Windows 7 Pro x64 explorer.exe crashing

For what it's worth, I've been experiencing an IDENTICAL problem since I installed the RTM build of Windows 7 Ultimate x64 on my MacBook Pro last month.

The issue also comes and goes for me. :-/

Omikr0n said:

For what it's worth, I've been experiencing an IDENTICAL problem since I installed the RTM build of Windows 7 Ultimate x64 on my MacBook Pro last month.

The issue also comes and goes for me. :-/

Can you clarify in what sense do you believe your crash to be identical to the OPs? Is there more to it than the name of the crashing process - Explorer?

Well, ever since you had me do the gflags /i explorer.exe +htc +hfc +hpc +hvc +htd I have not been able to reproduce the crashing, at all. I can't even get mmc.exe to crash now (i.e. event viewer). I've disabled the debugger and reset the gflags (I did use just +hfc later on like you suggested) back to normal.

I am going to run without debug/gflags for now and wait for another crash to happen. I just can't get it to happen. I have not changed anything since so I don't know what is going on. I've even just reinstalled AVG and 7zip (stable) in effort just to make it crash (incase it was related to those).

If I ever manage to get another crash, I'll fire up the debug stuff and try to reproduce it to get you a dump. So weird. The other day it's crashing on almost every right click and now I can right click until the mouse breaks or my fingers fall off.

I'll be back if I can get you a good dump using the settings you've provided.

update: would running the +hfc and debugger keep the shell from crashing? I can't get it to crash with +hfc and the debug running. /sigh -- it will crash pretty reliably otherwise.

H2SO4 said:

Omikr0n said:

For what it's worth, I've been experiencing an IDENTICAL problem since I installed the RTM build of Windows 7 Ultimate x64 on my MacBook Pro last month.

The issue also comes and goes for me. :-/

Can you clarify in what sense do you believe your crash to be identical to the OPs? Is there more to it than the name of the crashing process - Explorer?

I really do mean in almost every sense.

Random Explorer.exe crashes while browsing local drives, network drives, manipulating folders within the Start Menu, etc. No specific rhyme or reason to it. It seems to come and go every few days, and when it happens, MMC also crashes when attempting to launch.

When it is finally launched, all of the errors logged appear to be related to ntdll.dll.

At when I first started experiencing the crashes, I thought it was related to Norton 2010 Beta and browsing network drives, but that appeared to be simply coincidence since that was simply what I did most often. I no longer have Norton installed, and the crashes also happen while browsing local drives.

To compound things further, I am also experiencing intermittent crashes with my KeePass software, with KeePass reporting memory protection errors.

A 24-hr extended memory diagnostic found no evidence of hardware issues.

Porkrinds said:

update: would running the +hfc and debugger keep the shell from crashing? I can't get it to crash with +hfc and the debug running. /sigh -- it will crash pretty reliably otherwise.

The +hfc thing shouldn't normally alter the frequency of severity of any given crash. Although it's technically possible, it is very rare. The car mechanic analogy you used is a good one - the act of looking at the carburettor shouldn't by itself fix it, unless in doing so the mechanic inadvertantly leaned on something and closed a broken seal :)

To clarify, are you saying that you can no longer get Explorer (or MMC) to crash at all? Or is it just under +hfc that Explorer doesn't crash, ever?

Omikr0n said:

Random Explorer.exe crashes while browsing local drives, network drives, manipulating folders within the Start Menu, etc. No specific rhyme or reason to it. It seems to come and go every few days, and when it happens, MMC also crashes when attempting to launch.

If you've been following this thread, you may wish to try using the same debugger steps to generate memory dumps of your own crashes. I'd be happy to take a look at them and hence attempt to verify whether the pattern looks the same as the OP's crashes.

Yes, when I set +hfc, I am unable to get explorer or mmc to crash at all. It simply has not crashed with that flag set. If I reset them to default (nothing) then I can get it to crash again after trying for a few minutes.

Porkrinds said:

Yes, when I set +hfc, I am unable to get explorer or mmc to crash at all. It simply has not crashed with that flag set. If I reset them to default (nothing) then I can get it to crash again after trying for a few minutes.

Interesting. Can you get a similar dump of the crashing MMC process for comparison?

(If it crashes as soon as it starts, one way to get the debugger attached is to first run just MMC.exe, attach the debugger, and only then "add" the event viewer snap-in.)

H2SO4 said:

Porkrinds said:

Dumps attached per discussion HERE. (Note, these are two new dumps, one from the shell process and the other from a seperate file manager explorer.exe process) - yes I tell explorer to start a new process when starting the file manager, etc.

Excellent write-up. Have rep :)

All 3 of these dumps show a situation called "heap corruption", although the first one is subtly different. "Heap" can be thought of as a region of memory within the process which is allocated to parts of the process as they ask for memory. They must not write over each other's allocations, and it is up to each "part" to ensure that it stays within the confines of what it has allocated for itself.

There are ways to enable special diagnostic heap behaviour, so that the OS pays more attention to who's doing what with heap - at the expense of somewhat degraded performance. That way you can sometimes catch the heap corruptor component in the act, rather than simply witnessing the aftermath later when the corrupted memory is used.

Before we get too carried away, could you please consider temporarily uninstalling 7zip and AVG in order to get rid of their Explorer integration componentry as a test:

Image path: C:\Program Files\7-Zip\7-zip.dll
Image name: 7-zip.dll
Timestamp: Sat Aug 29 20:39:40 2009 (4A99056C)
...
Image path: C:\Program Files (x86)\AVG\AVG8\avgsea.dll
Image name: avgsea.dll
Timestamp: Wed Jul 08 10:22:16 2009 (4A53E6B8)

After that, if the crashes continue, we may need to tweak some settings before generating more dumps.

(BTW, I and others may also be able to help with your MMC crash, but I'd suggest another separate thread for that. The way to get dumps will be a bit different since the process, as I understand it, crashes on startup.)

I never had ie8 crash until i read a thread about how much faster it would run with goggle chromeframe BHO addon installed. Once i did this I then started getting crashes with the heap corruption. so I removed the goggle chrome BHO with hijackthis. and no more heap corruption.

thefabe said:

I never had ie8 crash until i read a thread about how much faster it would run with goggle chromeframe BHO addon installed. Once i did this I then started getting crashes with the heap corruption. so I disabled it and nomore crashing.

In the OP's (Porkrinds's) case it's Explorer.exe that's crashing, not IExplore.exe. His memory dumps don't show much left that's non-default. nVidia control panel stuff, from memory, but that's about it. A curious situation, doubly so because of the recent "heisenbug" development.