Windows 7 Pro x64 explorer.exe crashing

Page 1 of 3 123 LastLast

  1. Posts : 15
    Windows 7 Professional x64 MSDN-AA RTM
       #1

    Windows 7 Pro x64 explorer.exe crashing


    I have been following the people complaining about this here, as well as on the other forums and searching google day in and day out for a solution to this problem. Here is my exact problem:

    Random explorer.exe crashes. Be it the desktop process, or the file manager process. ALSO, when I get these crashes, MMC.EXE will crash when I try to open Event Viewer. Eventually it will stop crashing and I can view everything fine and it's like nothing happened at all. Eventlog is always an error with one of the following, from most often to least often: ntdll.dll, comctl.dll (deep inside the filesystem 'WinSxS'?), msvcrt.dll. 99% of the time it is ntdll.dll as others have reported.

    I can always tell when the crash is coming because there is a very small delay and the cursor turns to the busy spinning turquoise circle. Now, the fun part is that I started having this issue in Windows Vista Home Premium x64 before blaming my old install and moving to Windows 7 Professional x64 from MSDN-AA. The crashing happened. I googled to try and fix it, but alas came up empty handed. I re-installed and only installed the basics that were listed as Windows 7 compatible: Intel chipset (it listed Windows 7) and Nvidia current drivers as of today.

    The crashing is totally random. I ran several diagnostics:
    - sfc /scannow
    - antivirus antispyware (even did it on clean install just incase)
    - memtest86 overnight, 0 errors
    - Seagate disk tools, whatever it's called. Did SMART tests, and both short and long tests.
    - Encoding some DVDs into MKV using handbrake. CPU sat taxed %100 both cores for about 5 hours.

    Current system setup:
    Windows 7 Professional x64 (from MSDN-AA)
    Code:
    MD5: 7b7af5fe3a01e9fd76de4dacb45a796b
    SHA1: 50127304441a793ee51b3f501289f6599a559e9f
    CRC32: 502c42c1
    Dell Inspiron 530
    C2D E8400 3.0GHz
    Nvidia GTX 260 (Non Core 216)
    Foxconn Dell OEM motherboard
    4GB DDR2 800MHZ (1GB x 4)
    250GB Seagate HDD
    Onboard realtek sound
    650W Power Supply

    I will follow your Windows debugging guide as well on the previous pages and upload the result when I can get explorer to crash again. I can't make it happen... it just happens. :)

    I just wanted to add the "me too" factor.

    For what it's worth, I have two other machines that don't exhibit this behavior. Software wise, all machines share the same basic setup.

    Dumps attached per discussion HERE. (Note, these are two new dumps, one from the shell process and the other from a seperate file manager explorer.exe process) - yes I tell explorer to start a new process when starting the file manager, etc.
      My Computer


  2. Posts : 1,377
    Win7x64
       #2

    Porkrinds said:
    Dumps attached per discussion HERE. (Note, these are two new dumps, one from the shell process and the other from a seperate file manager explorer.exe process) - yes I tell explorer to start a new process when starting the file manager, etc.
    Excellent write-up. Have rep :)

    All 3 of these dumps show a situation called "heap corruption", although the first one is subtly different. "Heap" can be thought of as a region of memory within the process which is allocated to parts of the process as they ask for memory. They must not write over each other's allocations, and it is up to each "part" to ensure that it stays within the confines of what it has allocated for itself.

    There are ways to enable special diagnostic heap behaviour, so that the OS pays more attention to who's doing what with heap - at the expense of somewhat degraded performance. That way you can sometimes catch the heap corruptor component in the act, rather than simply witnessing the aftermath later when the corrupted memory is used.

    Before we get too carried away, could you please consider temporarily uninstalling 7zip and AVG in order to get rid of their Explorer integration componentry as a test:

    Image path: C:\Program Files\7-Zip\7-zip.dll
    Image name: 7-zip.dll
    Timestamp: Sat Aug 29 20:39:40 2009 (4A99056C)
    ...
    Image path: C:\Program Files (x86)\AVG\AVG8\avgsea.dll
    Image name: avgsea.dll
    Timestamp: Wed Jul 08 10:22:16 2009 (4A53E6B8)

    After that, if the crashes continue, we may need to tweak some settings before generating more dumps.

    (BTW, I and others may also be able to help with your MMC crash, but I'd suggest another separate thread for that. The way to get dumps will be a bit different since the process, as I understand it, crashes on startup.)
      My Computer


  3. Posts : 15
    Windows 7 Professional x64 MSDN-AA RTM
    Thread Starter
       #3

    Removed AVG (had to use a special "uninstaller" tool from their website /sigh)
    Removed 7zip

    I will report back with crash dumps if/when I get the explorer crashing after removing this software.
    Last edited by Porkrinds; 24 Sep 2009 at 15:46. Reason: Update, but no need to bump thread yet.
      My Computer


  4. Posts : 15
    Windows 7 Professional x64 MSDN-AA RTM
    Thread Starter
       #4

    new dump


    Here is a dump from a shell crash while right clicking the debug tool from the start menu in order to tell it to run as administrator.

    This was after removing 7zip and AVG using their uninstallers.

    9/24/09 about 5:15pm EST. I don't know if there are timestamps on the crash logs or not.
      My Computer


  5. Posts : 1,377
    Win7x64
       #5

    Porkrinds said:
    Here is a dump from a shell crash while right clicking the debug tool from the start menu in order to tell it to run as administrator.

    This was after removing 7zip and AVG using their uninstallers.

    9/24/09 about 5:15pm EST. I don't know if there are timestamps on the crash logs or not.
    Yeah, the time of the crash event is recorded, as is the fact that the process was only running for one minute and 39 seconds at the point where this dump was generated

    Again, it's a heap corruption problem. This is going into "serious debugging" territory where it's necessary to actually understand the code which is crashing. Given I don't have access to Microsoft's source code, that makes it challenging.

    I'm more than happy to continue to work with you on debugging these crashes, but I need to ask you to be prepared to do some fairly esoteric troubleshooting steps, plus you should also realise that we may not be able to find a practical solution based on debugging alone. Right now, your crash patterns are suggesting heap corruption in Microsoft's Explorer code, and that makes me suspect far bigger underlying issues. (Heap corruption of this sort would be rather amateurish, plus it doesn't seem to happen for the vast majority of other Win7 users.)

    If you're happy to continue working on it given those caveats, can I please ask you to generate some dumps using a slightly different mechanism:

    1) Open a CMD prompt and CD to the folder where you installed the debugging tools.

    2) Run this:

    cscript adplus.vbs -crash -nodumponfirst -minionsecond -quiet -pn explorer.exe

    That will "attach" the debugger to the Explorer process and wait for a crash to occur. When a problem is detected, a dump will be written (along with some other info files) in a new directory under the debugging tools folder ("Crash_Mode__Date_xx-yy-zzzz_-Time..."). Can you please zip up the entire new (dump) folder that's created and upload it here. It may be subtly but importantly different to the previous dumps.
      My Computer


  6. Posts : 15
    Windows 7 Professional x64 MSDN-AA RTM
    Thread Starter
       #6

    Big Dump


    Here is the next dump you wanted. This is the shell crashing on a right click.

    If you think this is hardware related, I can always do more tests... it's just hard to pinpoint what the issue could be. Maybe your sleuthing will help. Thanks again for your time.
      My Computer


  7. Posts : 1,377
    Win7x64
       #7

    No probs, I live for this stuff.

    Same again that time, supposed heap corruption. I'd like to crank up the OS's level of heap "scrutiny" - make it pay more attention to who's doing what with heap inside the Explorer process. The procedure:

    - open elevated (run as admin) CMD prompt
    - run this command from the debuggers folder: gflags /i explorer.exe +htc +hfc +hpc +hvc +htd
    - restart Explorer at least once because those settings won't take hold otherwise. Either crash it, or terminate and restart it (from task manager).
    - Use the same "cscript adplus.vbs..." command line again to attach the debugger to (the new) Explorer, then reproduce the crash once more.
    - Upload the subsequent dump.
      My Computer


  8. Posts : 15
    Windows 7 Professional x64 MSDN-AA RTM
    Thread Starter
       #8

    Arghhhh


    Ok, I can't get a crash to happen because the slowdown from the debugging is more than I can put up with :)

    I think I can get right click about once every 3-5mins, let alone have a file manager window open which takes 5-10mins just to startup to load as it is. I've tried for about 8 hours to get a crash to happen, and it just won't. Now if I turn off the debugging, I can get a crash to happen in 5-10mins doing various work inside the file manager.

    What I can seem to reproduce was the MMC.exe crash. Related? I don't know. I can keep trying since it's the weekend, but if you have any other suggestions to make this a bit more feasible then that would be grand.
      My Computer


  9. Posts : 1,377
    Win7x64
       #9

    Porkrinds said:
    Ok, I can't get a crash to happen because the slowdown from the debugging is more than I can put up with :)

    I think I can get right click about once every 3-5mins, let alone have a file manager window open which takes 5-10mins just to startup to load as it is. I've tried for about 8 hours to get a crash to happen, and it just won't. Now if I turn off the debugging, I can get a crash to happen in 5-10mins doing various work inside the file manager.

    What I can seem to reproduce was the MMC.exe crash. Related? I don't know. I can keep trying since it's the weekend, but if you have any other suggestions to make this a bit more feasible then that would be grand.
    LOL. OK, so that was a bit ham-fisted on my part

    Each of those "flags" corresponds to a specific type of additional heap operation scrutiny by the OS for the process name in question. Their definitions:

    htc - Enable heap tail checking
    hfc - Enable heap free checking
    hpc - Enable heap parameter checking
    hvc - Enable heap validation on call
    htd - Enable heap tagging by DLL

    The more additional scrutiny you specify, the worse the performance. At this stage I'm most interested in HFC because your crashes appear to be caused by something called a "double free" - the same allocation is being erroneously freed twice, as if the app has lost its sync and forgotten about the first time it freed a particular chunk of memory.

    Hence, can you please try with just the HFC flag: gflags /i explorer.exe +hfc

    To get rid of all additional checks and restore default process behaviour: gflags /i explorer.exe 0xFFFFFFFF

    This shouldn't have any bearing on MMC.EXE. Without getting into too much detail, everything we've done so far is going to be specific to Explorer.exe operation, and the OS won't treat MMC.exe any differently. If the MMC crash is not happening - great - it's probably not a conspiracy
      My Computer


  10. Posts : 15
    Windows 7 Professional x64 MSDN-AA RTM
    Thread Starter
       #10

    lol, ok I will reset the flags and give it a whirl.

    Yea, it was pretty rough for awhile today. I'd turn off the flags (I used -hfc, etc which seemed to work) and few mins later it would crash. I'd rush to turn it all back on and then nothing. Figures. It's like taking your car to get fixed and the mechanic can't reproduce the error long enough to find out what is the root of the problem.

    I'll update this post if I get a good crash dump.
      My Computer


 
Page 1 of 3 123 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 09:06.
Find Us