.com/forums/f/238/backup-imaging-and-disk-management-software/

Yes, I always do a full system backup of the OS after I install all the drivers and configure it the way I want it in case anything goes wrong later, I can use it to restore with no problem!

Thank you again for all the help and assistance you gave me. I wish you all the best!

Sincerely and all due respect,

Botezat Robert-Andrei

Edited by robertul, 23 April 2017 - 07:49 AM.